Splunk Pla;orm als Security Cockpit

Transkript

1 Copyright 2013 Splunk, Inc. Splunk Pla;orm als Security Cockpit Maier Senior Sales Engineer, CISSP Splunk Deutschland

2 Maschinendaten? Industriedaten / B2B / B2C IT- Infrastruktur IT für End Kunden LogisIk RFID Desktops Web Services Databases Online Shopping GPS/ Mobilfunk Energie Servers Security Developers ApplicaIons Telecoms Social Media Herstellung Networking Messaging Storage Clickstream Cloud Virtuell Hardware 2

3 TradiIonelle SIEM- Systeme Typische SIEM Architektur Data Reduc+on Model Security Informa+on and Event Management ü Normalisierung zerstört Originaldaten ü Vorab wissen was man sucht bevor man es benöigt ü Nützliche Daten kommen von allen Systemen, nicht nur von den vom Hersteller unterstützten ü Weniger Sichtbarkeit durch fehlende Skalierbarkeit ü Herstellerabhängigkeit 3

4 InnovaIv & Einfach Mehrwerte Generieren Adhoc Suche Überwachen/ Alarmieren Repor+ng/ Analyse Anwender- Dashboards Entwickler- PlaCorm Daten: Sammeln & Indizieren Splunk Datenspeicher Andere Datenspeicher 4

5 InnovaIv & Einfach Mehrwerte Generieren Adhoc Suche Überwachen/ Alarmieren Repor+ng/ Analyse Anwender- Dashboards Kein Limit bzgl: Volumen, Quelle & LokaIon Kein Daten vordefiniertes sammeln Schema und indizieren Keine proprietären Konnektoren Kein RDBMS Splunk Daten Keine Vorfilterung/Vorverarbeitung Entwickler- PlaCorm Andere Datenspeicher 5

6 Splunk Mehrwerte für IT & Business App Entw & App Mgmt. IT Betrieb IT- Sicherheit & Compliance Web Intelligence Geschägs- prozesse Prozessdaten Entwicklungspla;orm (REST API, SDKs) Small Data. Big Data. Huge Data. 6

7 FerIge Apps Mehrwerte für IT & Business IT Betriebs- Management Web Analyse Anwendungs- Management Geschägsprozesse IT- Sicherheit und Compliance Kunden- Support Management Betriebs- Teams Business- Analysten System- Anwendungs- IT- Sicherheits- Auditoren/ Administratoren Entwickler Prüfer Analysten 7 IT Manager

8 One SoluIon; Three Main Offerings Weather' BigFix' Sendmail' PDF'Report'Server' F5'' Radio'StaAons' WebSphere' XenDesktop' NetScaler' MulAcast' MS'Exchange' FISMA 2. Other security apps (free) Ruby'on'Rails' Google'Maps' Whois'lookup' PCI'Compliance' Puppet'Conf.'Mgt' Python'Mail' NetFlow' Audible'Alerts' Stock'Quote' FISMA'Monitoring' TwiWer' Windows' Nagios' Unix'and'Linux' Sourcefire' Splunk'Monitoring' SNORT' FireEye'Malware' ES POST/GET'Rqsts' Citrix'NetScaler' 3. Splunk App for Enterprise Security Security' Javamail' BlueCoat'ProxySG' Solera'DeepSee' IMAP' YouTube' Encrypt/Decrypt' Enterprise'Security' AS/400'3'iSeries' TransacAon'Profiling' Security' SCOM' TCP/UDP'Sending' IronPort IronPort'WSA' RSS'Input' JMS'receiver' Geo'LocaAon' VMware' Fin.'Inf.'eXchange' Developer Framework Splunk'Mobile' 1. Splunk Enterprise 8

9 Splunk App for Enterprise Security First soluion with out- of- the- box content to manage known and unknown threats. Security Analysts SOC Staff Security Execs/Mgrs Security Auditors " Scalability to manage muli- terabytes of real- Ime and historical data " Pre- built security correlaion rules, reports, and dashboards " StaIsIcal analysis for defining normal " Incident invesigaion and management framework

10 Find Advanced, Hidden Threats Step 1 Collect ALL the data in one locaion Step 2 Baseline/idenIfy normal acivity Step 3 Find outliers/anomalies Abnormal pa@erns/correlaions within normal aciviies What is rarely seen or standard deviaions off the norm What is different/new/changed Helpful Splunk search commands using math/stats include: stddev, outlier, count, rare, top, stats, cluster, transacion, predict 10

11 Sample Use Case: Traffic Size Analysis Compare traffic data with staisical data to find outliers Drill- down to look for anomalous source/ dest traffic IdenIfy suspicious data exfiltraion 11

12 Sample Use Case: New Domain Analysis Hosts talking to recently registered domains Discover outlier acivity to newly registered domains IdenIfy unexpected top level domain acivity 12

13 HEUTE STARTEN GANZ EINFACH! & Installieren in wenigen Minuten 1. Download & Install 2. Import von Maschinendaten 3. Start Splunking! 13