Actualmente las organizaciones enfrentan el reto de mejorar su eficiencia y niveles de seguridad, el desarrollar una estrategia de integración donde exista comunicación entre la infraestructura de seguridad garantiza que se tenga un nivel de colaboración y mejora en el nivel de seguridad. Hoy esto ya es posible siendo una realidad para mejorar gasto y mejora en la eficiencia operativa de seguridad de las organizaciones. Conozca cómo llegar a construir este modelo SPEAKER : Juan Pablo Páez, CISSP, CISM - Gerente Regional Latinoamérica de Ingeniería y Preventa McAfee Juan Pablo tiene 14 años de experiencia profesional en seguridad de la información, especializado en tecnologías de seguridad, arquitectura de seguridad y gestión de operaciones automatizadas e inteligentes. Certificado CISSP, CISM CEH. Adicionalmente, tiene conocimiento para el desarrollo de diseños de redes seguras, arquitecturas, operaciones de seguridad inteligente iSOC basados en las mejoras prácticas de la industria y estándares como el ISO27000, PCI-DSS entre otros.

1. INTELLIGENT SECURITY OPERATIONS 1© Intel Corporation© Intel Corporation© Intel Corporation
Buscas una Seguridad
integrada y dinámica?
Inteligencia y colaboración la platarforma
de un modelo efectivo y eficiente
Juan Pablo Páez, CISSP, CISM
Sales Engineer Manager, MC LTAMs
Intel Security

2. INTELLIGENT SECURITY OPERATIONS 2© Intel Corporation
Security Executive Council
Questions: Where to Focus? How would you prioritize?
Automatic discovery
of significant
missed attacks
A
Visualization and
context to interpret
suspected attacks
B
Orchestration of
containment and
remediation
C
Management of
incoming threat
intelligence
D

3. INTELLIGENT SECURITY OPERATIONS 3© Intel Corporation
Market Research: Key Findings
SOC triage is broken SOC investigations take too long SOC is too dependent on humans
• 25% of alerts are
never triaged
• Least skilled and
experienced SOC
member makes the most
important decisions
• Takes weeks to do a
thorough investigation
• 75% time and effort
spent collecting data
• 25% time and effort
analyzing data to bring
investigation to a
conclusion
• SOC T1 role is the most
populous, yet poor ROI
• Investigation quality is
highly dependent on
human skill-levels
• There are low levels of
automation (esp. expert
knowledge) in the SOC

4. INTELLIGENT SECURITY OPERATIONS 4© Intel Corporation
Workflow for Attack Investigations
Logs,endpoint
data,etc.
Anomaly
Analytics
Deception
Technology
Behavioral
Analytics
Correlation
(via SIEM)
External
Threat Intelligence
Collect
Linking
Merging
Preliminary
Scoping
Triage
Ranking
Prioritize
Detailed
Scoping
Visualization
Enrichment
Scope
Quarantine
Remediate
Update and
Improve
Share
(Optional)
Respond

5. INTELLIGENT SECURITY OPERATIONS 5© Intel Corporation
Automatization Proposal
Logs,endpoint
data,etc.
Anomaly
Analytics
Deception
Technology
Behavioral
Analytics
Correlation
(via SIEM)
External
Threat Intelligence Linking
Merging
Preliminary
Scoping
Ranking
Detailed
Scoping
Visualization
Enrichment
Quarantine
Remediate
Update and
Improve
Share
(Optional)
Collect Triage Prioritize Scope Respond
Leverage a mature
Big Data platform to
effectively harness
and manage your data
Accelerate triage with
automatic case build-out
and expansion
Prioritize cases to improve
focus on the right attacks
Re-construct attacks with
evidence collection to speed
up investigation, decision-
making, and response
accuracy

6. INTELLIGENT SECURITY OPERATIONS 6© Intel Corporation
SIEM makeup result of organic evolution
Log Management + Analytics + Security Monitoring + Investigation + Response “In a Box”
Data
Ingestion
Parsing /
Normalization
Data
Management
Streaming
Analytics
Batch / Historical
Analytics
Log Mgmt,
Compliance, &
Forensics
Security
Monitoring
Corrective
Actions
Incident
Investigation
IntelligentSecurity
Operations
(Detection & Correction)
Integrations & EDR
Log &
Compliance
Mgmt
Data Platform
(SIEM)
Security
Analytics
(SIEM)

7. INTELLIGENT SECURITY OPERATIONS 7© Intel Corporation
Threat detection and hunting tools evolving
Devices Servers
Security
Products
Infra Svc
(ie DNS)
OtherNetwork
SIEM
Analytics
(ie UEBA)
Attack Investigation &
Response
Event & data
sources
Detection &
prioritization
of incidents
Investigation
& Response
EDR
Data/events
Potential
Incidents
Queries&
Actions
SecurityAnalytics

8. INTELLIGENT SECURITY OPERATIONS 8© Intel Corporation

9. INTELLIGENT SECURITY OPERATIONS 9© Intel Corporation
Cyber Resilience
Journey to build better security operations
Defense against
targeted threats?
COMPLIANCE-DRIVEN
INTELLIGENCE-DRIVEN
ANALYTICS-DRIVEN
OPERATIVE
FOUNDATION
INTEGRATED
Covering all operating
environments and
insider threats?
Meeting regulatory
compliance requirements?
1
2
3
2
Where is YOUR Focus?

10. Intel and the Intel and McAfee logosare trademarksof Intel Corporation inthe US and/or other countries. Other marksand brands may be claimed asthe property of others. The product
plans, specificationsand descriptionsherein are provided for information only and subject to changewithout notice, andare provided without warranty of any kind, expressor implied.
Copyright © 2017 Intel Corporation.