Splunk [Enterprise Security] 2019 .conf Videos w/ Slides

What if you can scale test your Splunk Enterprise with multi-terabyte of data ingest followed by concurrent search tests on the loaded data? Attend this session to learn more about the framework for multi-terabyte data generation and multi-user search tests on Splunk Enterprise 7.2+.

Speaker(s)
Somu Rajarathinam, Pure Storage

Slides PDF link - https://conf.splunk.com/files/2019/slides/ITS2634.pdf?podcast=1577146234

After breaches, incident response teams often end up with an overwhelming amount of forensic evidence data, including disk images, memory captures, PCAP, and more. We'll show you how one of our IR/forensics teams is ingesting this data into Splunk to answer the who, what, where, when and why of breaches. Our presentation will show you how to use Splunk Enterprise and Splunk Enterprise Security for Incident Response (IR) workflow tracking and reporting on multi-source forensic data captures.

Speaker(s)
Josh Wilson, Consulting Engineer, August Schell
Dave Martin, Supervisory Special Agent, Federal Bureau of Investigation

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1796.pdf?podcast=1577146234

The Census is the nation’s largest peacetime mobilization effort and determines congressional representation. Census data is used by businesses, governments and civic organizations to inform decision-making and this year the Census is going mobile and online for the first time. This means that security is a top priority in ensuring the success of the 2020 Decennial. This segment of the conference will explore security related topics to include vulnerabilities, scalability and performance, with a special focus on Data Privacy, Compliance and Reputational Threat Management. If all things data and IT Security excite you, then this session is for you. Census executives Atri Kalluri and Zack Schwartz will provide a behind the scenes overview of the systems supporting the 2020 Decennial, including Splunk, and real world case studies on how the Census Bureau is adopting best practices across IT security and social media monitoring to ensure the security of respondent data.

Speaker(s)
Atri Kalluri, Senior Advocate, Response Security and Data Integrity, U.S. Census Bureau
Zack Scwhartz, IT Program Manager, U.S. Census Bureau

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2638.pdf?podcast=1577146234

Last year, after our outrageously successful talk "Pull Up Your SOCs: A Splunk Primer on Building or Rebuilding your Security Operations", we wanted to revisit this topic to cover changes in Security Operations that have taken place over the last 12 months. Whether you’re starting from scratch or rebuilding your security program, the first twelve months of standing up your security operations is absolutely critical to success.

Speaker(s)
Dimitri McKay, Staff Security Architect | Jedi Master, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2186.pdf?podcast=1577146234

Many government agencies and for-profit companies require that you run Splunk on a network disconnected from the outside Internet. This presents many challenges, including how to cross air gaps and one-way transfers, how to operate indexers in an air-gapped environment, and how to automate backwards. This session will cover lessons learned from a variety of air-gapped deployments.

Speaker(s)
Steve Schohn, Staff Sales Engineer, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1190.pdf?podcast=1577146234

Copper River ES, a strategic partner for Splunk public sector, is working with a large federal agency that has restructured their NOC and SOC organizations into a single unified entity as part of operational optimization.  The agency is responsible for protecting IP and other assets totaling $4.3 trillion as part of safeguarding the nation’s food supply chain.   The goal was to enhance the ability to handle problem escalations quickly and improve communications between teams. They are currently ingesting more than 3TB daily across 65 data sources where Splunk is leveraged as an integrated data platform and framework service to act as a nerve center for the combined NOC and SOC teams. Implementation has resulted in dramatically reducing MTTD to an average of less than 30 min compared to previous times of up to 12 hours, MTTR times from 16 hours to often less than 1 with overall outage times having now been reduced by about 68%. From a security perspective, it is used to identify data exfiltration and insider threats, as well as for security operations and compliance.  Increasing visibility into all aspects of system operations and troubleshooting efforts is now supported through a series of custom Splunk App’s, glass tables, reports and alerts with operational guides and training to best leverage the capabilities Splunk has generated.

Speaker(s)
Sandy Voellinger, Copper River Enterprise Services

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1921.pdf?podcast=1577146234

As the types of devices and applications used in IT organizations increase exponentially, scaling the analytics-driven SOC becomes even more imperative. In this session Splunk Professional Services will help you learn from its past experiences architecting Splunk Enterprise Security environments for scale into the terabytes per day. We will share technical details on improvements to search technology and Data Model Acceleration in Splunk Enterprise that will help you increase performance and decrease total cost of ownership. We will also take a deep dive under-the-hood into Splunk Enterprise Security Frameworks in which you should make special considerations for high volume.  Finally, we'll share important metrics on how to monitor the ongoing health of your Enterprise Security deployment, ensuring you stay on track over time, even in periods of rapid growth.

Speaker(s)
Marquis Montgomery, Principal Security Architect, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2120.pdf?podcast=1577146234

Organizations today struggle with quickly and consistently applying behavior-based threat intelligence across their security tools. The hours needed to stitch together this information manually leave analysts unprepared to quickly turnaround questions from management about their vulnerability to threats that their management sees in the news. In this session we will demonstrate how to use Splunk Phantom to reduce that time lag by automating your threat hunts. Specifically, we will show you how to use Yet Another Recursive Algorithm (YARA) rules on endpoint and network security tools automatically and simultaneously. We will use a case study to show the benefits achieved from this playbook: better reporting, more robust procedures, faster time to detect malware variants, and generally more efficient and effective threat hunts.

Speaker(s)
Robb Mayeski, Security Automation Magician , EY
Will Burger, Security Automation Consultant, EY
Haris Shawl, EY

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1280.pdf?podcast=1577146234

Join this session to learn the do’s and dont’s of rolling an effective cloud security visibility platform for a global organization. We will cover topics such as why we moved away from our previous SIEM provider, deploying and managing a cloud-based SIEM, and effectively using a third party organization to provide tier 1 and 2 event and incident support.

Speaker(s)
Simon O’Brien, Principal Sales Engineer, Splunk
Grant Slender, Chief Information Security Officer, QIC

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1205.pdf?podcast=1577146234

Women are underrepresented across all levels of the technology industry. Find out how these four female leaders advanced their careers to lead the industry. Join us for an in-depth discussion about female diversity and the importance of including women in leadership from those who've made it to the top.

Speaker(s)
Suzanne McGovern, Chief Diversity Officer & Head of Talent, Splunk
Jane Hite-Syed, NGS CIO, National Government Services
Patty Morrison, Splunk Board Member, Splunk
Monika Panpaliya, Senior Director, Digital Common Services, Boeing
Carol Jones, CIO, Sandia National Laboratories

Slides PDF link - https://conf.splunk.com/files/2019/slides/FND1268.pdf?podcast=1577146234