What you will take away from this session

2. © 2018 SPLUNK INC. ▶ The information in this presentation was compiled from sources believed to be reliable for informational and discussion purposes only. ▶ The information contained herein is not intended to constitute legal advice. You should consult with your own legal teams when developing programs and policies. You should not take, or refrain from taking, action based on its content. We do not guarantee the accuracy of this information and assume no liability in connection with therewith. Legal Disclaimer

6. © 2018 SPLUNK INC. GDPR Timelines ▶ The regulation is binding across all EU members states January, 2012 Commissioner Proposed reform to Data Protection regulation May, 2018 Effective Data Protection Framework comes into force (25th May, 2018) April, 2016 EU Council adopted new regulation December, 2015 EU agreement on regulation including the UK after Brexit You Are Here!

7. © 2018 SPLUNK INC. Key Features of GDPR Applicable to any company doing business in the European Union European Data Protection Harmonization Fines up to €20m or 4% of turnover Mandatory Privacy Impact Assessments Privacy by Design & Default 72 Hour Breach Notification Mandatory Data Erasure & Portability Consent for Personal Data Profiling

33. © 2018 SPLUNK INC. Aug 08 06:09:13 acmesep01.acmetech.com Aug 09 06:17:24 SymantecServer acmesep01: Virus found,Computer name: ACME-002,Source: Real Time Scan,Risk name: Hackertool.rootkit,Occurrences: 1,C:/Documents and Settings/smithe/Local Settings/Temp/evil.tmp,"""",Actual action: Quarantined,Requested action: Cleaned, time: 2009-01-23 03:19:12,Inserted: 2009-01-23 03:20:12,End: 2009-01-23 03:19:12,Domain: Default,Group: My CompanyACME Remote,Server: acmesep01,User: smithe,Source computer: ,Source IP: 10.11.36.20 Aug 08 08:26:54 snort.acmetech.com {TCP} 10.11.36.20:5072 -> 10.11.36.26:443 itsec snort[18774]: [1:100000:3] [Classification: Potential Corporate Privacy Violation] Credit Card Number Detected in Clear Text [Priority: 2]: 20130806041221.000000Caption=ACME-2975EBAdministrator Description=Built-in account for administering the computer/domainDomain=ACME-2975EB InstallDate=NULLLocalAccount = IP: 10.11.36.20 TrueName=Administrator SID =S-1-5-21-1715567821-926492609-725345543 500SIDType=1 Status=Degradedwmi_ type=UserAccounts All three occurring within a 24-hour period Example Correlation – Data Loss What Does Machine Data Look Like?

34. © 2018 SPLUNK INC. Aug 08 06:09:13 acmesep01.acmetech.com Aug 09 06:17:24 SymantecServer acmesep01: Virus found,Computer name: ACME-002,Source: Real Time Scan,Risk name: Hackertool.rootkit,Occurrences: 1,C:/Documents and Settings/smithe/Local Settings/Temp/evil.tmp,"""",Actual action: Quarantined,Requested action: Cleaned, time: 2009-01-23 03:19:12,Inserted: 2009-01-23 03:20:12,End: 2009-01-23 03:19:12,Domain: Default,Group: My CompanyACME Remote,Server: acmesep01,User: smithe,Source computer: ,Source IP: 10.11.36.20 Aug 08 08:26:54 snort.acmetech.com {TCP} 10.11.36.20:5072 -> 10.11.36.26:443 itsec snort[18774]: [1:100000:3] [Classification: Potential Corporate Privacy Violation] Credit Card Number Detected in Clear Text [Priority: 2]: 20130806041221.000000Caption=ACME-2975EBAdministrator Description=Built-in account for administering the computer/domainDomain=ACME-2975EB InstallDate=NULLLocalAccount = IP: 10.11.36.20 TrueName=Administrator SID =S-1-5-21-1715567821-926492609-725345543 500SIDType=1 Status=Degradedwmi_ type=UserAccounts Sources All three occurring within a 24-hour period Example Correlation – Data Loss Windows Authentication Time Range Intrusion Detection Endpoint Security What Does Machine Data Look Like?

35. © 2018 SPLUNK INC. Aug 08 06:09:13 acmesep01.acmetech.com Aug 09 06:17:24 SymantecServer acmesep01: Virus found,Computer name: ACME-002,Source: Real Time Scan,Risk name: Hackertool.rootkit,Occurrences: 1,C:/Documents and Settings/smithe/Local Settings/Temp/evil.tmp,"""",Actual action: Quarantined,Requested action: Cleaned, time: 2009-01-23 03:19:12,Inserted: 2009-01-23 03:20:12,End: 2009-01-23 03:19:12,Domain: Default,Group: My CompanyACME Remote,Server: acmesep01,User: smithe,Source computer: ,Source IP: 10.11.36.20 Aug 08 08:26:54 snort.acmetech.com {TCP} 10.11.36.20:5072 -> 10.11.36.26:443 itsec snort[18774]: [1:100000:3] [Classification: Potential Corporate Privacy Violation] Credit Card Number Detected in Clear Text [Priority: 2]: 20130806041221.000000Caption=ACME-2975EBAdministrator Description=Built-in account for administering the computer/domainDomain=ACME-2975EB InstallDate=NULLLocalAccount = IP: 10.11.36.20 TrueName=Administrator SID =S-1-5-21-1715567821-926492609-725345543 500SIDType=1 Status=Degradedwmi_ type=UserAccounts Sources All three occurring within a 24-hour period Example Correlation – Data Loss Source IP Source IP Source IP Data Loss Default Admin Account Malware Found Windows Authentication Time Range Intrusion Detection Endpoint Security What Does Machine Data Look Like?

36. © 2018 SPLUNK INC. Aug 08 06:09:13 acmesep01.acmetech.com Aug 09 06:17:24 SymantecServer acmesep01: Virus found,Computer name: ACME-002,Source: Real Time Scan,Risk name: Hackertool.rootkit,Occurrences: 1,C:/Documents and Settings/smithe/Local Settings/Temp/evil.tmp,"""",Actual action: Quarantined,Requested action: Cleaned, time: 2009-01-23 03:19:12,Inserted: 2009-01-23 03:20:12,End: 2009-01-23 03:19:12,Domain: Default,Group: My CompanyACME Remote,Server: acmesep01,User: smithe,Source computer: ,Source IP: 10.11.36.20 Aug 08 08:26:54 snort.acmetech.com {TCP} 10.11.36.20:5072 -> 10.11.36.26:443 itsec snort[18774]: [1:100000:3] [Classification: Potential Corporate Privacy Violation] Credit Card Number Detected in Clear Text [Priority: 2]: 20130806041221.000000Caption=ACME-2975EBAdministrator Description=Built-in account for administering the computer/domainDomain=ACME-2975EB InstallDate=NULLLocalAccount = IP: 10.11.36.20 TrueName=Administrator SID =S-1-5-21-1715567821-926492609-725345543 500SIDType=1 Status=Degradedwmi_ type=UserAccounts Sources All three occurring within a 24-hour period Example Correlation – Data Loss Source IP Source IP Source IP Data Loss Default Admin Account Malware Found Windows Authentication Time Range Intrusion Detection Endpoint Security What Does Machine Data Look Like?

47. © 2017 SPLUNK INC. Worst Practice: German Bundestag "The Trojans are still active," confirmed SPIEGEL ONLINE. According to data from several sources familiar with the case, Bundestag data from the ”Parliament" network continue to flow in an unknown direction.

59. © 2017 SPLUNK INC. Three Use Cases that bring different person’s on the same level and speak the same language, each: ▶ Real World Scenario (IT-Manager) ▶ Relevant GDPR Articles and what they mean (Data Privacy Officer) ▶ How machine data helps with (Splunk Champion) How Machine Data Supports GDPR Compliance Available at the Splunk stand R566

60. © 2018 SPLUNK INC. Machine Data is Crucial for Breach Response Detection, Investigation, Response & Remediation Custom dashboards Report and analyze Monitor and alert Developer Platform Ad hoc searchOn-Premises Private Cloud Public Cloud Storage Online Shopping Cart Telecoms Desktops Security Web Services Networks Containers Web Clickstreams RFID Smartphones and Devices Servers Messaging GPS Location Packaged Applications Custom Applications Online Services DatabasesCall Detail Records Energy MetersFirewall Intrusion Prevention Platform Support (Apps / API / SDKs) Enterprise Scalability Universal Indexing Machine Data: Any Location, Type, Volume Answer Any Question

61. © 2018 SPLUNK INC. Visit the Splunk stand for a demo of Security Essentials or Enterprise Security Ask for a Security Use Case Workshop Try it for FREE: online security investigation demo Next Steps

What you will take away from this session

Vous êtes en train de lire un aperçu.

Consultez-les par la suite

What you will take away from this session

Plus De Contenu Connexe

Diaporamas pour vous (20)

Similaire à What you will take away from this session (20)

Plus par Digital Transformation EXPO Event Series (20)

Plus récents (20)