Singapore .

16 April 2019
#CiscoConnectSG
From Chasing Alerts to Hunting Threats
What makes an Effective SOC is Evolving

Peter Baurichter
Manager ASEAN Security Services, Cisco
Security challenges go deeper than technology
2 million cybersecurity positions are projected to go unfilled by 2019*

SOCs are understaffed

Overwhelmed with alerts from

disparate security products

Unable to keep pace with current threats.

*according to Cybersecurity Ventures, 2017

 And time is a critical factor Late detection
1 in 4 High impact
Risk of a major breach in
the next 24 months

Early detection
Low impact

Time
Industry average Industry average Average cost
detection time for a time to contain of a data
breach a breach breach

Source: Ponemon 2018 Cost of a Data Breach Study

SOC – What is Changing?
SOC – What is Changing?
Events correlation Data analytics

Incident investigation Investigation & hunting

Threat Centric
Analyst Tasks Automation

Consuming constituency data + Threat intelligence consumption

The concepts of datamart and data

SIEM DB lakes
SOC – What is Changing?
Deterministic and statistical + Data science-centric analytics
Analytics

Data sharing is SIEM centric SOC data bus

Threat Centric
Creating SIEM rules Programing the requirements

Developing and consuming open

Limited integration capabilities APIs

Machine learning is for data Machine learning for everyone,

scientists i.e. Machine learning as a service
 Beyond Basic SOC Service
Advanced Threat Automation
Intelligence

Advanced
Advanced Reporting: KPIs,
Security Analytics KRIs
Enhance Threat
Detection and
Advanced Case Response
Threat Hunting and
Management Deception
We believe security systems should empower your
people to investigate and respond to threats faster

Automation should reduce the burden

on the SOC

Alerts should be relevant and

prescriptive

Security products and threat intel should all

work together
Respond faster!
 Expand Reduce Accelerate
visibility across your entire massive data sets to get to the response capabilities
attack surface critical alerts that matter
 You can’t respond to what you can’t see

KNOW SEE every Understand what is Be alerted to Respond to

every host communication NORMAL CHANGE THREATS quickly

HQ
Network

Branch Cloud Users

Data Center
Roaming Users

Admin
SOC Architecture
Evaluate, build and maintain a successful
SOC with Cisco SOC Advisory Services
Architecture and
Strategy
design

based on desired using preferred

outcomes operational model

Assessments and
Planning
Testing

to ensure
to guide development
effectiveness
Reference SOC Architecture CERT(s)
Dark web

Local agencies
Social networks

Foreign
agencies
Major institutes

Private threat Public threat

feeds feeds

Service Threat SOC Threat

Consumer Researcher Analyst Hunter

Case Mgmt and SLA/KPI Reporting Portal Threat Intelligence (collection,

correlation, scoring, DNS
enrichment, etc.)
Entity A ISE
Access to log and alerts
Portal FW
Entity B

Case Mgmt IPS

Entity C Top Level Analytics

NetFlow Analytics Vulnerability info

Multi-cloud
DPI Unstructured data
Short term-data lake Long term-data lake
Packet capture Structured data
Context Data

Service
Engineering Development Governance
management
Accelerate your SOC
with Cisco Security technologies

Cisco Threat AMP for Endpoints and Umbrella

Stealthwatch
Response Threat Grid Investigate
immediately raises the brings together intelligence automatically flags the file as identifies the malicious
alarm by pinpointing from different sources to malicious with deep malware domain callback, and
malicious network present a single view of the analysis, and prevents it from associated infrastructure in
activities, and helps to what, where, when and how of spreading order to prevent future
understand the scope of the the threat attacks by the entity
attack
Reference SOC Architecture CERT(s)
Dark web

Local agencies
Social networks

Foreign
agencies
Major institutes

Private threat Public threat

feeds feeds

Service Threat SOC Threat

Consumer Researcher Analyst Hunter

Case Mgmt and SLA/KPI Reporting Portal Threat Intelligence (collection,

correlation, scoring, DNS
enrichment, etc.)
Entity A ISE
Access to log and alerts
Portal FW
Entity B

Case Mgmt IPS

Entity C Top Level Analytics

NetFlow Analytics Vulnerability info

Multi-cloud
DPI Unstructured data
Short term-data lake Long term-data lake
Packet capture Structured data
Context Data

Service
Engineering Development Governance
management
Why is automation critical in
today’s SOC?
Automation of the SOC aims to
streamlines a series of time consuming,
repetitive, manual tasks into cohesive and
automated playbooks.
 Automating the SOC Tasks
Escalation and
Notification Case Management

Analysis and
Automation Data Enrichment
Investigation

Reporting and KPIs Adaptive Response

A Customer Test – One Process What was involved?
• Four dashboards!
• Copy and paste!
• Other alerts were getting genera
simultaneously!

0 15min 20min 23min 34min

A high alert is An L1 analyst The analyst access The analyst The analyst opens a
generated attends the alert Microsoft AD to retrieves threat intel case and assigns to
retrieve user information about a L2
information URL (virus total)
 • What if we can save 10 minutes
per alert?
• How many alerts can we optimize?

What if? • How many analysts per shift?

• How many shifts per day?
 Automating “this” Process
What was
involved?
• One dashboard
• No copy and paste
• Time to triage and analy
is optimized

0 1min 2min 2min 15min

A high alert is Alert created on MS AD Threat intel An L1 analyst

generated case management information about information about attends the alert on
platform user is retrieved the URL is the case
retrieved management
platform
CREATE AND EXECUTE

PLAYBOOKS
TO RUN COURSES OF ACTIONS
FOR YOU SECURITY TEAM WITH
A SIMPLE CLICK

DECISION
Execute Playbook
automatically or
manually.

Gain relevant data through orchestration

of other tools in your network.
What is threat hunting and why
it is important?
Proactive vs reactive

Hunters go out and look for

intruders before any alerts are
generated
Human-centric vs tool-centric
Starts with “a what-if question”,
followed by an initial
lead/clue, but then hunters
take many twists and turns
Hunters do not follow rules,
but can have a loose
methodology
Initial steps can be scripted,
scheduled and automated!
Hunters are hungry for “big” data!
 Respond to an
Threat Hunting – A Loose Methodology incident

If proven, pivot
Formulate a Look for it in the Research and and expand the
hypothesis environment optimize scope; follow the
hunting process

If not proven,
Develop new
optimize and go
detection content
back
Deception for Better Detection
and Hunting
Focused on Internal Compromises
• Nothing superficial!
• Identify attacker lateral movement and reconnaissance activity targeting production-critical
systems
• Embedded (deep) within the applications. Examples:
• AD admin accounts (honey) with hashes available on systems in the network
• SQL admin accounts (honey) with (honey) tables access
• etc.
• Deception should be linked with detection, hunting and response.
• The practice should be heavily governed!
• Possible source of “light” threat intelligence (IOCS and TTPs)
• Link that with the broad threat intelligence (ex. decoy documents leaking outside the organization
detected through TI or decoy documents calling home!)
What if?
 About Us
The Cisco Security Incident Response Services team is comprised of an international
ensemble of seasoned cyber security professionals possessing extensive experience in a
variety of disciplines such as computer crime investigations, incident response, malware
analysis, threat intelligence and more.

Comprised of selectively International team of experts Ability to reach across the

recruited consultants with diverse backgrounds Cisco enterprise
Prepare earlier so you can respond faster
using Cisco Incident Response Services
Retainer

Annual Dedicated Seasoned Offer may include: Access to Included

Subscription Consultants • Emergency Response Tools:
• Proactive Threat Hunting • AMP for
• IR Readiness Assessments Endpoints
• Table Top Exercises • Umbrella
• Stealthwatch
• Threat Grid

Proactive Emergency
Proactive Threat IR Readiness IR Plans & Playbooks Emergency
Table Top
Hunting Assessment Incident Response
Exercise
-contact with your
dedicated senior IR
pro within 4 hrs
-deploy within 24
hrs
 350+
A Winning Combination Full Time Threat Intel
Researchers

MILLIONS
Of Telemetry
Deep Telemetry Agents

During an
Seasoned incident
Investigators 4
Global Data
Centers

Law
Enforcement Deep & Dark 100+
Interaction Web Research Threat Intelligence
Partners

Reverse Signature
Engineer Creation 1100+
Malware Threat Traps
Collaboration
On-Demand

Cisco Collaboration technology

allows for real time and
coordination communication
across organizations
Singapore . 16 April 2019
#CiscoConnectSG