Slides from the GDPR Security Roundtable hosted in Zurich. Part 1 of 2. “The aim of the GDPR is to protect all EU citizens from privacy and data breaches in an increasingly data-driven world" - Goal of the General Data Protection Regulation.

1. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.
GDPR Security Roundtable
Grüezi – Bonjour – Welcome – Willkommen – Buongiorno
Part I
Matthias Maier
22th November 2017, Marriott Zürich

2. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ 13:30 Uhr: Splunk Welcome and Introduction Round
• Intro to GDPR
• Discussion
▶ 14:30 Uhr: Splunk‘s View: Day in a life of a GDPR Breach & How it looks like in a SOC
▶ 15:15 Uhr: Coffee Break
▶ 15:45 Uhr : Two Customer Insights
▶ 16:30 Uhr: Panel discussion
▶ 17:00 Uhr: Apéro
Agenda

3. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Introduction Round
SOC / GDPR / Security Experience
Todays Expectations

4. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
GDPR: Overview
• Sharing Where are you with GDPR?
• Splunk’s View

5. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Goal of the General Data Protection Regulation
“The aim of the GDPR is to protect all EU
citizens from privacy and data breaches
in an increasingly data-driven world”

6. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
GDPR Timelines
The regulation is binding across all EU members states
January, 2012
Commissioner Proposed reform
to Data Protection regulation
May, 2018
Effective Data Protection
Framework comes into force (25th
May, 2018)
April, 2016
EU Council adopted new
regulation
December, 2015
EU agreement on regulation
including the UK after Brexit

7. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Key Features of GDPR
Applicable to any company doing business in the European Union
European
Data
Protection
Harmonizati
on
Fines up to
€20m or
4% of
turnover
Mandatory
Privacy
Impact
Assessment
s
Privacy by
Design &
Default
72 Hour
Breach
Notification
Mandatory
Data
Erasure &
Portability
Consent for
Personal
Data
Profiling

8. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
GDPR Advice
from the
information
commissioner
office

9. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
• Who drives the GDPR
Program in your
organization?
• Experience with the
GDPR
• What’s your GDPR
challenge / question /
take away you want to
hear from your peers
today?
Sharing
Experiences

10. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ What’s the current status within your Organizations? Data Impact Assessments
happened?
▶ Who owns the GDPR Program in your organization?
▶ What are the Key Challenges?
▶ What are expected changes that influences the IT Department? What changes
have happened already?
▶ What capabilities need to be established for breach notification?
▶ What capabilities need to be established for data privacy audits?
▶ How about monitoring of PII processing activities?
Roundtable Discussion Points
HINTS

11. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Splunk’s View

12. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
How Splunk helps you
with GDPR compliance
Do not break GDPR
compliance with Splunk

13. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ Data in transit: Encryption
▶ Data at rest: Encryption
▶ Data at rest: Integrity
▶ Data/Fields within Splunk:
• Anonymization in raw event
• Anonymization in presentation layer
• Pseudonymization in raw event
• Pseudonymization in presentation layer
Pseudonymization of PII
Stay compliant whatever occurs in your machine data
risk
minimization
strategy
1.5hr workshop available
with live demo

14. © 2017 SPLUNK INC.
A day in the life of a
GDPR Breach

15. © 2017 SPLUNK INC.
What if
tomorrow is

16. © 2017 SPLUNK INC.
What if you’re
responsible
for Security?

17. © 2017 SPLUNK INC.
You wake up
in the morning
and you even
haven’t had
your coffee

18. © 2017 SPLUNK INC.
Your friendly
Data Privacy
Officer is on
the phone

19. © 2017 SPLUNK INC.
Someone
claims to sell
PI data you
hold

20. © 2017 SPLUNK INC.
He hangs up!
What’s next?

21. © 2017 SPLUNK INC.
Your incident
investigation
plan kicks in

22. © 2017 SPLUNK INC.
DPO
IT
PR/Media Team
Legal
(CEO)
Coordination

23. © 2017 SPLUNK INC.
Emergency
call
Emergency
chatroom

24. © 2017 SPLUNK INC.
The fire alarm
button is
pulled down

25. © 2017 SPLUNK INC.
T- 72h

26. © 2017 SPLUNK INC.
Internal Leak
External Leak
Incident
commander
T- 70h

27. © 2017 SPLUNK INC.
“We need to
investigate!!!”
Reaching out
to your
security
operations
team
T- 65h

28. © 2017 SPLUNK INC.
Where is that
data stored in
your
environment?
T- 55h

29. © 2017 SPLUNK INC.
First Action
Is data still
leaking?
T- 45h

30. © 2017 SPLUNK INC.
How will you
watch them?
T- 40h

31. © 2017 SPLUNK INC.
Nice,
structured,
tidy data
T- 39h

32. © 2017 SPLUNK INC.
Diving deep into
the digital
infrastructure
T- 35h

33. © 2017 SPLUNK INC.
time series, in motion,
unstructured
Machine data
33
T- 34h

34. © 2017 SPLUNK INC.
It can be big
data…
T- 33h

35. © 2017 SPLUNK INC.
… it is lazy
T- 32h

36. © 2017 SPLUNK INC.
… and it is
hard to
understand…
T- 30h

37. © 2017 SPLUNK INC.
Take response
actions to stop
data leakage
T- 20h

38. © 2017 SPLUNK INC.
Understand
T- 15h

39. © 2017 SPLUNK INC.
How much
data will be
needed for
this?

40. © 2017 SPLUNK INC.
Who
processed
your
information?
T- 10h

41. © 2017 SPLUNK INC.
Which user or
systems was
involved?
T- 8h

42. © 2017 SPLUNK INC.
You know what you
know
You know what you
don’t know
Painting the
picture
T- 5h

43. © 2017 SPLUNK INC.
Maybe resulting in a
non event?
Puts the breach
data subjects at
risk?

44. © 2017 SPLUNK INC.
Do individuals need to
be informed
additionally?
How sensitive
was the data?

45. © 2017 SPLUNK INC.
before chatter explodes
• Inform Authority
• Inform affected
Individuals
• (Inform Public)
As an
organization
you want to
control the
story
T- 0h

46. © 2017 SPLUNK INC.
Worst
Practice:
German
Bundestag
"The Trojans are still active," confirmed SPIEGEL ONLINE. According to
data from several sources familiar with the case, Bundestag data from
the ”Parliament" network continue to flow in an unknown direction.

47. © 2017 SPLUNK INC.
Best Practice:
ABTA Breach

48. © 2017 SPLUNK INC.
Best Practice:
ABTA Breach

49. © 2017 SPLUNK INC.

50. © 2017 SPLUNK INC.
2+ weeks later out of
the news
Example
ABTA Breach
50

51. © 2017 SPLUNK INC.

52. © 2017 SPLUNK INC.
Someone
knocks on
your door
T+ 1 Week

53. © 2017 SPLUNK INC.
Have you deployed
“countermeasures
appropriate to the risk”?
Have you used “state
of the art” best
practices?
Data Privacy
Audits
T+ 1 Week

54. © 2017 SPLUNK INC.
Massive Fines
T+ 1 Week

55. © 2017 SPLUNK INC.
What did you know?
When did you know?
How did you know
about it?
Prove
T+ 2 Weeks

56. © 2017 SPLUNK INC.
Logs become
your digital
fingerprints

57. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Machine Data plays a critical role and helps your organization to
comply with the GDPR - Are you prepared?
We invite you to ask for a GDPR Workshop!

58. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Customer Story in
Detail
UCAS – Security Mapped to Business Needs
PostFinance – SOC Use Case in Detail: Phishing Fishers

59. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Security at the
Universities and
Colleges Admissions
Service (UCAS)
Neil Bell, Security Assurance Manager, UCAS

60. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Getting to know us a little
The world’s only national centralised
organisation processing applications to higher
education.
An intermediary in an ever changing multi-£billion market.

61. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Our customer(s)
Circa 800,000applicants
Circa 600,000 placed
4 million applications, in over 6,000 registered
centres, to 388universities & colleges & 1200 schools.
This includes UK & international schools, agents and advisers
from over 100 countries.

62. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ Protecting circa 800k Student Records (across multiple schemes) and ensuring
availability of our services throughout the year including during our peak periods
of activity
▶ Data flows from applications to universities and back
▶ Maintaining service levels throughout the year but with specific focus during
August
▶ “UCAS provides important core services throughout the year, but for two
weeks during August the reliance on our services is significantly increased
- we are a crucial part of the process of ensuring applicants obtain their
University offers. If we fail circa 700k+ Undergraduate students don’t get
their places confirmed on time (during an already stressful period) and
universities don’t fill the spaces they need to.”
Our priorities in IT

63. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
National News at UCAS on results day

64. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
BBC Live from UCAS on results day

65. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ Exam results: Time sensitive (embargoed) data
▶ Students: UCAS.com and TRACK.UCAS.com over 4000 hits/s
▶ Providers: 388 providers wanting the latest view of their applicants
▶ Detect issues before they become a ‘real’ problem
▶ We can only do this using a single analytics driven view
Our Challenges - The ‘live’ view

66. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Our Challenges - The ‘live’ view

67. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
• AV endpoint reporting – Vulnerability scan data – Web filtering – mail
filtering – Domain – DNS
• File system auditing, Database auditing, Web access logging
• 98 web application services
• Sophos Endpoint incl. PUA detection
• Cisco ASAs, Firepower, Cisco ISE, Palo Alto
• Amazon Web Services monitoring via the app
• And much much more…
What goes into Splunk?
Monitoring
Alerts
Data

68. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
​Centralized Visibility in our
SOC
​Detecting Security Risks
beyond Malware
​Incident Investigation to
prove-negative for breach
notification obligation
What do we do with Splunk’s Security Platform
Insights in three use cases

69. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
With Splunk Enterprise
Security in the Cloud
Centralized
Visibility in
our SOC

70. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
With Splunk Enterprise
Security in the Cloud
Centralized
Visibility in
our SOC

71. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Automation of reporting
Detecting
Security Risks
beyond
Malware
Need:
• Monitoring of file auditing to detect if unauthorized users
are making changes or access data that is treated under
NDA and a timed embargo
Solution:
• Enabled windows auditing and data onboarding within a
day
• Event enrichment through a list of authorised users
• Automated alerting

72. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Automation
Detecting
Security Risks
beyond
Malware
Need:
• Monitoring newly created domain users
Solution:
• On boarded data within a day
• Created a dashboard
• Splunk Cloud sends us every day a report to review

73. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Protecting Privacy
Incident
Investigation
to prove-
negative
Compliance Regulation:
We are processing personal information from students around
the world and need to comply with the Data Protection Act
1988 (shortly EU-GDPR)
If personal data is lost or ends up in the wrong hands,
we have the obligation to report publicly

74. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Protecting the Privacy
Incident
Investigation
to prove-
negative
Situation:
Security Incident which looked like a breach of the DPA
Solution:
Incident Investigation with Splunk
• Analysing log data from all our databases
• „Connecting the dots“
• Found out it was a false report of loss that we could prove
didn‘t happen - no data was disclosed.
• We showed that others were wrong.
Result:
• No statutory reporting needed
• Stronger reporting position
• Increased trust in the platform and my team

75. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ We have been going about a year, but…
▶ It can be technically done in less than 5 Weeks
▶ We have a ‘Splunk Champion’ in every business area that uses it
▶ Put as much in as you can to get the best out
▶ Operate
• IT core technology partner (Including SOC service)
• Splunk Cloud and Splunk Enterprise Security are key to the deliverables
• Splunk is listed as our strategic logging and SIEM product
What does it take to establish and build this?

76. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
PostFinance
SOC Use Case in Detail: Phishing Fishers

77. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Post Finance: How Splunk Connects Business
and IT at a Swiss Bank
▶ 1TB Data / Day, 55+ Splunk Apps, 2360 Source Systems, 800 Searches per
Minute
▶ Automated Statistic Generation for Fraud Detection and Product Management
in E-Payment
▶ E-Payment Fraud Investigation Workflow
▶ Online Banking Security ,Threat Detection like Phishing Attack response
workflows

78. © 2017 SPLUNK INC.© 2017 SPLUNK INC.

79. © 2017 SPLUNK INC.© 2017 SPLUNK INC.

80. © 2017 SPLUNK INC.© 2017 SPLUNK INC.

81. © 2017 SPLUNK INC.© 2017 SPLUNK INC.

82. © 2017 SPLUNK INC.© 2017 SPLUNK INC.

83. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.
Thank You
83

84. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.
Backup

85. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Finding of the ICO at a
Privacy Audit
Search and
Report on
data
processing

86. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2016 SPLUNK INC. CONFIDENTIAL. INTERNAL USE ONLY.
Splunk can help your Organization with GDPR
GDPR about People (IT & Legal), Process and
Technology
Splunk helps to detect, prevent and investigate
breaches
• Breach Notification Article
• Breach Communication to Individuals Article
• Implement appropriate techn. Measures (Article)
Prove GDPR security controls are enforced
• Data security article / state of the art tech / implement
appropriate techn. Measures
Search and report on personal data processing