Secure IoT Application Lifecycle Overview

This presentation by Angelo Brancato delves into IoT security, focusing on malware threats in June 2016. It discusses HPE's Secure IoT Application Lifecycle, including security intelligence, data visualization, application security, and more. The presentation emphasizes the need for secure connectivity, edge computing, and IoT endpoints for a comprehensive IoT security strategy.

• IoT Security
• Application Lifecycle
• Malware Threats
• HPE
• Security Intelligence

viko563 Follow

Uploaded on Oct 05, 2024 | 0 Views

Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

Presentation Transcript

1. IoT Security Part 2, The Malware June, 2016 Angelo Brancato, CISSP, CISM. CCSK Chief Technologist HPE Security angelo.brancato@hpe.com Mobile: +49 174 1502278

2. This Presentation is recorded: https://youtu.be/AVwCZF84gew

3. HPE Secure IoT Application Lifecycle HPE Security ArcSight (Security Intelligence) HPE ADM (Application Delivery Management) image001Replay Part 1, The Data Visualization HPE ITOM (IT Operations Management) Data, Applications, Communication, Users HPE Security Fortify (Application Security) IoT Cloud / Platform HPE Security Data Security (Voltage/Atalla) HPE Aruba (Communication Security) HPE ADM, ITOM and Security solutions provide a secure IoT Application Lifecycle Connectivity Edge Computing IoT Endpoints

4. HPE Secure IoT Application Lifecycle HPE Security ArcSight (Security Intelligence) HPE ADM (Application Delivery Management) Visualization HPE ITOM (IT Operations Management) Data, Applications, Communication, Users HPE Security Fortify (Application Security) IoT Cloud / Platform HPE Security Data Security (Voltage/Atalla) HPE Aruba (Communication Security) HPE ADM, ITOM and Security solutions provide a secure IoT Application Lifecycle Connectivity Edge Computing IoT Endpoints

5. HPE Secure IoT Application Lifecycle Security Intelligence HPE Security ArcSight (Security Intelligence) Visualization Data, Applications, Communication, Users HPE Security Fortify (Application Security) IoT Platform IoT Cloud / Platform HPE Security Data Security (Voltage/Atalla) HPE Aruba (Communication Security) Connectivity Edge Computing IoT Endpoints

6. HPE Secure IoT Application Lifecycle Security Intelligence HPE Security ArcSight (Security Intelligence) Visualization IoT Platform IoT Cloud / Platform Connectivity Log Data Edge Computing IoT Endpoints

7. Security Intelligence - What is Security Analytics? Streams of Data Rivers of Data Ocean of Data / Data Lake

8. Security Intelligence - What is Security Analytics?

9. Security Intelligence - What is Security Analytics? Tactical Level E.g. Users Clients, Servers Applications Firewalls, IDS/IPS, VPN, Routers, WLAN IoT Edge Devices, Sensors, Actuators Streams of Data

10. Security Intelligence - What is Security Analytics? Operational Level Real-time correlation of knownattack patterns Streams of Data Rivers of Data Sample ArcSight correlation rule

11. Security Intelligence - What is Security Analytics? Operational Level ArcSight Key Differentiators some - True Real-Time and ArcSight ESM Contextual Correlation Real-time correlation of knownattack patterns Streams of Data - Pre-Defined Use Cases (correlation rules) and Rivers of Data Content Sharing Platform - 400+ supported event sources - Flex-Connector - Normalization / Categorization - Guaranteed Event Delivery and Event Load-Balancing - Multi-Tenancy

12. Security Intelligence - What is Security Analytics? Tactical Level Operational Level Strategic Level Ubiquitous, reliable and scalable event collection and normalization, Remediation Feed back to Operational Level, creation of real-time correlation rules Hunt for yet unknown attack patterns in the Big Data Lake ArcSight ESM Streams of Data Rivers of Data Hunt Team Ocean of Data / Data Lake

13. Security Intelligence - What is Security Analytics? Tactical Level Operational Level Strategic Level Ubiquitous, reliable and scalable event collection and normalization, Remediation Feed back to Operational Level, creation of real-time correlation rules Hunt for yet unknown attack patterns in the Big Data Lake ArcSight ESM Streams of Data DMA Rivers of Data Hunt Team In-A-Box ArcSight DNS Malware Analytics Ocean of Data / Data Lake

14. HPE ArcSight DMA DNS Malware Analytics Overview

15. HPE ArcSight DNS Malware Analytics (DMA) HPE Security ArcSight (Security Intelligence) Visualization IoT Platform IoT Cloud / Platform HPE ArcSight DNS Malware Analytics (DMA) Connectivity DNS Data DMA Edge Computing IoT Endpoints

16. Challenges in Collecting & Monitoring DNS Data Why is DNS monitoring this a hard problem for Enterprise Environments? Case Study: 250,000 Volume! Events per second 200,000 18-20 Billion DNS packets move through HPE s core data centers every day 220,000 150,000 Logging impacts severely performance of the DNS Infrastructure 100,000 14,000 3,000 50,000 200 The right information is not logged 80 7 0 Every new employee, device, server etc. only adds to the total Routers VPN McAfee ePO Active Directory Web Proxy DNS HPE 2013-2016

17. HPE ArcSight DNS Malware Analytics (DMA) Manual or automaticremediation ! ! ! Visualization Alerting (Infected Systems) ArcSight REST connector, Secure communication HPE Analytics Cloud ArcSight ADP/ESM IoT Platform IoT Cloud / Platform Network Tap Secure communication DNS Capture Module Connectivity HPE Aruba ClearPass Easy to install pre-configured appliance Edge Computing Constantly analyze DNS data for security threats Local DNS Pre- processing Data visualization & exploration Filter out 99% of traffic IoT Endpoints Web-based detail & visual drill down Statistics and diagnostics Cloud On-Site

18. HPE ArcSight DNS Malware Analytics (DMA) Recap DMA is a solution that: provides high fidelity very low to zero false-positive rate enables Operational Staff (L1) to mitigate/remediate fit into an existing SOC infrastructure without expansion DMA is an automated service to detect and identify hosts (things) that: are positively infected with malware, bots, or other unknown threats are trying to contact Command and Control (C&C) Servers or exfiltrate data other signature based perimeter or internal security products have not detected

19. Thank You! Angelo Brancato,CISSP, CISM. CCSK Chief Technologist HPE Security angelo.brancato@hpe.com Mobile: +49 174 1502278 hpe.com/security