Log management is one of the primary requirements for building an enterprise class SOC. In security, Log analysis is often the first step in incident forensics. Operating systems such as windows, Unix, Linux and other network devices such as routers, firewalls etc. offer native log management capabilities but are not sufficient for organizations because of a variety of reasons. First, due to storage constraint older logs are overwritten by the most recent logs. Second, log collection for network devices, OSs are not reliable and are often not in the same format rendering analysis difficult. Another challenge is that the logs are distributed across devices and are not centrally stored or managed.

image courtesy: https://www.flickr.com/photos/purpleslog/2870445260

Some of the benefits of log management are :

• Logs  often provide the first hand evidence in cyber forensics and are often invaluable in investigating security incidents and auditing. Log management help make forensics and investigation much easier.
• Logs feeds SIEM solution for continuous security monitoring. A better log management speeds-ups the correlation engine and provide better insights by  reducing noise in analysis results.
• Log management helps managing compliance requirements as they require organizations to index log events for easy accessibility and search capability
• Log management can help optimize the storage requirements by discarding unimportant logs

( Read More: Checklist To Evaluate SIEM Vendors )

Below is the list of couple of open-source Log Management tools which provide the capability of reliable log collection, Log normalization and relaying of Log messages to a central location for their log time storage.

1. Syslog-ng

syslog-ng allows you to flexibly collect, parse, classify, and correlate logs from across your infrastructure and store or route them to log analysis tools

2. rsyslog

Rsyslog is an open-source software utility used on UNIX and Unix-like computer systems for forwarding log messages in an IPnetwork. It implements the basic syslog protocol, extends it with content-based filtering, rich filtering capabilities, flexible configuration options and adds features such as using TCP for transport.

3. Log2timeline

Log2timeline is a tool designed to extract timestamps from various files found on a typical computer system(s) and aggregate them. Plaso is a Python-based backend engine for the tool log2timeline.

4.Logalyze

LOGalyze is an open source, centralized log management and network monitoring software. If you would like to handle all of your log data in one place, LOGalyze is the right choice. It supports Linux/Unix servers, network devices, Windows hosts. It provides real-time event detection and extensive search capabilities.

5.Gray Log

Graylog2 collects and aggregates events from a multitude of sources and presents your data in a streamlined, simplified interface where you can drill down to important metrics, identify key relationships, generate powerful data visualizations and derive actionable insights.

6. Fluentd

Fluentd is an open source data collector, which lets you unify the data collection and consumption for a better use and understanding of data.

( Read More: Top 10 'Incident Response & SIEM' talks from RSA Conference 2016 (USA) )

Pre-Register for SACON International 2017. Click on the image below to pre-register

SACON is India's 1st & Only Security Architecture Conference. With over 60 participants, this was the first year of SACON and here are a few highlights we wanted to share with you. It was held on 12th July, Ritz Carlton, Bangalore, India.

We had with us Top Security Industry Leaders who helped SACON with great content. For more details visit: sacon.io

( Read More: ATP( Advanced Threat Protection) Technology Stack )

What We Covered? (Key Highlights)

• Need for Security Architecture and Key Challenges

• Security Architecture Models and Views ( TOGAF, Zachman, SABSA etc. )

• Security Architecture Process and Deliverables

• CISO Platform Security Strategy Model & Comparison to existing models

• Threat Modeling and Security Architecture Planning

• Google's Innovative Approaches - Google's Beyond Corp

• Benchmarking Your Security Program

• Building The Threat Model Of An Example Application

• AppSec Program Creation - An Organisational Situation Solved Using OpenSAMM & BSIMM Controls

• HandsOn Workshop On Designing Security Architecture For Your Organisation

• Combination of latest technologies like EDR, SA, AMP and more to build your ATP Security Architecture

( Read More: Checklist To Assess The Effectiveness Of Your Vulnerability Management Program )

Presentations

Click on each presentation name to open slide in new tab

• SACON Orientation by Bikash Barai [ Co-Founder Cigital India ( Earlier iViZ ) ]
  
  
• Enterprise Security Architecture by Arnab Chattopadhayay [ Senior Technical Director @MetricStream ]
  
  
• From Business Architecture to Security Architecture by Vinayak Godse [ Senior Director-Data Protection @DSCI ]
  
  
• Practical Enterprise Security Architecture by Dr. Rajesh P. Deo [ Senior Manager @Ernst&Young ]
  
  
• Security Maturity Models by Ravi Mishra [ Head Of Advisory @CISO Platform ]
  
  
• Application Threat Modeling by Nilanjan De [ Principal Architect @Cigital ]
  
  
• ATP Technology Pillars by  Bikash Barai [ Co-Founder Cigital India ( Earlier iViZ ) ]

Photo Album

Some great photographs have been compiled into an album. Help us Tag you ( Tag yourself  ) and let us know if you want to add some pictures you took at the event. Email - pritha.aash@cisoplatform.com

Here's the Photo Album link - https://goo.gl/CHqLkr

Video: What Were Your TakeAways?

Pre-Registrations For Annual Summit Is Now open! Click Here To Know More

Read More: Pre-launch Preview: State of Security Technology Adoption in Enterprises - Annual Report 2015

We are happy to announce the results of the annual survey of Security Buying Status in which 230 Companies have participated in the enterprise segment. We define enterprise as organisations that have 5000+ employees. This is a preview of the key findings on the buying of various security technologies.

About The Report

• The Data was collected from various online and offline sources like CISO Platform Security Benchmarking, Programs, Buying Advisory by CISO Platform Analysts, Surveys (online & offline during events)
• Total sample size 230 enterprises
• We define enterprise as 5000+ employees
• Complete report coming soon

(Key Insights) IT Security Buying Trends:

• Threat Intelligence and Forensics (Network, Endpoint) are the most sought out solutions with 47 % of the enterprises said they are planning to Implement Forensics and Threat Intelligence this year

• Even though the demand for APT (Advanced Persistent Threat) Security solutions is high, market understanding of various use cases and technologies is not, as APT Security is a broad spectrum of solution and not a point product. 44% of the organization said that they are planning to implement APT Security this year
  
  
• India is at 75-80% par to US in terms of Prevention and Detection capabilities, whereas 10% par in terms of Response and Prediction. And when we compare in terms of adopting emerging technologies, India is less than 10% at par
  
  
• Almost 2 out of 5 Enterprise in India are still not ready to implement Forensics this year

• Telecom is the most mature market in terms of implementation of these emerging cyber-security technologies whereas Manufacturing is the least matured market

Recommendations:

• Many organizations are still struggling with this issue of mobile devices and the bring-your-own device concept and hence that drives the demand of Mobile Device Management in India.
• APT Security is not a single technology/solution but a complex program (people, process and technology ). Sandboxing or any single technology can only provide partial protection against “real” advanced attacks. We suggest organisations to look at the complete stack of technologies and build a holistic program to secure against advanced attacks.

Survey Objectives

The primary objectives of this survey is to find:-

• The latest trends in Information Security Buying
• Maturity Level of various Industry domains like BFSI, Telecom, IT/IES etc.
• Emerging Technologies to look out for in 2016

Data Insights

Figure 1: Domain of Survey Participants

In Figure 1, we can see that majority of respondents are from BFSI domain with 35% of respondents whereas IT/ITES makes up to 24% in the survey. Public organization accounts to 7% of the respondents.

Figure 2: Emerging Technologies of 2016

In Figure 2, we can see that 47.2% of the enterprise planning to implement Forensics this year and emerged out as most emerging technology. Similarly, 47% planning Threat Intelligence this year.

State of Implementation of Key Security Technologies

1. Forensics (Network, Endpoint):

Forensics is the science of application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in such a way that it serves as digital evidence in court of law

• 15.5% Already have Forensics in place
• 47.2% of the enterprise says they are Planning to Implement this year and
• 37.3% organization still believes they are not ready to implement Forensics this year.

Figure 3: Implementation Status of Forensics in 2016

The breakup of Implementation Status of Forensics across domains in India in 2016 is mentioned in a Table1: Telecom and Retail emerged out as the matured industry in terms of implementing Forensics whereas surprisingly BFSI emerged out as least matured in implementing Forensics.

2. Threat Intelligence:

Threat Intelligence is the act of proactively gathering threat information and identifying, collecting and enriching the relevant information and subsequent analysis of the gathered information. Thus businesses continue to run with comprehensive intelligence and they are enabled to proactively stop threats and monitor their network to quickly respond to and resolve attacks.

• 32% Already have Threat Intelligence in place
• 47% of the enterprise says they are Planning to Implement this year
• 21% organization still believes they are not ready to implement Threat Intelligence this year.

Figure 4: Implementation Status of Threat Intelligence in 2016

 The breakup of Implementation Status of Threat Intelligence across domains in India in 2016 is mentioned in a Table 2: Telecom and Major IT/ITES emerged out as the matured industry in terms of implementing Threat Intelligence whereas Media/Entertainment is least matured industry in terms of having Threat Intelligence in place.

3. APT (Advanced Persistent Threat) Security:

For Comprehensive APT Security, multiple products are required and it can be split into various channels like End-Point, Network, Email and Solution with some of Tech Stack capabilities like NGFW etc.

• 37% Already have APT Security in place
• 44% of the enterprise says they are Planning to Implement this year
• 19% organization still believes they are not ready to implement APT Security this year.

Figure 5: Implementation Status of APT Security in 2016

The breakup of Implementation Status of APT Security across domains in India in 2016 is mentioned in a Table 3: Telecom and BFSI emerged out as the matured industry in terms of implementing APT Security whereas Manufacturing is least matured industry in terms of having APT Security in place.

4. Mobile Device Management (MDM):  

It brings together people, processes and technology focused to manage mobile devices, wireless networks, and other mobile computing services in a business context.

• 48.8% Already have Mobile Security in place
• 42.3% of the enterprise says they are Planning to Implement this year
• 8.9% organization still believes they are not ready to implement Mobile Security this year.

Figure 6: Implementation Status of MDM in 2016

The breakup of Implementation Status of MDM Security across domains in India in 2016 is mentioned in a Table 4: Public Sector and BFSI emerged out as the matured industry in terms of implementing MDM Security whereas Media/Entertainment is least matured industry in terms of having MDM Security in place.

5.  SIEM (Security Information and Event Management) /SOC (Security Operations Center): 

It’s a cyber security product or service that combines the effect of (a) Security Information Management (SIM) and (b) Security Event Management (SEM) and thus combined performs two functions-
(a) centrally storing logs allowing real time analysis and
(b) carrying out trend analysis by collecting data into a central repository and thus providing automated reporting for compliance and centralized reporting.

• 50% Already have SIEM/SOC in place
• 41.7% of the enterprise says they are planning to implement this year
• 8.3% organization still believes they are not ready to implement SIEM/SOC this year.

Figure 7: Implementation Status of SIEM/SOC in 2016

The breakup of Implementation Status of SIEM/SOC Security across domains in India in 2016 is mentioned in a Table 5: BFSI and Minor IT/ITES emerged out as the matured industry in terms of implementing SIEM/SOC whereas Media/Entertainment Sector is least matured industry in terms of having SIEM/SOC Security in place.

This report is not comprehensive as this covers only the Top 5 Emerging Buying Trends. For comprehensive report, please contact us at analyst@cisoplatform.com

Pre-Registrations For Annual Summit Is Now open! Click Here To Know More

Speaker: Nilanjan De, Principal Architect @Cigital

Speaker: Vinayak Godse, Senior Director-Data Protection @DSCI

Please Note - Speaker presentations represent the views of the individual speakers and not of CISO Platform or their employers

Speaker: Bikash Barai, Co-Founder Cigital India ( Earlier iViZ )

Please Note - Speaker presentations represent the views of the individual speakers and not of CISO Platform or their employers

Speaker: Ravi Mishra, Head Of Advisory @CISO Platform

Please Note - Speaker presentations represent the views of the individual speakers and not of CISO Platform or their employers

Speaker:Arnab Chattopadhyay, Senior Technical Director @MetricStream

*We suggest you use Chrome to view the slides, as the it may be inaccessible on other browsers like safari etc.

Please Note - Speaker presentations represent the views of the individual speakers and not of CISO Platform or their employers

Speaker: Dr. Rajesh P. Deo, Senior Manager @Ernst&Young

*We suggest you use Chrome to view the slides, as the it may be inaccessible on other browsers like safari etc.

Please Note - Speaker presentations represent the views of the individual speakers and not of CISO Platform or their employers

Speaker: Bikash Barai, Co-Founder Cigital India ( Earlier iViZ )

Please Note - Speaker presentations represent the views of the individual speakers and not of CISO Platform or their employers

Ransomware is a type of malicious software (malware) when infected with encrypts all the important files such as documents, pictures, movie file etc with a virtually unbreakable encryption key. Here we have compiled some of the Good-reads blogs, articles, freely available Decryptors and removal kits to keep you up-to-date on the latest happenings in the Ransomware space.

1. (Free tools) AVG announces 6 new free decryption tools to retrieve your encrypted files : AVG has come out with six new tools designed to fight this affliction. Each is for a different form of this malware.
According to AVG These new free tools are for the decryption of six current Ransomware strains: Apocalypse, BadBlock, Crypt888, Legion, SZFLocker, and TeslaCrypt.

2. Locker Ransomware author dumps database of private keys, apologizes : Allegedly, the author of the "Locker" ransomware has uploaded a dump of the C2 server database, releasing private keys of infected hosts worldwide to the public.  The "author" claims that the release was a mistake, that no further keys will be utilized for encryption, and that automatic decryption of all affected hosts will begin on June 2nd 2016

3. (Free tool) ESET releases new free decryptor for TeslaCrypt ransomware: After TeslaCrypt authors announced that they are closing down their operations and made public their Universal master decryptor key, ESET created a free decryptor tool to unlock files affected by all variants between 3.0.0 and 4.2 of this Ransomware.

4. Ransomware removal kit published online, helps streamline infection response: A security researcher has made a Ransomware removal kit available online with the hope that it will help security professionals and system administrators alike in responding to instances of Ransomware infection. Researcher Jada Cyrus has published the kit on Atlassian Bitbucket. The kit itself consists of removal tools for common ransomware variants, as well as guides on how to perform the necessary removal tasks.

5. What is Ransomware and 15 Easy Steps To Keep Your System Protected [Updated]: A very comprehensive and updated guide on Ransomware. This Blogs outlines target vectors, attack anatomy, Ransomware families and much more.

( Read More: Checklist To Evaluate SIEM Vendors )

6. Behaviour analysis of CERBER ransomware: The Ransomware so called CERBER has been out since early march according to TrendMicro and so far has used different techniques for delivering the payload to the victim. For instance it has been seen to use compressed JavaScript files (.zip) or in other instances using Windows Script Files (WSFs) which had XML content and then executed by Windows’ wscript.exe utility.

7. When the cryptolocker strikes: Reasons for ransomware success and ways to prevent : What factors lead to the high success of cryptolockers, a type of Ransomware that scrambles your files and asks for a ransom to recover them again?

8. Catching Ransomware infections with a Honeypot script & integration into Zerto Virtual replication: This script uses the honeypot technique to detect Ransomware infections by comparing 2 files, a honeypot file and a witness file. 

9. "Zepto" the new threat: Analysis and anatomy of New Ransomware known as "Zepto". The blog talks about how Zepto infects target computer and how to detect for its behaviour.

10. How to trade Bitcoins: Practically, all Ransomware attackers demand ransom in Bitcoins. Bitcoin are a relatively new currency which has significantly increased in value over the past few years. Bitcoins are known as a cryptocurrency and can be traded in order to earn money.

11. Ransomware thats 100% pure Javascript, no download required: By the start of 2016, many crooks were steadily shifting their infection strategy as the world began to realise that enabling macros was a really bad idea. These days, a lot of ransomware arrives in JavaScript attachments and this blogs analyses and presents the challenges associated with the same.

( Read More: ATP( Advanced Threat Protection) Technology Stack )

We believe, isn't a single technology/solution but is a complex program which consists of people, process and technology. Sandboxing or any single technology can only provide partial protection against “real” advanced attacks. We suggest organizations to look at the complete stack of technologies mentioned below and build a holistic program to secure against advanced attacks.

Advanced Threat Detection: ATP Products generally leverage one or more of the below mentioned techniques-

• Sandboxing: This improves the detection rates of ransomware and will enable an organization to identify customized or tailored malware which is beyond the recognition capability of traditional Antivirus.
  
  It creates a safe environment to analyse suspicious files, either cloud-based or On-Premise: 
  
  
  • Virtual Sandbox & Physical Sandbox : For Virtual Machine aware malware. 

• Security Analytics: Correlation & analysis of data from across the IT infra for identifying threats
  
  
  • Behavioural Analytics (Network & User) ; Heuristics; Machine Learning 

• Application Containerization: Isolates applications in a micro-virtual machine. It can help to reduce the load on the overall resources available.

• Embedded URL Analysis: For analysing suspicious URLs sent via emails etc.
  
  
  • URL Rewriting – For real-time click protection; URL Tracking / Tracing

( Read More: Threat Intelligence (Workshop Presentation) )

• Network Traffic Analysis: This will enable ATP to detect inbound and outbound threats as well as suspicious IPs, URLs, Known C&C and other attacker behavior across the entire attack lifecycle.

• IOC Detection: Once detected, IOC can be used to quickly locate other infected devices

• File Reputation Analysis, Whitelisting, Blacklisting

• Static Code Analysis: Examine the code without executing the file for threat protection

• Threat Intelligence: Provides Intelligence about emerging threats from across the globe 

It's time to go beyond using sandboxing as a standalone capability rather an organization needs to have a holistic approach for their ATP Program. You need to have efficient and robust analysis tools that can integrate with your existing security ecosystem and can continuously detect the most advanced threats.

But as Kevin Mitnick, World's Famous Hacker says "A company can spend hundreds or thousands of dollars on Firewall, IDS/IPS, ATP and other security technologies, but if attacker can call one trusted person within the company, and that person complies, and if attacker gets in, then all that money spent on technology is essentially wasted." Therefore, processes and people also play a crucial role in establishing the strong ATP Program.

( Read More: 9 Top Features To Look For In Next Generation Firewall (NGFW) )

The quantity of vulnerabilities are exploding in today’s dynamic environments, while attackers are exploiting them faster than ever before—and with greater sophistication and stealth. In so- called “zero-day attacks,” exploits are created for vulnerabilities in which a patch has not been released. In fact, X-Force found that 77 percent of all exploitable vulnerabilities have a public exploit available on the very same day.3 Then, in addition to the potential lag time between the disclosure of vulnerabilities and the availability of a patch, organizations need time to determine which systems are affected, prioritize their remediation, and take corrective action to patch those machines.

What Will You Learn?

• Understanding the threat landscape

• Combining vulnerability management with risk management

• Closing the gaps in risk and vulnerability management

>>Download Complete Report Here

An average CISO Tenure is 17 months. This is why we brought up the burnout issue. Some of the factor are listed below:

CISO Role Expectations-

• Prevent any security risks in an enterprise (Superpower Expectation)
• Communicate & drive security in terms of business
• IT Security Infrastructure (Scale it from the present condition)

To secure the enterprise, the CISO must use tools/security products. Here's a challenge in itself. The number of IT Security Vendors and Products are ever increasing. It's not even robust, a single google search doesn't give much insight into the numbers of the same. This results in decision complexity increases many folds. As a community initiative we are taking steps to make this less challenging for you (For details send a mail at analyst@cisoplatform.com)

How complex can the decision become?

Technically if we consider the 'decision tree model' (often used in computational complexity), the function is directly proportional to the no. of factors/parameters affecting the decision making. This means, the larger number of vendors, the larger the complexity. And all this is often done in your brain-it's a challenge we probably don't comprehend everyday. But that's what a CISO or other Senior Security Officer's brain faces.

For more details on the computational tree models follow the reference link

Ref: https://en.wikipedia.org/wiki/Decision_tree_model

Challenges Faced By The CISO (Why they get fired/quit)-

• Bandwidth to evaluate security vendors
• Huge number of security vendors (e.g. Gartner had tracked 23 End Point Protection Vendors)
• Getting a team together with the deserved skills (security skills are way below demand)
• Difference of Opinion with CIO (the interests vary)
• Communicating security to the Board
• Single security dashboard for managing and tracking the various reports & incidents

How To Simplify The Selection Of Security Vendors?

The one place to search up all available options and their real life user experience could reduce the dimensions of decisions making to 2 instead of the earlier complex parameters. A robust view will allow for tremendous time saving and probabilistic right product selection. This is what FireCompass does-beta version of this is available. To add the manual expertise and experience, some of the best industry analysts from cisoplatform have agreed to guid the process.To request demo or user feedback mail at analyst@cisoplatform.com. 

Why Fire Compass

It is a community initiative available in freemium model as well as premium.

• Maps all security vendors under all major security domains
• Holistic security landscape view
• Decision backed by experienced security analysts
• Security Benchmarking helping in Gap Analysis-CPSMM

References-

http://www.csoonline.com/article/3077243/it-careers/vendor-overload-adds-to-ciso-burnout.html

http://www.csoonline.com/article/3057243/security/these-cisos-explain-why-they-got-fired.html

http://www.computerweekly.com/news/2240103602/Too-many-products-spoil-security-management

According to a recent research sited in the whitepaper, 86% security leaders have adopted or plan to adopt cloud initiatives. Cloud being cost-effective, investments in public, private and hybrid clouds are reasonable investments. This guide will give us an understanding in this area thus allowing us to understand the SIEM on Cloud model.

>>Download Complete Report Here

 What Will You Learn?

• Security Intelligence On Cloud Deployment Model
• SIEM on the Cloud Hosted Model
• The key capabilities/advantages/parameters of SIEM on cloud

>>Download Complete Report Here

Our editorial team has handpicked the best of the best talks at RSA Conference - one of the largest IT Security Conference in the world. Following is the list of top talks on Incident Response & SIEM at RSA Conference 2016.

RSA Conference held its 25th annual event at the Moscone Center in San Francisco and brought together a record number of more than 40,000 attendees. Attendees experienced keynotes, peer-to-peer sessions, top notch track sessions, tutorials and seminars along with networking and social activities including the RSAC Codebreakers bash at AT&T Park featuring Sheryl Crow, Walk off the Earth and Tony Hawk. Keynotes, sessions and debates focused on the Internet of Things, industrial control systems, encryption, artificial intelligence and machine learning, crowdsourcing, healthcare, automotive, and more, with many reflecting current industry news. (Source: RSA Conference USA 2016)

1) The Incident Response Playbook for Android and iOS

Speaker: Andrew Hoog ( @ahoog42 )

What is your mobile device incident response plan? If you cannot answer that question, you should attend this session. The session will cover the challenges in mobile, how and why it is different from traditional incident response, and the building blocks you can use to craft your own mobile incident response plan.

>>Go To Presentation

2) Demystifying Security Analytics: Data, Methods, Use Cases

Speaker: Anton Chuvakin ( @anton_chuvakin )

Many vendors sell “security analytics” tools. Also, some organizations built their own security analytics toolsets and capabilities using Big Data technologies and approaches. How do you find the right approach for your organization and benefit from this analytics boom? How to start your security analytics project and how to mature the capabilities?

>>Go To Presentation

image courtesy: https://www.flickr.com/photos/123943225@N07/14380659947

3) The Rise of the Purple Team

Speaker: Robert Wood ( @robertwood50 ), William Bengtson ( @waggie2009 )

As attacker tactics, techniques and procedures evolve, so must the defenses and strategy used to defend against them. Traditional red teaming presents an opportunity to find gaps in security, but leaves more valuable information unabsorbed. Results and methodologies used in red team assessments can drive protections in place use by blue teams and a larger program and vice versa.

>>Go To Presentation

image courtesy: https://www.flickr.com/photos/111692634@N04/18495846450

4) Building a World-Class Proactive Integrated Security and Network Ops Center

Speaker: Hanna Sicker ( @SNOCgirl )

The SNOC (Security & Network Operations Center) is a cost-effective, world-class, proactive integrated function that leverages and optimizes your current NOC members while hiring a minimal number of additional security professionals. Learn how to use the SNOC framework to transform your existing NOC into a single effective team that is responsible for both network and security functions.

>>Go To Presentation

image courtesy: https://www.flickr.com/photos/jakerust/16649925388

5) Make IR Effective with Risk Evaluation and Reporting

Speaker: Justin Monti, Mischel Kwon 

Today, determining risk of a cyberattack is the generic vulnerability or malware rating ignoring aspects of how the business is impacted. Understanding the vulnerability state of the network, reputational risk, business loss, cost of IR and reconstitution cost are rarely understood. This presentation will show a data-driven approach to IR prioritizing response based on risk and business impact.

>>Go To Presentation

6) Data Breach Litigation How To Avoid It And Be Better Prepared

Speaker: Ronald I. Raether, Jr. Andrea Hoy

Here's an overview of the presentation: Background: Where are the Data Breaches occuring?; How to Be Better Prepared for When Your Company Data is Brenched; How to Avoid it: Lessons Learned & Best Practices

>>Go To Presentation

7) Cloud Breach – Preparation and Response

Speaker: Monzy Merza ( @monzymerza )

Your next breach or insider attack will most likely have you digging for evidence in the cloud. Are you prepared? The old styles of imaging disks and tapping networks won't work! It won’t scale! This session will discuss response scenarios for cloud-enabled and cloud-dependent enterprises, a model for preparing for cloud response, and will show examples of cloud breach investigations.

>>Go To Presentation

8) Preserving the Privilege during Breach Response

Speaker: Jeff Kosseff ( @jkosseff )

When companies hire cybersecurity consultants to investigate incidents, those professionals’ reports and emails could be used against the company in court unless a privilege applies. This session provides an overview of the attorney-client privilege for post-breach investigations, and tips for increasing the chances that the privilege will apply and the data will remain confidential.

>>Go To Presentation

9) Integrated Security Operations Center (ISOC) for Cybersecurity Collaboration

Speaker: Timothy Lee

This session will present a real case study of methodology and advanced cybersecurity tools used along with important tips and lessons learned on implementing an ISOC project at the second largest city of the nation. Topics include the critical success factors, advanced tools and technologies for ISOC, Situational Awareness, Threat Intelligence Sharing and cybersecurity collaboration.

>>Go To Presentation

10) Data Science Transforming Security Operations

Speaker: Alon Kaufman

Data science brings a huge promise to IT security and accordingly to the sprouting of DS teams across all enterprises, and numerous vendors. Indeed DS has the potential to transform the way security is done—yet, the secret sauce is how to do it in a way that actually provides clear value, embedded into the security workflow, and leverages the human knowledge in combined with the data.

>>Go To Presentation

Your Complete Guide To Top Talks @RSA Conference 2016 (USA)

Get your FREE Guide on Top Talks @ RSA Conference 2016 (USA) . Our editorial team has gone through all the talks and handpicked the best of the best talks at RSA Conference into a single guide. Get your Free copy today.

>>Click Here To Get Your FREE Guide

In keeping with the latest happenings in Information security, this article is on the 10 finalists  of RSA innovation sandbox contest held at the RSA Security conference, the world's leading Information security conference. Companies with innovative products and disruptive technologies are given platform to pitch their product. This competition promotes innovative thinking and encourages out-of-the-box  ideas.

The finalist have to demonstrate  their products and deliver a 3 minute long presentation in front of attendees and Judging panel. The judges based on participants demonstration and presentation decides the winner.

List of Finalists:

• Skyport systems
• Illusive Networks
• Bastille Networks
• Menlo security
• Phantom
• Prevoty
• Protectwise
• Safebreach
• Vera security
• Versa networks

Winner of RSA Innovation sandbox 2016 contest:

Phantom

Headquarters: Palo Alto, California

Founded: 2014

Current CEO: Oliver Friedrichs

Phantom provides Security Automation & Orchestration Platform to close the security gap by Integrating with all the security systems and tools and managing the enterprise security operations in a smart way. Phantom helps streamline security operations for the swift response to any incidents and possible threats.  Using Phantom you can semi-automate or fully automate responses, customize according o your organization need while accelerating the entire incident lifecycle.

Phantom uses high level python script, which initiates actions to be taken to remediate the Incident and start investigations. These High level Python scripts are incident specific and Phantom call them Playbooks. Playbooks can be used to execute actions on connected devices.

Other Finalists

Skyport Systems

Head quartered: Mountain view, CA

Founded: 2013

Current CEO: Art Gilliland

Skyport delivers  secure-computing infrastructure for enterprise applications. Skysecure server can be deployed on-premise and are managed remotely. The server is designed to  host business critical applications to protect against viruses, rootkits and malware. the system maintains a secure configuration by providing embedded, layered an compartmentalized security. The solution also provide full visibility by capturing network traffic from layer 2 to layer 7 for audits and investigations. 

Illusive Networks

Headquarters: Tel Aviv, Israel.

Founded: 2014

Current CEO: Shlomo Touboul

Illusive networks adds a deceptive layer over the entire network - agentlessly deployed on every endpoint, server and network component, which paralyses the attacker who penetrates the network by feeding wrong information to them. So when the attacker breach your network illusive network ensure that they step into an deceptive world were the data is unreliable. This makes the attacker goals virtually  impossible to achieve. The illusive network maintains that there is no cost to the IT because of these deceptions and it is completely transparent to the IT and attackers.

Bastille Networks

Headquarters: Atlanta, Georgia

Founded: 2014

Current CEO: Chris Risley

Bastille deals regarding Security for the Internet Of Things(IOT). The secure Solution provided by Bastille aims to identify  to enterprises from the unintended consequence of IOT and allow preemptive response from the organization. Through its proprietary software, Bastille scans complete radio spectrum giving visibility over every wireless device on the premise. As a result, enterprises has full situational awareness and can accurately quantify risk and mitigate threats.

Menlo Security

Headquarters: Menlo Park, CA

Founded: 2013

Current CEO: Amir Ben-Efraim

Menlo Security provides solution to protect from  the threats of advanced malware and other Web based attack vectors by introducing a new security model. The Model provides a new layer in the security stack that contains and eliminates all malware and grants secure access to the web. The company has patented Isolation platform which scans and eliminates malwares in the cloud. There is no need to deploy endpoint agents and the process is completely transparent to the users providing them safe and clean experience.

Prevoty

Headquarters: Los Angeles, CA

Founded: 2013

Current CEO: Julien Bellanger

Prevoty is a security software company dedicated to protecting users and enterprises by solving problems related to application security. Prevoty’s products provide real-time application security intelligence and RASP (Runtime Application Self-Protection) capabilities for enterprises.

ProtectWise

Headquarters: Denver, CO

Founded: 2013

Current CEO: Scott Chasin

ProtectWise delivers a cloud based network security solution that provide complete visibility and detection of enterprise threats and accelerated incident response. ProtectWise uses its cloud Network DVR, a virtual camera in the cloud to monitor, record and retain all network traffic for automated analysis and retrospection, creating a long-term network memory.

SafeBreach

Headquarters: Menlo Park, CA

Founded: 2014

Current CEO: Guy Bejerano

SafeBreach  provides a "hackers view"  of an enterprise security posture. They executes active breach scenarios with Hackers Playbook of research and real-world investigative data  and performs continuous validation to find holes in an environment before an attacker does. SafeBreach allows to benchmark and analyze the effect of attacks and the effectiveness of the defense products at any given moment.

Vera Security

Headquarters: Palo Alto, CA

Founded:2014

Current CEO: Ajay Arora

Vera security enables businesses to easily secure and track any digital information across all platforms and devices without borders and controlled endpoints. With its Zero-touch, Zero-friction data protection and Encryption Vera enable organizations to Secure any file across all devices, all users and all applications  in real-time  with Seamless user experience, Military-grade file encryption, Real-time policy enforcement, Centralized control and analytics.

Versa  networks

Headquarters: Santa Clara, CA

Founded: 2012

Current CEO: Kumar Mehta

Versa solutions enable service providers and large enterprises to transform the WAN and branch networks based on a broad set of virtualized network functions (VNFs) to achieve unprecedented business advantages. Versa VNF-based solutions eliminate costly and proprietary network hardware to increase service agility and significantly reduce total cost of ownership (TCO).

(Source: RSA USA 2016, San Francisco)

Our editorial team has handpicked the best of the best talks at RSA Conference - one of the largest IT Security Conference in the world. Following is the list of top talks on Cloud Security at RSA Conference 2016.

RSA Conference held its 25th annual event at the Moscone Center in San Francisco and brought together a record number of more than 40,000 attendees. Attendees experienced keynotes, peer-to-peer sessions, top notch track sessions, tutorials and seminars along with networking and social activities including the RSAC Codebreakers bash at AT&T Park featuring Sheryl Crow, Walk off the Earth and Tony Hawk. Keynotes, sessions and debates focused on the Internet of Things, industrial control systems, encryption, artificial intelligence and machine learning, crowdsourcing, healthcare, automotive, and more, with many reflecting current industry news. (Source: RSA Conference USA 2016)

image courtesy: https://www.flickr.com/photos/111692634@N04/15423276943

1) Aspirin as a Service: Using the Cloud to Cure Security Headaches

Speaker: Bill Shinn , Rich Mogull ( @rmogull )

Moving critical workloads into the cloud can be unnerving for security professionals. In reality, though, the cloud offers a whole new set of opportunities for the security team to do things even better than in their on-premises environment. Two seasoned cloud experts will explore the latest real-world, practical tools and techniques for becoming demonstrably more secure as you move to the cloud.

>>Go To Presentation

image courtesy: https://de.wikipedia.org/wiki/Hacker

2) Cloud Security Essentials 2.0 Full Stack Hacking & Recovery

Speaker: Shannon LIetz ( @devsecops ), Javier Godinez

Here's an overview of the presentation: A Basic Introduction – Cloud Hack Lab; Attack Harness, Enumeration and Testing Tools Cloud; Forensics at Scale; Opportunities for Tools

>>Go To Presentation

3) Security Program Development for the Hipster Company

Speaker: Robert Wood ( @robertwood50 )

Cloud services have evolved and can now replace nearly every facet of traditional infrastructure. This movement has enabled rapid scale while introducing a considerable element of risk. This session will discuss a framework for getting started building a security program in an organization that is built purely on cloud services, covering the contradictions and opportunities of that business model.

>>Go To Presentation

https://www.flickr.com/photos/mikecogh/5280585822

4) Designing Virtual Network Security Architectures

Speaker: Dave Shackleford ( @daveshackleford )

With the advent of virtualization and software-defined networking (SDN), the nature and design of today’s networks are changing rapidly. Network security models need to adapt to the virtual data center, and there are a plethora of new technologies that can help security and operations teams design scalable network security architectures that work in highly virtualized environments.

>>Go To Presentation

5) Cloud Breach – Preparation and Response

Speaker: Monzy Merza ( @monzymerza )

Your next breach or insider attack will most likely have you digging for evidence in the cloud. Are you prepared? The old styles of imaging disks and tapping networks won't work! It won’t scale! This session will discuss response scenarios for cloud-enabled and cloud-dependent enterprises, a model for preparing for cloud response, and will show examples of cloud breach investigations.

>>Go To Presentation

6) Take It to the Cloud: The Evolution of Security Architecture

Speaker: Dana Wolf ( @dayowolf )

As companies evolve their IT stack, traditional security approaches/architectures need to be reconsidered. This session will review some of the new risks introduced by SaaS/IaaS adoption and show how to mitigate these risks using new approaches to security architecture. Presenters will also review the transition of security architecture itself to the cloud.

>>Go To Presentation

Your Complete Guide To Top Talks @RSA Conference 2016 (USA)

Get your FREE Guide on Top Talks @ RSA Conference 2016 (USA) . Our editorial team has gone through all the talks and handpicked the best of the best talks at RSA Conference into a single guide. Get your Free copy today.

>>Click Here To Get Your FREE Guide

Our editorial team has handpicked the best of the best talks at RSA Conference - one of the largest IT Security Conference in the world. Following is the list of top GRC talks at RSA Conference 2016.

RSA Conference held its 25th annual event at the Moscone Center in San Francisco and brought together a record number of more than 40,000 attendees. Attendees experienced keynotes, peer-to-peer sessions, top notch track sessions, tutorials and seminars along with networking and social activities including the RSAC Codebreakers bash at AT&T Park featuring Sheryl Crow, Walk off the Earth and Tony Hawk. Keynotes, sessions and debates focused on the Internet of Things, industrial control systems, encryption, artificial intelligence and machine learning, crowdsourcing, healthcare, automotive, and more, with many reflecting current industry news. (Source: RSA Conference USA 2016)

1) Bridging the Gap Between Threat Intelligence and Risk Management

Speaker: Wade Baker ( @wadebaker )

Here's an overview of the presentation: Bridging Risk & IR in Verizon's DBIR; Building Understanding; Finding Common Ground; Bridging the Gap; Crossing the Divide

>>Go To Presentation

2) The Newest Element of Risk Metrics: Social Media

Speaker: Ian Amit ( @iiamit )

In order to identify, measure and track the risk exposure that different elements of social media have on an organization, organizations require a threat metric framework to evaluate a network’s current risk posture. Learn how to take an ocean of data and distill it to the most critical risk indicators.

>>Go To Presentation

3) Building an Effective Supply Chain Security Program

Speaker: Dave Shackleford ( @daveshackleford )

We’ve realized that the supply chain in most organizations is a potential weak spot for security controls and awareness. The time has come to shore up our approaches to supply chain management, incorporating security best practices at all stages. This talk will break down exactly how to get started, what to look for, and how to better secure your supply chain across the board.

>>Go To Presentation

4) Integrating Cybersecurity into Supply Chain Risk Management

Speaker: Jon Boyens

Cyber–supply chain risks pose a new set of challenges for businesses (loss of critical IP, unwanted functionality in products) which jeopardize brand reputation and shareholder value. This session will present case study research from NIST on cutting-edge practices and tools that today’s industry leaders in supply chain risk management are deploying to secure their supply chains from end to end.

>>Go To Presentation

5) The Measure of Success:Security Metrics to Tell Your Story

Speaker: Julie Bernard ( @juliein10A ), Wendy Frank

Information Security as a problem is rather complex and it gets more difficult in terms of quantification. This presentation helps us with some metrics that will help us make security more understandable.

>>Go To Presentation

Your Complete Guide To Top Talks @RSA Conference 2016 (USA)

Get your FREE Guide on Top Talks @ RSA Conference 2016 (USA) . Our editorial team has gone through all the talks and handpicked the best of the best talks at RSA Conference into a single guide. Get your Free copy today.

>>Click Here To Get Your FREE Guide