OVERVIEW. March 13, 2015

Transcription

1 OVERVIEW March 13, 2015

2 Healthcare Solution for Automated Threat Exchange and Collaboration Over 300 healthcare organizations actively sharing Limit infiltration of my organization and exfiltration of data in an efficient and effective manner. CISO, Health Plan My organization needs the ability to streamline processes and based on the quality of the intel determine where best to place capital and operating expenses in defense of the organization. CISO, Hospital 2 hitrustalliance.net/cyber-threat-xchange/

3 Industry Challenge Low quality intelligence combined with historical and low Fidelity Data creates non-actionable alerts Intelligence sourced contained many false positives including hosting IP addresses and legitimate domain names Time to value The timeliness of the data was a major concern as they discovered they were several days behind the industry Not Consumable because of inherent lack of automation Internal Development Cycles Rather than focusing on the analysis analysts spent their time fixing scripts and working on content in the SIEM Lack of Collaboration Unable to automate the desired collaboration with other organizations in the industry Collaboration is limited to conference calls and back of napkin discussions lacking detection and response capability Threat data packaged for human consumption PDF reports are being manually collected and triaged by analysts who spend time copy and pasting observable data 3 hitrustalliance.net/cyber-threat-xchange/

4 Intelligence Driven Security Proactive Detection Situational Awareness Community Collaboration Proactive Robust Set of IOCs Active and Timely Relevant to Healthcare Observable Acquisition Collaboration Analysis Security Operations Enterprise Distribution 4 hitrustalliance.net/cyber-threat-xchange/

5 Information Sharing and Collaboration Proven benefits Provides Situational Awareness and context across organizational and geographical boundaries Force multiplier leverage your peers Data Classifications Rules TLP Protocol Actor / Campaign Details Automated distribution Platform Agnostic Anonymous and Secure 5 hitrustalliance.net/cyber-threat-xchange/

6 Collaboration in Action 6 hitrustalliance.net/cyber-threat-xchange/

7 Return on Investment Cost your organization? Worst Case: A breach Malware detection and response? Delayed access to threat observables from industry breaches? Inaccurate Intelligence? CTX Provides: Analyst force multiplication Speed of identification and accuracy of information. Decrease time to detection of malware and targeted attacks Reduce SIEM content and use case building costs Indicator consolidation reduced the man-hours spent acquiring and operationalizing indicators External context and enrichment in a single pane of glass To more rapidly identify and subsequently eradicate active threats in my environment is extremely valuable and offers a much quicker ROI to the acquiring entity CISO, Major Healthcare 7 hitrustalliance.net/cyber-threat-xchange/

8 Summary Q&A Proactive Detection and Situational Awareness Observables directly integrated into existing security infrastructure Community Collaboration CTX customers benefit from receiving threat details that have already been tested and vetted. Relevant to healthcare Ability to share threat information in an efficient, managed and secure process CTX enables real-time controlled collaboration between trusted partners. Allows for organizational oversight and facilitation of sharing by CTX Actionable and Timely Automated analytics removes invalid IOCs Bi-Directional SIEM integration allows for threat validation by CTX 8 hitrustalliance.net/cyber-threat-xchange/

9 Appendix 9 hitrustalliance.net/cyber-threat-xchange/

10 Use Cases and Observables Broad range of use cases: Malware, APT, Fraud, Phishing, DDoS Observable Types User Agent String URLs MD5s IPs Domains File Names Correlate With HTTP DNS Proxy Firewall IPS Application 10 hitrustalliance.net/cyber-threat-xchange/

11 Legacy Process (1-2 weeks) Threat Intel Collected Manual Analysis Data: Pre-Process/Format Upload to Internal Site Retrieval of Threat Intel Manual Load to SIEM Analysis and Feedback to Threat Team Threat Team Threat Team Threat Team Threat Team OPS Team OPS Team OPS Team 11 hitrustalliance.net/cyber-threat-xchange/

12 Operational Intelligence (1 hour or less) Pre-Process, Aggregate, Analyze Threat Intel Collected Upload to CTX Security Infrastructure Alert Analysis Threat Team Analyst Feedback and Collaboration 12 hitrustalliance.net/cyber-threat-xchange/

13 Indicator Acquisition OPTIC / Research Trusted Collaboration Homeland Security Partners (APP Store) Sandbox Modern Honey Net Threat Indicator Acquisition 13 hitrustalliance.net/cyber-threat-xchange/

14 Enterprise Integration Integrate to existing Security Infrastructure Delivered from the Cloud Correlation Instructions Rules, Reports, Dashboards One Click Browser Rest API STIX Enterprise Distribution 14 hitrustalliance.net/cyber-threat-xchange/