SLIDE 1
The New Security Frontier:
Threat Hunting, Augmented Intelligence, and Automated Response
Michael Melore, CISSP
June 2018 IBM Cyber Security Advisor
@MichaelMelore
May 2018
The New Security Frontier: Threat Hunting, Augmented Intelligence, - - PowerPoint PPT Presentation
The New Security Frontier: Threat Hunting, Augmented Intelligence, - - PowerPoint PPT Presentation
The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response Michael Melore, CISSP IBM Cyber Security Advisor @MichaelMelore June 2018 May 2018 May 2018 Threat Hunting Workflow Cognitive Advanced Analytics
SLIDE 2
SLIDE 3
May 2018
SLIDE 4
Workflow
Advanced Analytics Cognitive Threat Hunting
DETECT ENRICH
INVESTIGATE ORCHESTRATE
Incident Response
SLIDE 5
IBM CONFIDENTIAL until January 2017
Investigations
SLIDE 6
IBM CONFIDENTIAL until January 2017
Investigations
SLIDE 7
IBM CONFIDENTIAL until January 2017
Investigations
SLIDE 8
What is an Unknown Unknown Search
Offense
2
Offense Property
b
Offense Property
a
Offense Property
f
Offense
1
Offense Property
i
Offense Property
c
Offense Property
d
Offense Property
e
Offense Property
h
Offense Property
g
Ask the question: “show me which
- ffenses share the same property”
– you don’t know the subset of offenses, not the subset of properties to search
SLIDE 9
IBM CONFIDENTIAL until January 2017
Investigations
SLIDE 10
IBM CONFIDENTIAL until January 2017
Hunting
SLIDE 11
Incident Response
SLIDE 12
Gain integrated, real-time threat intelligence
IBM X-Force Exchange Crowd-sourced information sharing based on 700+TB of threat intelligence
https://exchange.xforce.ibmcloud.com
Find, fix, and secure endpoints Prevent advanced network attacks Use analytics to discover and eliminate threats Coordinate response activity Understand the latest threat actors Get help from security experts
SLIDE 13
Gain integrated, real-time threat intelligence
IBM X-Force Exchange – Tailored Dashboards Crowd-sourced information sharing based on 700+TB of threat intelligence
https://exchange.xforce.ibmcloud.com
Find, fix, and secure endpoints Prevent advanced network attacks Use analytics to discover and eliminate threats Coordinate response activity Understand the latest threat actors Get help from security experts
SLIDE 14
An integrated and intelligent security immune system
Workload protection Cloud access security broker Access management Identity management Data access control Application security management Application scanning Data monitoring Device management Content security
SLIDE 15
The New Security Frontier:
Threat Hunting, Augmented Intelligence, and Automated Response
Michael Melore, CISSP
June 2018 IBM Cyber Security Advisor
@MichaelMelore