how to turbocharge your cyber security incident response with automation

© 2016 Ayehu Software Technologies, Ltd. All rights reserved.

How to Turbocharge Your Cyber Security Incident

Response With Automation

February 24, 2016starting at

12:00pm EST / 9:00am PST

http://www.ayehu.com/



Today’s webinar will be presented by:

Guy NadiviDirector, Business

Development


slide 2

Sharon Cohen, CISM

IT & Security Professional Services Manager



Company Background

• Leading innovator of IT Process Automation Software

• Founded in 2007, Headquarters in New York

• Product first launched in 2009

• Flagship product: eyeShare™ IT Process Automation v4.7.3

• Eric Benhamou, former CEO of 3Com and Palm, BGV currently

slide 3© 2016 Ayehu Software Technologies, Ltd. All rights reserved.




Sample of eyeShare Users




Agenda


#1Why you should

automate Cyber Security

Incident Response

#2The concerns

of running automation in Cyber Security

Incident Response

#3A real life

scenario of automating

Incident Response



What Is A Cyber Security Incident Response?


An organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident).

The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.

source: searchsecurity.techtarget.com/definition/incident-response

An organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident).

The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.



What Is A Cyber Security Incident Response?


source: Gartner - "Top Security Trends for 2016-2017"



Why Automate Cyber Security Incident Response?


“71% of represented organizations experienced at least one successful cyberattack in the preceding 12 months (up from 62% the year prior)”.

source: 2015 Cyberthreat Defense Report from the CyberEdge Group

205 - median number of days that threat groups were present on a victim’s network before detection (Longest Presence: 2,287 days)

source: "Beyond the Breach" - Mandiant 2015 Malware Report

Malicious cyber attacks cost US$300 Billion to US$1 Trillion a year!

source: "THE ECONOMIC IMPACT OF CYBERCRIME AND CYBER ESPIONAGE Report" - Center for Strategic and International Studies July 2013





“By 2019, 40% of large enterprises will require specialized, automated tools to meet regulatory obligations in the event of a serious information security incident.”

source: Gartner





Lack of qualified staff Lack of necessary expertisePeople don’t scale very well





When it comes to remediating security breaches, automation is a force multiplier



Concerns About Automating Cyber Security Incident Response


Too Many False Positives In Security



Concerns About Automating Cyber Security Incident Response


In Security (& elsewhere) False Positives Are Distressing



Automating Cyber Security Incident Response




Automating Cyber Security Incident Response


A security playbook is a customizable template for specific cyber security incidents, that streamlines an organization's response procedures using best practices.

Playbook



Ayehu Case Study


Dual Logins By The Same Individual From Different Locations

• A user logs in from one location.

• The same user then logs in 15 minutes later from another location 30 miles away.

• Is the first login legitimate, but the second one fraudulent? Or is it the other way around? Maybe they’re both fraudulent?

• How do you automate the process of determining which login (if any) is legitimate?



Sharon Cohen


slide 17



Demo




Top 3 Features


slide 19

No Programming !



Top 3 Features


slide 20

No Agents !

