breaches detection using cognitive threat analytics (cta) › file › cybersecurity2016 › ... ·...
TRANSCRIPT
-
Karel Simek,
Technical Marketing Engineers
January 2016
Breaches Detection Using Cognitive Threat Analytics (CTA)
-
There’s a new cyber-threat reality
Hackers will likely
command and control
your environment via web
You’ll most likely be
infected via email
Your environment
will get breached
-
BEFORE Discover Enforce Harden
DURING Detect Block Defend
AFTER Scope
Contain Remediate
Network Endpoint Mobile Virtual Email & Web
Continuous Point-in-time
Cloud Strengthen proactive analysis / after phase
(continuous monitoring, analytics, machine learning)
Advanced Threat Detection Requires Greater Visibility
-
“65% of CEOs say their risk management
approach is falling behind. In a new reality
where security breaches come at a daily rate,
we must move away from trying to achieve the
impossible perfect protection and instead invest in
detection and response. Organizations should
move their investments from 90 percent
prevention and 10 percent detection and
response to a 60/40 split.”
Peter Sondergaard
Senior VP and Global Head of Research
Gartner
-
CTA enhances web security with layers of breach detection
and analytics to identify difficult-to-find threats
With Cognitive Threat Analytics (CTA)
Anomalous Web requests
Threat Incidents
Malicious Events
Anomaly
detection Trust
modeling
Event
classification
Relationship
modeling
10B requests
per day
20K incidents
per day
-
CTA: Breach Detection Results
20k breaches daily On a sample of 10B we requests
10 breaches @ 1000 seats weekly FW/NGFW
NGIPS
Antivirus
Reputation/Rules
Policy/Patches
Web Security
CTA
60% increased
breach detection Based on Cisco internal testing
-
CTA in Customer Environment
-
CTA as part of Customers’ Security Strategy
3. CTA makes your SIEM intelligent
1. CTA turns your proxy into a security sensor
2. CTA helps you shorten breach reaction time
-
1. CTA turns your proxy into a security sensor
-
CTA turns your proxy into a security sensors
Server IP | URL | User | Rule Action | …. 75.82.2.16 | www.xydsdd.com/ | oskiemk | Blocked | 78.84.3.16 | www.xproex.com/ | jsmith | Allow| 75.82.2.16 | www.cnn.com/new | pjames | Allow| 75.82.2.16 | www.tripcost.com/ | Mozilla | Blocked | 75.82.2.16 | www.78.87.53.16/ | Mozilla | Blocked | 75.82.2.16 | www.xydsdd.com/ | Mozilla | Blocked | 75.82.2.16 | www.xydsdd.com/ | Mozilla | Allowed | 75.82.2.16 | www.xydsdd.com/ | Mozilla | Blocked |
75.82.2.16 | www.xydsdd.com/ | Mozilla | Blocked | 75.82.2.16 | www.xydsdd.com/ | Mozilla | Blocked | 75.82.2.16 | www.xydsdd.com/ | Mozilla | Blocked | 75.82.2.16 | www.seznam.com/ | Mozilla | Allow | 75.82.2.16 | www.google.com/ | Internet Exp. | Allow| 75.82.2.16 | www.xydsdd.com/ | Mozilla | Blocked |
CTA
Context
Advanced Correlation
Long term modeling
Anomaly Detection
WHAT&WHEN
http://www.xydsdd.com/http://www.xydsdd.com/http://www.xydsdd.com/http://www.xydsdd.com/http://www.tripcost.com/http://www.tripcost.com/http://www.xydsdd.com/http://www.xydsdd.com/http://www.xydsdd.com/http://www.xydsdd.com/http://www.xydsdd.com/http://www.xydsdd.com/http://www.xydsdd.com/http://www.seznam.com/http://www.seznam.com/http://www.google.com/http://www.google.com/http://www.xydsdd.com/
-
Cisco WSA (Web Security Appliance)
External Telemetry (BlueCoat Sec. Gateway)
Cisco CWS (Cloud Web Security)
Cisco
Cognitive Threat
Analytics (CTA)
Confirmed Threats
Detected Threats
Threat Alerts
Incident
Response HQ
STIX / TAXII API
CT
A
CT
A
CT
A
SIEMs:
Splunk, ArcSight,
Q1 Radar, ...
HQ
Web Security
Gateways
Cloud
Web Security
Gateways CTA a-la-carte
ATD bundle = CTA & AMP
WSP bundle = CWS & ATD
CTA a-la-carte
CTA a-la-carte
Web Access Logs (input telemetry)
Breach Detection &
Advanced Threat Visibility
Cognitive Threat Analytics For CWS, WSA, and External Telemetry
-
2. CTA helps you shorten breach reaction time
-
Malware leads to more malware Avalanche Effect of a Breach
If (optimistically)
1% of infections
make it through…
…Then those are
leveraged over and over
again in escalating series
of malicious operations
Click fraud
Pony
password
stealer
Data stealer
Subsequent targeted mission
Ransomware
RAT
Click fraud
Click fraud Malware injection
-
Simplified Integration
-
CTA: Responding To Active Breach
IPS
ISE IT Team
CTA AMP For Endpoint
SIEM
AMP For Endpoint
Breach Detection Immediate Reaction Final Reaction
Swiftness and Automation
Goal: disrupt malware
channels avoid immediate
risk of data leak
Thoroughness and Adaptation
Goal: Follow breadcrumbs to
the root cause, loss estimates,
policy updates
-
CTA: C2 Detected Ongoing Breach 10min
Breach Detection Immediate Reaction Final Reaction
-
10min
Breach Detection Immediate Reaction Final Reaction
-
ISE: Immediate User Quarantine 15min
Breach Detection Immediate Reaction Final Reaction
-
AMP4E: Immediate C2 Blocking 20min
Breach Detection Immediate Reaction Final Reaction
-
AMP4E: Finding Files Generating C2 20min
Breach Detection Immediate Reaction Final Reaction
-
AMP4E: Unloading Malware
Unknown
30min
Breach Detection Immediate Reaction Final Reaction
-
• Malware C2 and main modules have been disrupted
• Infected machines can no longer operate on the network
• Get some sleep, we still need to do some cleaning…
Immediate Reaction Done
Breach Detection Immediate Reaction Final Reaction
45min
-
AMP4E+SIEM Forensics: Root Cause 1 day
User mistake? Vulnerable app? New exploit?
Breach Detection Immediate Reaction Final Reaction
-
• Ticket created automatically
• Infected machine reimaged to prevent reinfection as malware often has additional modules and hurts machine security in general
Desktop Team: Reimaging Machine 2 days
Breach Detection Immediate Reaction Final Reaction
-
3. CTA makes your SIEM intelligent
-
CTA Simplifying SIEM Workflow CTA is a starting point for investigations
SIEM Limitation
• No detection, only forensics
• Only simple manual correlations,
analyst time-intensive
• Does not generate local security
intelligence
CTA-Enabled SIEM
• Provides prioritized workflow
• Detection of visibility of novel and
emerging threats
• Automatic adaptation with
continuous detection
• Localized security intel
-
Building a Security Dashboard With CTA Intel
-
• CTA delivers superior breach detection
• CTA provides you with web traffic visibility
• CTA makes your SIEM smarter
Key Takeaway Messages
-
Q&A
-
Additional Resources
-
The Business of Malware; CTA Overview by Martin Rehak (co-founder of Cognitive Security)
• http://slideslive.com/38894173/breaking-the-business-of-malware
Identify Zero-Day Breaches with CTA on Cisco Web Security by Petr Cernohorsky (Product Mgr)
• http://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-security
CWS Premium / Cognitive Threat Analytics on Cisco YouTube Channel
• https://www.youtube.com/watch?v=QFCJgpQOopk
• https://youtu.be/K-fpDDJLJKs?list=PL6FEA443253B44EC2 ... customer reference
Manuals on log export from WSA and BlueCoat
• http://www.cisco.com/c/dam/en/us/td/docs/security/web_security/scancenter/deployment/guide/Configure_WSA_Upload.pdf
• http://www.cisco.com/c/dam/en/us/td/docs/security/web_security/scancenter/deployment/guide/Configure_Blue_Coat_ProxySG_Upload.pdf
External CTA Videos, References, Manuals
http://slideslive.com/38894173/breaking-the-business-of-malwarehttp://slideslive.com/38894173/breaking-the-business-of-malwarehttp://slideslive.com/38894173/breaking-the-business-of-malwarehttp://slideslive.com/38894173/breaking-the-business-of-malwarehttp://slideslive.com/38894173/breaking-the-business-of-malwarehttp://slideslive.com/38894173/breaking-the-business-of-malwarehttp://slideslive.com/38894173/breaking-the-business-of-malwarehttp://slideslive.com/38894173/breaking-the-business-of-malwarehttp://slideslive.com/38894173/breaking-the-business-of-malwarehttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttp://www.slideshare.net/CiscoSecurity/identify-zeroday-breaches-with-cognitive-threat-analytics-on-cisco-web-securityhttps://www.youtube.com/watch?v=QFCJgpQOopkhttps://www.youtube.com/watch?v=QFCJgpQOopkhttps://youtu.be/K-fpDDJLJKs?list=PL6FEA443253B44EC2https://youtu.be/K-fpDDJLJKs?list=PL6FEA443253B44EC2https://youtu.be/K-fpDDJLJKs?list=PL6FEA443253B44EC2http://www.cisco.com/c/dam/en/us/td/docs/security/web_security/scancenter/deployment/guide/Configure_WSA_Upload.pdfhttp://www.cisco.com/c/dam/en/us/td/docs/security/web_security/scancenter/deployment/guide/Configure_WSA_Upload.pdfhttp://www.cisco.com/c/dam/en/us/td/docs/security/web_security/scancenter/deployment/guide/Configure_WSA_Upload.pdfhttp://www.cisco.com/c/dam/en/us/td/docs/security/web_security/scancenter/deployment/guide/Configure_Blue_Coat_ProxySG_Upload.pdfhttp://www.cisco.com/c/dam/en/us/td/docs/security/web_security/scancenter/deployment/guide/Configure_Blue_Coat_ProxySG_Upload.pdfhttp://www.cisco.com/c/dam/en/us/td/docs/security/web_security/scancenter/deployment/guide/Configure_Blue_Coat_ProxySG_Upload.pdfhttp://www.cisco.com/c/dam/en/us/td/docs/security/web_security/scancenter/deployment/guide/Configure_Blue_Coat_ProxySG_Upload.pdf
-
Angler EK detection by Cognitive Threat Analytics (CTA)
• http://blogs.cisco.com/security/angler-for-beginners
Fake blogs generating real money
• http://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-money
Cognitive Research: Learning Detectors of Malicious Network Traffic
• http://blogs.cisco.com/security/talos/machine-learning-detectors
Cognitive Threat Analytics – Transparency in Advanced Threat Researc
• http://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-research
Bad Browser Plug-ins Gone Wild: Malvertising, Data Exfiltration, and Malware, Oh my!
• http://blogs.cisco.com/security/talos/bad-browser-plug-ins
CTA Security Blog
http://blogs.cisco.com/security/angler-for-beginnershttp://blogs.cisco.com/security/angler-for-beginnershttp://blogs.cisco.com/security/angler-for-beginnershttp://blogs.cisco.com/security/angler-for-beginnershttp://blogs.cisco.com/security/angler-for-beginnershttp://blogs.cisco.com/security/angler-for-beginnershttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/cognitive-research-fake-blogs-generating-real-moneyhttp://blogs.cisco.com/security/talos/machine-learning-detectorshttp://blogs.cisco.com/security/talos/machine-learning-detectorshttp://blogs.cisco.com/security/talos/machine-learning-detectorshttp://blogs.cisco.com/security/talos/machine-learning-detectorshttp://blogs.cisco.com/security/talos/machine-learning-detectorshttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/cognitive-threat-analytics-transparency-in-advanced-threat-researchhttp://blogs.cisco.com/security/talos/bad-browser-plug-inshttp://blogs.cisco.com/security/talos/bad-browser-plug-inshttp://blogs.cisco.com/security/talos/bad-browser-plug-inshttp://blogs.cisco.com/security/talos/bad-browser-plug-inshttp://blogs.cisco.com/security/talos/bad-browser-plug-inshttp://blogs.cisco.com/security/talos/bad-browser-plug-inshttp://blogs.cisco.com/security/talos/bad-browser-plug-inshttp://blogs.cisco.com/security/talos/bad-browser-plug-ins