The New Security Frontier: Threat Hunting, Augmented Intelligence, - PowerPoint PPT Presentation

The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response Michael Melore, CISSP IBM Cyber Security Advisor @MichaelMelore June 2018

May 2018

May 2018

Threat Hunting Workflow Cognitive Advanced Analytics INVESTIGATE DETECT ENRICH ORCHESTRATE Incident Response

Investigations IBM CONFIDENTIAL until January 2017

Investigations IBM CONFIDENTIAL until January 2017

Investigations IBM CONFIDENTIAL until January 2017

What is an Unknown Unknown Search Offense Offense Property Property b i Offense Offense Offense Property Property Property a h c Offense Offense Offense Property d 1 2 Offense Property f Offense Offense Property Property g e Ask the question: “show me which offenses share the same property” – you don’t know the subset of offenses, not the subset of properties to search

Investigations IBM CONFIDENTIAL until January 2017

Hunting IBM CONFIDENTIAL until January 2017

Incident Response

Gain integrated, real-time threat intelligence IBM X-Force Exchange Find, fix, and secure endpoints Prevent advanced network attacks Use analytics to discover and eliminate threats Coordinate response activity Understand the latest threat actors Crowd-sourced information sharing Get help from security experts based on 700+TB of threat intelligence https://exchange.xforce.ibmcloud.com

Gain integrated, real-time threat intelligence IBM X-Force Exchange – Tailored Dashboards Find, fix, and secure endpoints Prevent advanced network attacks Use analytics to discover and eliminate threats Coordinate response activity Understand the latest threat actors Crowd-sourced information sharing Get help from security experts based on 700+TB of threat intelligence https://exchange.xforce.ibmcloud.com

An integrated and intelligent security immune system Device management Content security Data monitoring Data access control Access management Application scanning Cloud access Workload Application security management Identity management security broker protection

The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response Michael Melore, CISSP IBM Cyber Security Advisor @MichaelMelore June 2018