SIEM enabled risk management , SOC and GRC v1.0
- 1. SIEM Enabled Risk Management, SOC and GRC 1
- 2. SIEM: A Single View of Your IT Security • SIEM is about looking at what’s happening on your network through a larger lens than can be provided via any one security control or information source. • Your Intrusion Detection only understands Packets, Protocols and IP Addresses • Your Endpoint Security sees files, usernames and hosts • Your Service Logs show user logins, service activity and configuration changes. • Your Asset Management system sees apps, business processes and owners • None of these by themselves, can tell you what is happening to *your business* in terms of securing the continuity of your business processes – but together, they can… • SIEM is essentially, nothing more than a management layer above your existing systems and security controls. • It connects and unifies the information contained in your existing systems, allowing them to be analyzed and cross-referenced from a single interface SAP Cloud Security 2
- 3. SIEM based Risk Management • SIEM is a foundation to security management in 21st Century for provides mostly the post-exploit value • Risk Manager based on SIEM gives detailed assessment of network security risk using broad risk indicators such as: • WHAT HAS HAPPENED? (from network activity data and behavior analysis) • WHAT CAN HAPPEN? (from topology and configuration) • WHAT HAS BEEN ATTEPMTED? (from events and content data) • WHAT IS VULNERABLE AND AT RISK? (from scanners) SAP Cloud Security 3 • Automated and real time «Security Intelligence» is what is needed for GRC • Risk Assessment & Management • IT Security Governance & Management • Control of activities and environment • Performance measurement and improvement • Benefits from better alignment with business (costs saving, efficiency etc.)
- 4. SIEM- 8 Critical Things – At a glance SAP Cloud Security 44
- 5. Logs, flows, maze • What logs – • Audit logs • Transaction logs • Intrusion logs • Connection logs • System performance records • User activity logs • Business systems alerts and different other systems messages SAP Cloud Security 5 • From where – • Firewalls / Intrusion prevention • Routers / Switches • Intrusion detection • Servers, desktops, mainframes • Business applications • Databases • Antivirus software • VPN’s
- 6. SIEM based Risk Management • Assessing the risks = • Log management + • Event management + • Network activity monitoring + • Configuration + • Most successful attacks are result of poor configuration • Configuration audits are expensive, labor intensive and time consuming • Config files are inconsistent across the vendors and product / technology types • Compliance is mandatory in many industries SAP Cloud Security 6 • Vulnerability Assessment + • VA scanners don’t prioritize based on network context • Vulnerability prioritization is historically complex
- 7. Legal Compliance and Laws • EU Data Protection /WP29 • US Data Protection • COPPA,HIPPA,SOX, Safe Harbor • Usage and Purpose of Collection • Conflicts • ES-US Data transfer • Encryption or not • Trade Compliance • Business need vs. Personal need • Information Assymetry SAP Cloud Security 7 • Privacy Policies • Secondary Data Collection • Opt-in and Opt-out • Defaults • Necessity • Tracking • Browser Cookies • Data transfers • Data retention
- 8. What is SOC – Security Operations Center • Providing Security Intelligence by • Detection of IT threats • Containment of IT threats • Remediation of IT threats • Monitors application to identify possible cyber attack ( Event) • Real time Monitoring • Log Collection, Analysis • Reporting/Custom Views • Post Incident Analysis • Forensic • Investigation • Automatic Remediation SAP Cloud Security 8 • Central Location to collect information on • External threats • Internal Threats • User activity • Loss of Personal or sensitive data • Provide evidence in investigations
- 9. Isn't a firewall, IDS or AVS enough ? • Firewall is active and known by attackers • Protect systems , not users • Anti-Virus • Lag time to catch new threats • Matches file, but not patterns SAP Cloud Security 9 • IDS alerts but does not provide context • System Logs, • Proxy Logs, • DNS Logs • Information from other sources
- 10. IBM Qradar Solution Portfolio and vision SAP Cloud Security 10
- 11. SIEM based Risk Management SAP Cloud Security 11
- 12. Sample Security Governance Model SAP Cloud Security 12
- 13. SAP Cloud Security 13 Q & A