From reactive to automated reducing costs through mature security processes info security europe 2011

From reactive to automated reducing costs through mature security processes info security europe 2011

• 1.
  From Reactive ToAutomated:Reducing Costs Through Mature Security ProcessesJörn DierksChiefSecurityStrategist [email protected]
• 2.
  Solving Cross-Discipline Problems2ProcessPeopleTechnologyInfrastructure& ApplicationsProvisioningHRComplianceHelpdeskNetIQNOCIncidentSecurityChangeBusinessOwnersOther Mgmt VendorsBusiness Processes
• 3.
  ProcessPeopleTechnologyInfrastructure & ApplicationsProvisioningHRCross-ProductIntegration ComplianceHelpdeskNetIQNOCIncidentSecurityChangeBusinessOwnersOther Mgmt VendorsBusiness ProcessesSolving Cross-Discipline Problems3
• 4.
  The Role ofIT Process Automation –Bridging Silos Between Business and ITToolsToolsBusinessConfiguration & Identity AuditingService / Help DeskSecurity Info & Event ManagementEvent Correlation & AnalysisIT GRCMSLMIT ProcessAutomationVulnerability AssessmentSystems & App Monitoring Perimeter & Network SecurityNetwork MonitoringContent Monitoring / DLPResponse TimeMonitoringOperationsSecurityPolicyAwarenessConfiguration & Patch ManagementCMDBAV / Malware ProtectionIdentity ManagementResponsibilities Shared between Security & OperationsContinuityManagementCapacity & AvailabilityManagementReleaseManagementIncident & Problem Management Configuration & ChangeManagement
• 5.
  5Security & CompliancePerformance& Availability Identity & Access5© 2010 NetIQ Corporation. All rights reserved.About NetIQManage and audit user entitlements
• 6.
  Track privileged useractivity
• 7.
  Protect the integrityof key systems and files
• 8.
  Monitor access tosensitive information
• 9.
  Simplify compliance reportingITProcessAutomationMonitor and manage heterogeneous environments including custom applications
• 10.
  IT Service validationand end-user performance monitoring
• 11.
  Dynamic provisioning of large-scale monitoring with exceptions
• 12.
  Functional and hierarchicalIncident escalation
• 13.
  Deliver & managedifferentiated service levels
• 14.
  User Provisioning LifecycleManagement
• 15.
  Centralize Unix accountmanagement through Active Directory
• 16.
  Reduce number ofprivileged users
• 17.
  Secure delegated administration
• 18.
  Windows and ExchangeMigrationAddressing Insider ThreatPrivileged User MonitoringAddressing Compliance RequirementsBusiness Exception ManagementEnd-User Policy Management andAwarenessUse-Cases In This Presentation
• 19.
  Security Breachesinvolving SensitiveBusiness Data
• 20.
  Another Challenge toConsider…Source:“Data Loss RisksDuring Downsizing“, Ponemon Institute LLC, 23 Feb 2009
• 21.
  Policies, procedures andstandardsClear guidelinesPolicies as a key for your organizationStandardize assetsIdentity & access controlData ClassificationAccess controlManage islands of identity(Privileged) User monitoringAuditsNot a one-time effortRegular auditsThorough auditsRegulationsDifficult to do manuallyReporting neededThree Important Subjects9Photo by: Giorgio Monteforti: http://www.flickr.com/photos/11139043@N00/1439804758/
• 22.
  Mapping Subjects ToTechnologyBACWorkflow & Process AutomationIdentity & AccessManagementIT Infrastructure Windows Systems
• 23.
  Unix & LinuxSystems
• 24.
  Mac OS Systems
• 25.
  Security &Network Devices
• 26.
  Applications
• 27.
  Users
• 28.
  Groups
• 29.
  etc.Active DirectoryPolicyManagement& User AwarenessConfiguration &Compliance ManagementPrivileged User Monitoring, SIEM
• 30.
  Security Process AutomationFORRESTER®Required  Optional* Determined using the Aegis ROI calculator developed by Forrester Consulting based on a representative customer with 1,000 servers.
• 31.
  Use Case #1InsiderThreatIncident Automation withPrivileged User Monitoring
• 32.
  Automated IncidentManagement Workflow13DataWarehouseCMDBChangeManagementIncident Management ConsoleWorkflow / ProcessEventAdministratorAutomated event detection & response:Reduces time to response
• 33.
  Improves Auditability
• 34.
  Provides better consistency
• 35.
  Lowers impact onadministratorsRemediation
• 36.
  Use Case #2BusinessException Management Automation in Compliance Management
• 37.
  8Workflow / Process1. PolicyTemplates assess complianceNetIQ Secure Configuration Manager detects non-compliant systems3SystemOwner2.Secure Configuration Manager tells Aegis about the Compliance problemAegis starts Non-Compliance Workflow943. Aegis emails the system ownerInforms about the problems foundApproval & ExceptionManagement ProcessSystem Owner analyzes the issuesThen he tells Aegis that he wants to create an exception for one of the issues752105. Aegis informs the Security Officer about the exception creation requestEnsures that no exceptions get created without approval6Compliance & Configuration ManagementSecurityOfficer6.Security Officer approves exception requestHe can do that either by email or through the Aegis web consoleResults:No exceptions get created without prior approval
• 38.
  Security Processes arefollowed through
• 39.
  Compliance Issues aretracked consistently
• 40.
  There’s always aconsistent result of a workflow7.Aegis creates the exception in NetIQ Secure Configuration Manager and approves the exceptionAll details about the approvals process are added into the notes section of the exception1018. Administrator is notified about the exception approval and creationAlso, he’s asked if he wants to re-run the policy templateManual WorkloadAutomated Workload9.The System Owner confirms…10. Aegis tells Secure Configuration Manager to re-run the Policy TemplatesBusiness System
• 41.
  Where do Istart? – Process Automation Lifecycle
• 42.
  Policies, proceduresandstandardsClear guidelinesPoliciesasa keyforyourorganizationStandardizeassetsAchievePolicy ComplianceConfiguration & Compliance ManagementAutomatedException & Approval ManagementMonitor Privileged User ActivitySIEM & Access MonitoringAutomatedIncident Management, Escalation & AlertingSummary – Remember… 1… 2… 3…!BACWorkflow & Process AutomationIdentity & AccessManagementIT Infrastructure Windows Systems
• 43.
  Unix & LinuxSystems
• 44.
  Mac OS Systems
• 45.
  Security &Network Devices
• 46.
  Applications
• 47.
  Users
• 48.
  Groups
• 49.
  etc.Active DirectoryPolicyManagement& User AwarenessConfiguration &Compliance ManagementPrivileged User Monitoring, SIEM