[Music]
all right uh my name is Jeremy hegerman
I'm from Cisco Systems and all of you I
welcome all of you to my talk um so I
want to talk about security operations
from a a real world persp perspective uh
I used to run a sock and then I ran
cyber defense team for a while discover
Financial
Services
um uh so I have I I've been in in cyber
defense for I think now about 100,000
years so um adjusted for
inflation um so I want to start off with
just like normalizing some of the stuff
we talk about when we talk about
security operations and I want to talk
about some of the different security
operations model so we have a basis from
which to uh
to further discuss how we're going to
build out from there so um everyone has
a model that they're in whether or not
it's you know intentional or
non-intentional but you'll find yourself
in one of these models right generally
speaking so we talk about the the
security operations is a service model
you have the sck knck when I say sock
knck I'm talking about uh individuals
that are doing both network operations
and security operations
um we have like co-manage type
situations where we have both the um the
sock situation as well as an internal
sock and then we also have dedicated
socks and then command socks are what
you would see at very very large
organizations and that's kind of where
you know once companies get to be you
know in the Fortune 100 that's kind of
where they start to start to move
towards um but realizing that each one
of these has a strength and a
weakness um many times we start
implementing these models we Implement
and we talk about the strength of the
model and we kind of ignore the weakness
and we really need to lean into the
weakness uh and acknowledge their
weakness and address it so for example
um we talk about like the the uh the
dedicated sock as a service model if we
don't have people on the ground boots on
the
ground we're really going to struggle
with actually doing things right because
the boots and the around that'll be
there not going to be educ ated they're
not going to be security people and
they're not really going to know how to
do anything other than follow what some
weird person in the phone says and the
person on the phone has no idea of the
operation the operational context of
those events or what may break or what
may not break or should someone be
talking to someone else within an
organization they're only looking at
kind of an alert space model so I just
kind of like set with that and then
start to talk about like stock growth
trajectories and um this is just kind of
like where we see people move right so
people start off with like an individual
contributor they'll move to security
team then they move to one of these
models before they ultimately end up in
a command sock but the reality is is
that majority of the companies right now
are kind of in this spot they're in the
sock knock model sock is a service model
co-managed and we just kind of have to
understand that because as we're going
through this cyber security maturity
life cycle um as we're moving more
towards anticipatory uh we have to
really understand in our stock uh
Evolution that we are that we're always
cognizant of where we are what that
weakness is and we're addressing that
weakness as well as um in in the long
term are we are we do we have the right
trajectory because what a lot what
happens a lot of times we end up with
these Point Solutions in the time frame
and the result of that is we end up with
a a a spaghetti of security products
that don't really do anything and don't
have really any intent and so we're
trying to move beyond that because we
talk about it you know actions determine
outcomes and uh we need to create ttps
within our organizations that help us um
move towards a model that is solid and
we always going to need boots in the
ground
so I kind of skipped over that but all
right
so what what security keems want and I
this is a marketing slide so I apologize
but uh it does kind of hit these next
few slides are kind of markting slides
and I apologize about that but I I want
to kind of drive home the fact that you
know we have to start thinking about
making our environment simple accelerate
our our involvement as well as that
we're keeping our environment secured
because the reality is that things are
getting more complex and complexity is
the antithesis of security so the more
complexity we have the more difficult it
is actually do real world
security so basically we have a platform
that helps kind of address some of that
stuff and I want to kind of like I I put
this up there because I want people to
understand like Cisco has been doing
this for a very very very long time um
if you guys remember Mars if you're old
enough to remember Mars it was way ahead
of its time fantastic
product uh I still don't know if I
forgive us for for getting rid of that
that's a great product but um but it
does take time to build that up as well
as well as we start talking about the
threat research stuff our threat
research team tallos is one of the best
in the world I mean no one can refute
that it is clearly one of the best um
and I once jokingly said to the Talis
person you know do you guys work with
the government and the Talis person said
back to me no they work with us so you
know maybe there's some ego involved
there I don't know but um we have a very
strong portfolio and so the most people
most organizations they'll Focus
primarily on like an endpoint security
model and when they have the endpoint
security model they have those kind of
filtered in but we really need to be
able to look across the entire Spectrum
so look at Network because an endpoint
becomes disabled then we still need some
secondary control that can look at that
uh as well as when we start look getting
Cloud environments and Cloud Edge
environments um those those areas are
are evolving so quickly um and they're
so difficult to stay on top of that
securing them is incredibly difficult
because to me at least in my opinion
hopefully you guys agree you have to
know a thing before you can secure a
thing right and that is a severe
Challenge and I can tell you we've made
some dooes of mistakes in our past uh
and my previous employer actually doing
that and um and the reality is that if
we can get to a place where we have
something is controlling the
underlay where it it kind of trickles up
the environment and then we can see
everything at a platform level it makes
it a little bit easier to handle and
so I I want to talk to you guys about
securex securex is our uh xdr platform
um it's it is cloud native you uh
basically bring in all the Telemetry
from all your tools all the outside
tools um and and that's growing every
day everybody has their own way of
bringing Telemetry in
um if we don't have the support there's
a third party connector that we have
that you can use to bring third party
data into uh into the tool um but at the
end of the day what we're really talking
about is starting to use cloud native
security platforms to manage the
incidents that come into our environment
and I would just say this I I I bring
this up because this is not actually
even a complete picture but when we
start out with these alerts
alerts most of the time have no context
um and then we have to Pivot between
different PL different places and
everybody talks about having a single
paint of glass uh I don't necessarily
agree with that model on an on the
operations of the device side because
then you with like 50 tabs this way 50
tabs this way 50 tabs in the middle um
but our security signals and our ability
to manipulate the um automate the
responses to those security signals we
should be pulling those into a single
location and a single paint of glass and
so when we talk about like taking these
ioc's and then turning them into action
um there we go oh look at that that was
fancy wouldn't it uh we're really
talking about like two two workflows
right we're talking about an instant
handling workflow and we're talking
about a uh a threat hunting workflow and
the difference between those two in my
opinion is you end you start off if
you're doing an instant investigation
workflow basically what's happening is
uh you're using your tools whatever
tools they are and you're ciphering
through them and you begin to find
things that are interesting and then
when you find those we turn those into
our own indicators of compromise for a
given case right and so once we turn
those into ioc's for that case or I call
them IO um we turn into IO then we want
to take that data and then find out how
much we know about that in a bunch of
different ways and so if you're used to
like traditional Sim models what you
would do is you would start out with
like an IP address or something like
that and then you would go and say okay
show me everything about the IP address
okay well now we did that now let's okay
oh the username that and the username
right I don't know if you guys have done
this kind of stuff and then that and the
username and the you know Mac address
just depends on how the log gives you
the data right and the idea is that when
when we're looking at security uh secure
xdr type Solutions or xdr type Solutions
we need be able to see relationships and
get the data in a way that makes sense
to humans because humans are really good
at doing like complex processing from
like a like when you give them something
visual they can really deal with it um
but when you give them words or you give
them just like static things they're not
as good at that as it turns out as maybe
computers are so um so I'm going to take
you to a
demo so this is secure X and secure X is
um we start off by really just focusing
on oh
yeah
oh I got to take myself up presenter
mode apparently there we
go thank
you so when we start off with secure
secure X we have our standard what I
call the sock wall kind of you know
dashboards I'm not going to spend too
much time on this because everybody can
kind of like configure you configure
your own dashboards you can customize it
to just for you or other people um and
you know as you start to build
Integrations the then you'll start to
see more and more tiles that are
available for you to actually build
dashboards on I I I don't like spend too
much time on the dashboard because I
feel like that's kind of table Stakes at
this point right um we do have uh uh
like security events that come in on the
site you see so you can see if any new
security events have come in um and then
here's the actual Integrations that we
have enabled when you do when you go
actually to do
Integrations um so we have a bunch of
different Integrations it tells you
instantly if there's a problem with the
integration or if there's not a problem
with integration because if we have a
problem with integration we don't know
about it uh that can skew our data so
when we actually go to run an
investigation we want to make sure that
we understand at the time we're running
it anything that could have impacted NE
negatively so let's start uh let's so we
get our that we get our dashboard done
and then the other kind of pieing we can
pull in if we start to pull in something
with our tool called
insights um uh with insights we're
actually pulling in oh thank you we're
actually pulling in
um we're actually pulling in uh data
from from your mdms so with the with the
data from your mdms we can begin to
build a complete picture of an endpoint
so if you think about like when I said
before we have to like go and peace meal
things together as many different ways
that we can pull to themetry uh from the
beginning and say that they're related
and then ask apis what do you know about
those and then pull them back and give a
picture that's really the thing that we
kind of want to drive towards right and
and that's what that's one of the real
Powers here so um so let me show you
real quick I'm just going to go through
the threat hunting workf flow But
realize you can do the same thing and
I'll show you the uh the incidents in a
minute but you can do the same kind of
thing given your own ioc's um as as I'm
about to show you so uh this is a a
Talis blog on half them the fact that
it's Talis blog it could be any web page
this could be Splunk this could be any
page that you can any web page out there
um we have a a chrome add-on and when
you click on the Chrome add-on and then
you come to this little thing here find
observables on page it actually parses
through this entire page and pulls out
all the ioc's on this page and then
gives you a really quick disposition on
those different elements right so
there's nine of these nine of these are
unknown we know four five or four are
malicious and two are clean so let's say
that now we want to go do oh by the way
so let me show you this too so on this
web
page um these ioc's are actually we call
them defamed right so if you see here
they've got the brackets around the
periods uh the tool actually pulls that
out for you and uh in my previous role
as a stock manager uh I invented
something called the hover click because
my team came to me and said hey you
clicked on an an iok and I was like I
didn't click on an iok and they said but
we see it in the logs and I said I
didn't click on the iok and they said
okay you must have hover clicked it um
so I'm the inventor of the hover click
apparently uh which got me a
complimentary free rebuild I'm sorry
yeah so it got me a compliment
complimentary uh free re rebuild of my
laptop which was
fantastic um and uh because my previous
employer they're not they don't mess
around about that stuff it's just you
get something you get going so um so
realize that we can just quickly pull
those things
out say we quickly pull out there
go get the dispositions and then we can
just say investigate threat
response so now what this is doing is we
pulled all those ioc's off that off that
page we've defamed them we're now going
out and we're saying give us all the
information that you have about this
particular thing and then bring it back
in a way that is uh that is Meaningful
to us and right so we have three
different Windows here and I'm going to
actually add you can see you can
actually add things to the
workflow I'm add to the clean elements
to the
workflow um and so why this is building
but so realize that um what we're doing
right now is we are going out real time
we're pulling back data from all the
apis that we have integrated in securex
so it's asking all of these
Integrations what they know about those
things give us all the data you have on
those and then pull all that back and
give us a view that humans can
understand and I hate this toot else I'm
going to move something down to the boot
just makes more sense to
me
so you can see right now it's actually
building real time those things so it's
actually taking all of those elements
going out and asking the apis for stuff
and it's telling us along the way oh by
the way that broke that's broken so this
these are things that are potentially
impacting to our investigation right so
um which I think is really important
because I think a lot of tools they
don't really tell you that it's just if
it's broken it just pulls the data back
and goes here's the data and you don't
know that something's broke it and so
that's one of the things I really like
about this is that that ability to see
that so it's now gone out to all the
apis asked it 42 questions about that um
and now it's going to start presenting
it's pulling all that data out and it's
going to start compressing it down
together to make it a little bit more
meaningful for humans here all right
so um let's give this one more second to
to finish here um realize that we're
we're while we're building out the top
we're also building a timeline here and
the timeline is the reason a timeline is
important is because we always want to
find patient zero patient zero is one of
the core elements that we need to
understand an investigation to actually
be fruitful and so we can see pretty
clearly right here that at least now
unless this is done building it's still
building um but right now we can see
that patient zero came in on that
particular day right um and when we
click on it once we get this built we'll
be able to click on it and see the whole
thing about it so um the other thing too
is that we also get all the target
information so this is anything that
marries up in our
environment um so this for example is a
a DNS tag um an open DNS tag so we're
pulling an open DNS and we're we see
actually saw some DNS activity come from
our Open DNS uh St does anyone use Open
DNS in the past in the future planning
on it okay all right uh so um open DNS
is is run by Cisco and uh the commercial
product for open DNS is umbrella and so
we're actually pulling in the umbrella
DNS information into this workflow to
see um that stuff here so it's it's now
built out a map I'm going to make this
bigger so it's not just a so much of an
ey ey
sort and what we end up with st is stuff
that is married and stuff that's not
married so um we show you stuff that
doesn't marry because you might want to
add some of this additional information
to your investigation so just because it
didn't hit on exactly what we provided
we may want to Pivot and add you know
some MD FS or something like that to
this investigation that we found it was
interesting and the way we would do that
is we just click on this and then we
click on this and then we can add it to
our investigation
um and uh realize that if if this is
even too complicated I can even begin to
create Target filters where these are
the indirect flows for this
environment um and so you see it took
away the ones that weren't connected but
we can also do uh direct connects and so
now we're looking at specifically the
things that talk to the other things in
the environment very clear picture uh of
what happened but to me if I'm I'm doing
an investigation I I kind of want it
all right that's just kind of the way I
want I I want the whole kitten kabo I
want to be able to see everything so
here we can see there's this device
Granite um which the purple things are
the things in our environment um green
things are good things red things are
bad things and gray things are I don't
know what they are things um so just
realize that um the blue stuff is is our
stuff so we can see Granite with
targeted by this domain this when when
they went to resolve it they went to go
resolve some stuff from this interaction
and now we have the malicious domain as
well as the IP address that was resolved
to any Shaws that were pulled in related
to this the disposition of them and then
if we wanted to we could even send these
off to Dynamic analysis uh with a click
of a button here and send us off to our
uh our uh investigation side so um the
the last piece I want to show you here
is I I don't know does does anyone have
service
now yeah okay so everyone that has a
ticketing system um if if you have a
ticketing system you love submitting
tickets I mean like you probably just
set submit them for fun you know those
kind of things
um if if you're the other type of person
like the rare person that doesn't like
doing that um we can also do things like
create tickets and service now for you
so well this is not a good example let's
try uh we'll say we'll say we'll send
home um let's say we wanted to add this
to a no r on the firewall and realize
this is a lab that's why you're seeing
home might be here because we didn't
want to go into a bad domain um we go
down to our orchestrations and we have a
canned orchestration that will just add
it to a it submits the service now
request to add it to a no rout on the
firewall so we come service now we go to
favorites
[Music]
changes hopefully that clicked yep okay
so now we can see we have a service now
ticket build out uh has any part in
inform information that you want to put
in here this is all editable in the in
the orchestrator um if you have
description but you can see we put the
justification in the implementation plan
risk the whole n automated uh from that
tool because not everything is going to
be a right click and go do things right
we realize that we live in the real
world here and you know it's not right
click to remediate the whole world right
but if you can if you want you can do
that though so you could if you wanted
to so for example one of these this
sends it over to our moroi devices um we
could actually just submit a firewall
request to or submit a request of moroi
to just block this IP address right from
here where this comes in handy is is um
if you've got uh if you've got teams
that you don't have to work with to get
some of this stuff done and there's
sometime an impediment to that um but
they'll let you like add a single
firewall rule the single IP address you
can do that
here right so and it's just click it's
show you what's happening and then let
you
decide what you want to do and that's
kind of the power of this tool is that
that ability to to see everything and
then instantly we're going into
remediation and currently this is an
entitled product if you have uh any
Cisco security product uh you are
entitled to to have this right now so if
you if you have a Cisco security product
uh and you're not using this I would
recommend you actually take a look at it
uh because you have
it um I I do want to show you one one
other thing so a lot of times in
investigations we get uh we get bad uh
uh we get bad Intel from a source or
something that comes into these things
um something else you do is if you had
get bad Intel from a source you just go
to one of the modules and say don't show
me that one right I mean it's kind of
like you would think that would be an
every tool but it's sometimes just like
oh we're going to give you the
everything that ever happened and that's
not really helpful uh as well as like in
this instance we have a lot related
elements but if we wanted to go in and
add a related element we could do that
uh or if we wanted to bring uh bring
Focus to it by removing some of the
objects that are in here maybe we want
to remove the clean ones or something
like that to give us a little bit more
Focus so you can completely control your
view it's all Dynamic and starts
building all this stuff up um and then
I'll show you the last thing which is um
we start looking at the individual
elements here we get all the information
that we want to have on it any
information around you know what kind of
attacks we've seen related to this as
well as any verdicts that have been
associated with it whether they be
coming in this instance from umbrella or
whether they be coming from a TS or some
other source we get all that information
and then I said that was the last thing
I I'll show you one more thing and that
is this that uh when we look at this uh
the the timeline here for sightings we
get the stuff that's relative to your
environment but you also
get the global
perspective of it as well and why that
why that's important obviously is is
this targeted
is this a spike that just came in across
the world it gives us more information
more context uh about this particular
instance that we're dealing
with so I will leave it there do you
guys have any
questions if you don't have at least one
question I'm going to
cry on
stage okay go ahead so it's a guy last
night who had a really shazzy bow tie
why are you not wearing a bow tie uh
this so this that's a good question so
this is what we call the TSA
tuxedo so this is TSA
dress TSA here too this is tuxedo so you
can't see the tie it's there but it's
virtual it's both a bow tie and a
regular tie too and it has all the
different knots so
virtual the integration so
um what are what um Solutions you um
what EDR Solutions so um currently we
support obviously ours and a couple
other ones but there's there's a lot of
big changes coming so I don't want to go
too far down the road of exactly what we
support right now because it's about to
change but we do have from from an EDR
perspective we do have a few of the
other ones right now it's not as strong
as we really want it to be um
so yeah I mean we think that there's
there's more room to grow there that's
coming very soon what about NE I'm sorry
to collect NE I'm sorry still in here NE
logs um to connect to collect it logs
yes yeah so we don't do logs so we will
pull from like graph or Splunk or
whatever um and that just becomes API
source for us because we're we're not in
that we're not in the like collecting
data we're actually pulling in the
Telemetry from all those different
places and then giving you context for
it um if you if you've ever dealt with
some of the the Sim products or seene
products depending your perspective how
to say that
um what you end up with a lot of times
is they're very good at um displaying
data once you know what you're looking
for but sometimes finding like I I
always say it's like you got a room full
of hey you got find you know the one
needle but once you know where the the
needle type you're looking for you can
find it quickly that's their power um is
that that they can once you know what
you're looking for they can pull data
for you so we're just kind of like
pulling all that together by saying okay
you guys do the S stuff right you do
that stuff for same stuff and then we'll
pull in that data into this tool and
then I'll say one last thing uh about
that as well which is um we did a whole
big
effort uh at my previous employer to try
and build everything into
Splunk um and uh Splunk is a fantastic
tool I'm not getting I I I love spun so
say that front I love spun um the
challenge is that when you start trying
to do these like complex visualizations
like I just showed you uh they're really
difficult if not you got to get double
charge or something for them right um so
uh having said all that what I think the
better thing to do is use your Sims and
your seams to pull data in pull alerting
in and then start pivoting out of those
into the tools that just do it
better you know what I mean instead of
trying to build everything in there
pivot to your firewall vendor your EDR
vendor or
whatever cool we got to wrap it up
actually okay all right thank you
[Applause]
everybody
[Music]