Splunk [Security, Compliance and Fraud Track] 2019 .conf Videos w/ Slides

Our security research, engineering and product teams have been hard at work building new capabilities to bolster your Splunk security stack. Find out what they’ve been up to since .conf18, and watch a demonstration of the latest innovations in Splunk Enterprise Security, Splunk User Behavior Analytics, and Splunk Phantom. There are other awesome developments that we can’t share now but are excited to share with you at .conf.

Speaker(s)
Kyle Champlin, Senior Product Manager, Splunk
Patriz Regalado, Sr. Product Marketing Manager, Splunk
Rob Truesdell, Sr Director, Product Management, Splunk
Chris Simmons, Director of Product Marketing, Splunk
Koulick Ghosh, Product Manager, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2366.pdf?podcast=1577146217

Product: Splunk Enterprise Security, Splunk User Behavior Analytics, Phantom

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Never used Splunk before, have no Splunk admins and you’ve just bought Splunk Enterprise Security? That was us, and now we're using Splunk in ways that we could've only dreamed of using IBM QRadar. In this session we’ll share our implementation story, how we worked with Splunk to accelerate our learning curve, and how we went from 0 to 3TB in 3 months with no Splunk admins. We'll also cover how Splunk allows us to onboard data sources that we couldn't with QRadar.

Speaker(s)
Nick Ho, Sales Engineer, Splunk
Ross Rutherford, Information Security Engineer, Western Union

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1264.pdf?podcast=1577146217

Product: Splunk Cloud, Splunk Enterprise Security

Track: Security, Compliance and Fraud

Level: Beginner

Does your small team also run a full-featured SOC that supports a global company? In this session we’ll show you how we’ve used Splunk Cloud and Splunk Enterprise Security to bring together all the relevant security intelligence from our technology stack, transforming our security operations from ad hoc and tactical to strategic and compliance-driven. We’ll discuss key takeaways from our journey, such as the benefits of ingesting data properly from the outset so you can reap the rewards as you scale; how we leverage multiple use cases out of single data sources; and how we created easy-to-understand visualizations that convey our firm’s security posture to management.

Speaker(s)
Edward Asiedu, Senior Professional Services Consultant, Splunk
Craig Gilliver, Head Of SecOps, Johnson Matthey

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1511.pdf?podcast=1577146217

Product: Splunk Cloud, Splunk Enterprise Security, Phantom

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Join us to see the latest developments with Splunk’s Security Operations Suite. We’ll share background on the underlying architecture as well as a showcase of new features. Learn how your security use cases are solved with scale and performance.

Speaker(s)
Rob Truesdell, Sr Director, Product Management, Splunk
Atom Coffman, Starbucks

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1706.pdf?podcast=1577146216

Product: Splunk Enterprise Security, Splunk User Behavior Analytics, Phantom

Track: Security, Compliance and Fraud

Level: Beginner

Today SOCs are in desperate need of a different alerting approach. Texas Instruments (TI) decided to transform its SOC by using risk-based alerting to generate fewer, higher fidelity alerts, and by aligning to the MITRE ATT&CK™ framework, which provides more situational awareness to analysts. This risk-based approach reduces false positives and the situational numbness associated with the legacy whitelisting process. Splunk and TI will walk you through TI's SOC successes as it transitioned to risk-based alerting. TI will detail a few real-life risk-based rule examples, discuss learning curves to fast track your transition, and discuss how MITRE ATT&CK™ fits in with this approach. After this session, you will have the foundation to embark on your risk-based alerting journey, allowing you to increase detection mechanisms, increase your coverage of the ATT&CK™ techniques, and improve the overall effectiveness of your SOC.

Speaker(s)
Jim Apger, Staff Security Architect, Splunk
Jimi Mills, Security Operations Center Manager, Texas Instruments

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1803.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Enterprise Security

Track: Security, Compliance and Fraud

Level: Intermediate

We will share our journey, lessons, and observations from the past year of implementing compliance at the MITRE Corporation. We'll recap our path from initially learning about Defense Federal Acquisition Regulation Supplement (DFARS), also known as NIST 800-171, to complying with it. We'll share insights from the process that may help you in your compliance journey, but we'll also discuss how your journey might be different than ours, as one size never fits all with compliance.

Speaker(s)
Bob Clasen, Computer Engineer, MITRE
Eugene Katz, Splunk Evangelist, MITRE

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1372.pdf?podcast=1577146216

Product: Splunk Enterprise

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Learn from our experience implementing Splunk Phantom so that you can speed up your automation journey. We'll examine key decisions we made with our implementation and the good and the bad that resulted. We'll also cover our automation efforts in event triage, incident response and everything in between, with walkthroughs of our top playbooks. Additionally, we'll present how we tackled Splunk alert ingestion and what Phantom could look like in a cloud-first deployment.

Speaker(s)
John Murphy, Security Analyst, NAB
Chris Hanlen, Lead Cyber Security Specialist, NAB

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1506.pdf?podcast=1577146216

Product: Splunk Enterprise, Phantom

Track: Security, Compliance and Fraud

Level: Good for all skill levels

After breaches, incident response teams often end up with an overwhelming amount of forensic evidence data, including disk images, memory captures, PCAP, and more. We'll show you how one of our IR/forensics teams is ingesting this data into Splunk to answer the who, what, where, when and why of breaches. Our presentation will show you how to use Splunk Enterprise and Splunk Enterprise Security for Incident Response (IR) workflow tracking and reporting on multi-source forensic data captures.

Speaker(s)
Josh Wilson, Consulting Engineer, August Schell
Dave Martin, Supervisory Special Agent, Federal Bureau of Investigation

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1796.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Enterprise Security

Track: Security, Compliance and Fraud

Level: Good for all skill levels

The Census is the nation’s largest peacetime mobilization effort and determines congressional representation. Census data is used by businesses, governments and civic organizations to inform decision-making and this year the Census is going mobile and online for the first time. This means that security is a top priority in ensuring the success of the 2020 Decennial. This segment of the conference will explore security related topics to include vulnerabilities, scalability and performance, with a special focus on Data Privacy, Compliance and Reputational Threat Management. If all things data and IT Security excite you, then this session is for you. Census executives Atri Kalluri and Zack Schwartz will provide a behind the scenes overview of the systems supporting the 2020 Decennial, including Splunk, and real world case studies on how the Census Bureau is adopting best practices across IT security and social media monitoring to ensure the security of respondent data.

Speaker(s)
Atri Kalluri, Senior Advocate, Response Security and Data Integrity, U.S. Census Bureau
Zack Scwhartz, IT Program Manager, U.S. Census Bureau

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2638.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Enterprise Security

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Last year, after our outrageously successful talk "Pull Up Your SOCs: A Splunk Primer on Building or Rebuilding your Security Operations", we wanted to revisit this topic to cover changes in Security Operations that have taken place over the last 12 months. Whether you’re starting from scratch or rebuilding your security program, the first twelve months of standing up your security operations is absolutely critical to success.

Speaker(s)
Dimitri McKay, Staff Security Architect | Jedi Master, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2186.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Enterprise Security, Phantom

Track: Security, Compliance and Fraud

Level: Good for all skill levels