We've run a risk-based approach with our security alerts for over a year, and we're excited to review our progress with you. We'll discuss how we increased the number of behavioral indicators by 300% while reducing our alerts by 50%. We'll also discuss how we expanded our risk approach to handle on premise and cloud environments within the same framework, which yielded a single alerting mechanism that leverages all of our data enrichment. We'll also share the roadmap for our risk-based approach, which incorporates risk rules that utilize algorithms to identify risks not discovered by traditional detection approaches.

Speaker(s)
Stuart McIntosh, Threat Intelligence, Outpost Security

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1908.pdf?podcast=1577146235

Nick Hayes, VP of Strategy at IntSights, will take you on a tour of the dark web and explain how CISOs can successfully implement a dark web intelligence strategy to neutralize threats outside the wire and at the earliest stages of the cyber kill chain. Now equipped with IntSights External Threat Intelligence, learn how you can take advantage of it through seamless integrations with your Splunk SIEM and Phantom toolsets. Enrich your threat data with internal network security observables, expedite incident reviews and prioritization, and automate your threat prevention and response with SOAR and integrated playbooks.

Speaker(s)
Nick Hayes, IntSights

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2887.pdf?podcast=1577146235

Have you ever wondered what Joe meant when he referred to “Wire Data”? Today, you'll see the applicability of wire data in your organization, and you'll be amazed. Solve fraud, cybersecurity, ops, and business challenges, all with one single source of data. Wire data is the information that passes over computer and telecommunications networks to define communications between client and server devices. It is the result of decoding wire and transport protocols containing the bi-directional data payload. We will cover the use of wire data to solve security, IT operations, and business use cases, and see how the Splunk Stream platform is easily integrated into your existing data flows. The Splunk Essentials for Wire Data app from Splunkbase will be used to showcase dozens of examples using wire data to solve common business and technical issues. We will cover how to deploy and configure Splunk Stream in a distributed environment, including a demonstration.

Speaker(s)
Simon O’Brien, Principal Sales Engineer, Splunk
Vinu Alazath, Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1206.pdf?podcast=1577146235

This presentation will discuss how Security Operation Centers (SOCs) will need to change to meet the cybersecurity challenges of the 2020s. The speaker will draw on his experience as a founder of the first SOC-as-a-Service company that delivers managed security services using Splunk. Most industry analysts envision that the next generation of SOCs will leverage AI, Big Data, and the Cloud, but how far can automation take us and is the concept of an autonomous SOC really practical? How will the SOC of the Future address the global shortage of cyber professionals? How will the role of security analysts need to change? Will the SOC of the Future still need to be housed in dedicated physical facilities? The speaker will provide a blueprint of Proficio’s vision of the SOC of the Future using Splunk and provide a playbook for IT leaders and aspiring IT leaders on how to drive continuous improvement in productivity and measurable outcomes.

Speaker(s)
Brad Taylor, Proficio

Slides PDF link - https://conf.splunk.com/files/2019/slides/SECS2839.pdf?podcast=1577146235

Industrial operations comprise a diverse blend of technology that run critical processes. The proliferation of automation and networking has increased the sophistication of Industrial Control Systems (ICS), also known as Operational Technology (OT) environments.Threats targeting OT are increasing in both frequency and sophistication. Dragos tracks 9 OT-targeting activity groups, the most significant of which, XENOTIME, was responsible for the TRISIS malware that targeted safety systems (SIS) resulting in multiple plant shutdowns and the potential to cause harm to human operators.Traditional IT threat hunting is not well-suited to OT environments. This session will outline the differences between IT and OT assessments, highlight the most significant threats facing OT, and review best practices for OT-specific threat hunting engagements, including techniques that empower defenders to detect and respond more efficiently to existing and future threats, therefore reducing adversary dwell time.

Speaker(s)
Amy Bejtlich, Threat Intelligence, Dragos
Marc Seitz, Threat Analyst, Dragos

Slides PDF link - https://conf.splunk.com/files/2019/slides/IOT1641.pdf?podcast=1577146235

Intel is transforming its approach to security by deploying a new Cyber Intelligence Platform (CIP) based on Splunk, Kafka, and other leading-edge technologies. Our new platform ingests data from hundreds of data sources and security tools, providing context-rich visibility and a common work surface, and improving the efficiency of our entire information security organization. This session will address how we partnered with Splunk architects to deploy and realize benefits from this solution in just five weeks. We will detail how our solution uses real-time data, streams processing, machine learning tools and consistent data models to decrease time to detect and respond to sophisticated threats. This session will cover everything from our platform's business value to its solution architecture.

Speaker(s)
Jac Noel, Security Solutions Architect, Intel
Aubrey Sharwarko, Data Scientist, Intel
Jerome Swanson, Security Data Scientist, Intel

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2253.pdf?podcast=1577146235

Deception, automation, and real-time data exploitation help security organizations go on offense vs attackers. In this session we will discuss how to use a variety of deception techniques to gather threat intelligence, how to create an automated response, and how to test response playbooks to validate that responses work as expected.

Speaker(s)
Vincent Urias, Researcher, Sandia National Laboratories
Will Stout, Researcher, Sandia National Laboratories

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2203.pdf?podcast=1577146235

Most of us have had (or still have) nightmares about an alert that someone's exfltrating data from our organization. We've lived that nightmare at Harris, and we've learned from it. In this session, we'll discuss how we used red and purple teaming to improve our security posture post-breach. Learn from our experience so that you can strengthen your team's alerting, staff comptency, and policies, and reduce the risk of a breach at your company.

Speaker(s)
Nate Piquette, Sr. Detection & Response Engineer, L3Harris Technologies
Adam Parsons, Sr. Detection & Response Engineer, L3Harris Technologies

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1375.pdf?podcast=1577146235

Obtaining data to develop defenses against threats is a constant challenge for security analysts. To that end, Splunk's Security Research team developed the Splunk SIEMulator, a framework modeled after Chris Long's DetectionLab that allows a defender to replay attack scenarios using AttackIQ in a simulated environment. SIEMulator’s Attack Range environments are all configured with Splunk forwarders and the apps necessary to create and store data in CIM data models. We'll show you how to use the SIEMulator to produce shareable data that can help security analysts replicate scenarios and effectively detect, investigate, and respond to threats.

Speaker(s)
Phil Royer, Research Engineer, Splunk
Rod Soto, Principal Security Research Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1671.pdf?podcast=1577146235

As a high-profile public-sector organization, the Dutch Tax and Customs Administration deals with criminals claiming to be representatives of the organization and contacting the public with phishing e-mails every day. By using Splunk and RFC’s like, RFC7208 – Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, we have developed a technique to identify phishing attacks that are carried out under the disguise of the Dutch Tax and Customs Administration. This technique is universally applicable. A precondition is access to the DNS logging. By means of this technique, insight can be obtained where the phishing e-mails are sent from and to whom the phishing e-mails are sent. In this talk we will start by explaining which standards are available to increase e-mail security and how we have build an app in Splunk, including dashboard and a wizard to create the necessary DNS records to gain insight information about the abuse of our domains.

Speaker(s)
Karl Lovink, Lead Security Operations Center, Dutch Tax and Customs Administration
Arnold Holzel, Senior Security Consultant, SMT

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1106.pdf?podcast=1577146235