Cyber Defense Magazine Special Annual Edition for RSA Conference 2021
Cyber Defense Magazine Special Annual Edition for RSA Conference 2021 - the INFOSEC community's largest, most popular cybersecurity event in the world. Hosted every year in beautiful and sunny San Francisco, California, USA. This year, post COVID-19, virtually with #RESILIENCE! In addition, we're in our 9th year of the prestigious Global InfoSec Awards. This is a must read source for all things infosec.
Cyber Defense Magazine Special Annual Edition for RSA Conference 2021 - the INFOSEC community's largest, most popular cybersecurity event in the world. Hosted every year in beautiful and sunny San Francisco, California, USA. This year, post COVID-19, virtually with #RESILIENCE! In addition, we're in our 9th year of the prestigious Global InfoSec Awards. This is a must read source for all things infosec.
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
What’s the architecture <strong>for</strong> a successful deployment?<br />
For security teams, the ideal is to have a “single-pane-of-glass” that collects and collates threat telemetry<br />
from all of the different sources and provides a single view of threat activity across the threat lifecycle.<br />
Typically, organizations are electing to implement a SIEM tool, or a data-lake that provides data mining<br />
and search capabilities. SOAR tools are also rapidly gaining in popularity - as a way to help organizations<br />
collect and analyze evidence of threat activity.<br />
The key capability that organizations need is being able to quickly reconstruct events from the collected<br />
and collated telemetry to understand what happened, how it happened, and what the impact of that event<br />
is. With a centralized view of activity, analysts can ask and answer questions quickly to understand<br />
whether there has been lateral movement from an initial compromise, whether data has been exfiltrated<br />
or not, etc.<br />
Having access to full packet capture data is an indispensable resource in enabling this capability. With<br />
access to the actual packets, including payload, analysts can see what activity took place on the network<br />
and reconstruct events precisely - right down to seeing what data may have been exfiltrated and how an<br />
attacker is moving around the network to increase their foothold.<br />
Full packet capture data is also an incredibly powerful resource <strong>for</strong> proactive threat hunting. Packet datadriven<br />
threat hunting and simulation exercises are a great way <strong>for</strong> teams to determine the effectiveness<br />
of their detection tools - including AI/ML tools - to understand why they are not detecting events that they<br />
ought to, or alternatively why they are incorrectly flagging non-malicious activity as malicious.<br />
Packet capture data is invaluable as an evidence source because it is complete and reliable. Where a<br />
skilled attacker will often delete or modify logs to hide their activity, it's very difficult <strong>for</strong> them to manipulate<br />
packet data captured off the network - particularly when in most cases they are not even aware that it’s<br />
being captured and don’t have access to it. This makes packet data a trusted source of “truth” about<br />
what’s really happening on the network.<br />
Right deployment, right outcome<br />
AI/ML detection tools have a lot of promise. However, there are pitfalls if the right architecture and<br />
capabilities are not in place. In order <strong>for</strong> AI/ML threat detection tools to deliver on their promise to reliably<br />
detect and remediate threats, companies must be able to trust them to make the right decisions, not to<br />
miss things, and to act accurately. To achieve this level of trust, we must be able to always verify and<br />
validate decisions made by AI/ML tools. To do this, companies need to ensure they have the right data.<br />
Packets are an indispensable resource <strong>for</strong> validating AI decisions. But in order <strong>for</strong> packet data to be<br />
useful it needs to be complete and accurate, with no blind spots, and provide as much lookback history<br />
as possible. It also needs to be easily accessible and provide fast search and data mining.<br />
Considering how packet data can be incorporated into workflows is also important. When packet data<br />
can be integrated into security tools - enabling analysts to pivot from a specific alert or event to the related<br />
17