Splunk [Security, Compliance and Fraud Track] 2019 .conf Videos w/ Slides

DATEV provides information services to ~2.5 million payrolling, accounting, and tax clients. Given the sensitivity of the personal and financial data that our clients process, DATAEV decided to establish a SOC to secure our clients' information, and we put Splunk at the core of its operations. In this session we will discuss four key elements relevant to building a successful SOC with Splunk. We'll first discuss how we formed our SOC and orchestrated its activities internally. We'll then discuss how we use MITRE's ATT&CK™ framework to prioritize activities, how we spread our SOC's security knowledge to all relevant groups at DATEV, and how we use Splunk to create real-time situational awareness for different SOC customers, for stakeholders, and for management.

Speaker(s)
Sebastian Schmerl, Head of Cyber Defense, Computacenter
Christian Heger, SOC Architect / Technical Head of SOC & Analyst, DATEV eG

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1411.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Business Flow

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Winston Churchill once said, “Success is not final, failure is not fatal: it is the courage to continue that counts." Then again, Churchill wasn’t in cybersecurity...While our successes are certainly never final, our failures can absolutely be fatal—to a company and our continued employment. What's a good way to actually measure success and failure, though, outside of not appearing on the front page of the paper? Well, as CrowdStrike notes, you have on average one minute to detect an attack in progress, ten minutes to understand it, and sixty minutes to contain it. We will show how to use this 1-10-60 Rule as a measuring metric and leverage the data and capabilities within Splunk and its ecosystem to ensure that we win the survival of the fastest.

Speaker(s)
Wissam Ali-Ahmad, Lead Solutions Architect, Splunk
Tim Sullivan, Global Senior Strategic Solutions Architect, CrowdStrike

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1573.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Enterprise Security, Phantom

Track: Security, Compliance and Fraud

Level: Intermediate

This session will give you a comprehensive look into automating the investigation and remediation of AWS security events using Splunk Phantom. The session will start with an overview and then progress to a live technical walkthrough of setting up Phantom to remediate an AWS security event.

Speaker(s)
Matt Tichenor, Product Manager, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2187.pdf?podcast=1577146216

Product: Phantom

Track: Security, Compliance and Fraud

Level: Intermediate

We've run a risk-based approach with our security alerts for over a year, and we're excited to review our progress with you. We'll discuss how we increased the number of behavioral indicators by 300% while reducing our alerts by 50%. We'll also discuss how we expanded our risk approach to handle on premise and cloud environments within the same framework, which yielded a single alerting mechanism that leverages all of our data enrichment. We'll also share the roadmap for our risk-based approach, which incorporates risk rules that utilize algorithms to identify risks not discovered by traditional detection approaches.

Speaker(s)
Stuart McIntosh, Threat Intelligence, Outpost Security

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1908.pdf?podcast=1577146216

Product: Splunk Enterprise Security

Track: Security, Compliance and Fraud

Level: Advanced

Nick Hayes, VP of Strategy at IntSights, will take you on a tour of the dark web and explain how CISOs can successfully implement a dark web intelligence strategy to neutralize threats outside the wire and at the earliest stages of the cyber kill chain. Now equipped with IntSights External Threat Intelligence, learn how you can take advantage of it through seamless integrations with your Splunk SIEM and Phantom toolsets. Enrich your threat data with internal network security observables, expedite incident reviews and prioritization, and automate your threat prevention and response with SOAR and integrated playbooks.

Speaker(s)
Nick Hayes, IntSights

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2887.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Enterprise Security, Phantom

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Aflac measures risk to provide financial protection to more than 50 million people worldwide. Join this session to learn how Aflac mitigates fraud by using Splunk's Machine Learning Toolkit (MLTK) to find outliers and cluster events. Using Splunk and the MLTK reduced the time needed to conduct necessary analyses (e.g. link analysis) from weeks and months to just minutes—we will share with you how we use Splunk's MLTK to iterate quickly, develop new anomaly detection techniques, and improve our overall fraud mitigation perfomance.

Speaker(s)
Matthew Harper, Director, Cyber Crime Prevention, Aflac

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1904.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Machine Learning Toolkit, AI/ML

Track: Security, Compliance and Fraud

Level: Advanced

What happens when the call is coming from inside the house? Data exfiltration by insiders is a dangerous threat, but one that often doesn't get the same level of attention as the sexier external ones. We'll start this session with a brief overview of why and how users exfiltrate information, and we'll progress to tactics, such as effective SPL searches, for operationalizing insider threat detection. You'll leave this session better able to catch insider threats in the in the act of exfiltration instead of days, weeks, or months later.

Speaker(s)
David Doyle, Splunk Puncher, Bechtel
Eric Secules, Forensic Investigator, Bechtel

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1179.pdf?podcast=1577146216

Product: Splunk Enterprise

Track: Security, Compliance and Fraud

Level: Good for all skill levels

This presentation will discuss how Security Operation Centers (SOCs) will need to change to meet the cybersecurity challenges of the 2020s. The speaker will draw on his experience as a founder of the first SOC-as-a-Service company that delivers managed security services using Splunk. Most industry analysts envision that the next generation of SOCs will leverage AI, Big Data, and the Cloud, but how far can automation take us and is the concept of an autonomous SOC really practical? How will the SOC of the Future address the global shortage of cyber professionals? How will the role of security analysts need to change? Will the SOC of the Future still need to be housed in dedicated physical facilities? The speaker will provide a blueprint of Proficio’s vision of the SOC of the Future using Splunk and provide a playbook for IT leaders and aspiring IT leaders on how to drive continuous improvement in productivity and measurable outcomes.

Speaker(s)
Brad Taylor, Proficio

Slides PDF link - https://conf.splunk.com/files/2019/slides/SECS2839.pdf?podcast=1577146216

Product: Splunk Enterprise, Splunk Enterprise Security, Splunk User Behavior Analytics

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Intel is transforming its approach to security by deploying a new Cyber Intelligence Platform (CIP) based on Splunk, Kafka, and other leading-edge technologies. Our new platform ingests data from hundreds of data sources and security tools, providing context-rich visibility and a common work surface, and improving the efficiency of our entire information security organization. This session will address how we partnered with Splunk architects to deploy and realize benefits from this solution in just five weeks. We will detail how our solution uses real-time data, streams processing, machine learning tools and consistent data models to decrease time to detect and respond to sophisticated threats. This session will cover everything from our platform's business value to its solution architecture.

Speaker(s)
Jac Noel, Security Solutions Architect, Intel
Aubrey Sharwarko, Data Scientist, Intel
Jerome Swanson, Security Data Scientist, Intel

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2253.pdf?podcast=1577146216

Product: Splunk Enterprise Security

Track: Security, Compliance and Fraud

Level: Good for all skill levels

Deception, automation, and real-time data exploitation help security organizations go on offense vs attackers. In this session we will discuss how to use a variety of deception techniques to gather threat intelligence, how to create an automated response, and how to test response playbooks to validate that responses work as expected.

Speaker(s)
Vincent Urias, Researcher, Sandia National Laboratories
Will Stout, Researcher, Sandia National Laboratories

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2203.pdf?podcast=1577146216

Product: Splunk Enterprise Security, Splunk Machine Learning Toolkit, Phantom, AI/ML

Track: Security, Compliance and Fraud

Level: Intermediate