[Music]
uh good afternoon happy Friday everyone
my name is mat Rini I'm a security
specialist at
elastic and we're here to talk about
elastic security uh elastic security
solution how many of you are familiar
with elastic or the elk stack or elastic
search so a few of you so elastic is the
company behind a very popular search
technology called elastic search that
powers uh many of your search
experiences every day whether you know
it or not every time you get a ride
using Uber the match between the driver
and the passenger using GE spatial
search is done by elastic search when
you search on Yelp for restaurants or
you look at
Wikipedia or Ebay that's all powered by
elastic search so that's how elastic
search started it started as an
application search technology that was
released to the community as an open
source product and the community started
using elastic search for different use
cases starting with ingesting logs for
observability and that has quickly
evolved to metrics and
security uh I joined elastic a little
bit over 5 years ago and at the time we
didn't have a security solution so
nothing out of the box designed for
security yet I found out when I joined
that our largest customers at the time
were using elastic for security so what
elastic has decided to do in the last
few years is to make it easier for our
users to use elastic for security by
providing content like detection Rules
by creating workflows for the analysts
and I'll share with you the context of
what I'm talking about in a
minute so if you think about the mother
security challenges and again this is
more on on the defensive side right if
you work for an organization you're
security Professional Security analyst
your job is to protect the assets of the
organization whether you're thinking
about employees the workstations they
use the intellectual property any system
that is powering any activity that is
Mission critical or Revenue
generating must be protected any
downtime as a cost it doesn't matter if
the downtime is caused by a bug or by a
Cyber attack there is still a cost
that's how cyber security is also
involved in U in those type of U
conversations this
day so when elastic search was released
as an open source project the community
again started using elastic search for
different use cases but again it was
just a rest API scalable search
technology and if you know it
administrators and it Ops they don't
really like to write code and use the
rest API so other community members they
came about to say okay maybe I should
create a user interface that will make
it easier to search and visualize logs
and that's how kibana was born that's
the name of the user interface and
others came about to create other
components to make it easy to ingest
easier to ingest data into a elastic
search and uh this is how elastic has
been looking for a while so you have the
capability to ingest and store any type
of data at the core in elastic search is
a j Json documents that are stored
they're analyzed at in
justest with the goal of making any
subsequent search fast and when I talk
fast I talk about millisecond
response what we have done with elastic
security is really adding on the top of
the basic functionality that you expect
from the elastic
stack fast and scalable being able to
create powerful analytics and
visualizations keeping the open aspect
all the source code of elastics is still
open even our detections and protections
are open and uh and the support adding
capabilities that you would expect for a
security use case and the core security
use case of elastic security is sem
security information event monitoring
the idea is ingesting all documents
centrally and being able to search them
so you can visualize activity that goes
on within
infrastructure since we released elastic
Sam we had additional capabilities
starting with endpoint security so now
with elastic in addition of the
capability to visualize what's going on
within your infrastructure you can also
add protection at the edge on the
endpoint with endpoint protection EP and
then point detection response
capabilities in elastic agent and more
recently we are Rel we have released
also Cloud security capabilities that
I'll talk in a
minute so this is elastic today again
capability to ingest
anything search and analyze at scale
visualize and on the top of that you
have all these security features that
are very very relevant to any use case
and
organizations if you're still students
or you just want to play with technology
we still have a free tier that applies
to all these use cases so if you have a
home lab you want to have a Sam you want
to add protection to your laptop you can
deploy elastic you don't need to
interact with us you just have to
download the the binaries and and do it
yourself so this is a structure for the
demo today I was planning to do a live
demo but then when I found that the
screen was so small I'm like you're not
going to be able to see the mouse but
I'm I'm going to try to deliver the
points that I would have made in a live
demo so these are common challenges in
the security space again think about the
context of gaining visibility what's
going on within your infrastructure your
environment within your distributed
Workforce and adding protection As You
observe the the core requirement of a
sem is to be able to capture all the
machine data that is generated by all
the different devices that you use and
for those of you that have some
experience with Sams you know that it's
typically challenging to be able to
first of all afford to ingest all the
data but also to keep up with the
constant volumes of data that go
up so the first thing we did that when
we started working on elastic security
is let's make it easier to ingest data
from the most common lock Source types
that are top of mind for Security
Professionals to gain visibility so now
we have hundreds of data Integrations
that you can simply use elastic is
designed for search so whenever you
inest any data into elastic the data is
normalized and additional metadata is
generated to make any subsequent query
fast any of these Integrations does just
that
job uh compared to other vendors in the
same space we have a very high focus on
the what I like to refer to as emerging
log Source types especially during covid
there has been Accel an acceleration of
moving to the cloud moving to SAS and
suddenly once you start using those SAS
Services you still want to gain
visibility I want to see what my
employees do when they use one password
to access one secret so one password
actually was with the the number one top
requested log Source type that we didn't
support at the time at the beginning of
covid That's right when organizations
start to say okay you have to work from
home we need to find a way to manage
Secrets but I want to see who is
accessing
W once you have all the data stored
inside elastic
search you still would like to keep it
for as long as possible Right whenever
you you as a security analyst you have
an any indication of
compromise you start a process called
security investigation where you try to
find the initial vulnerability or what
happened that allowed an actor to gain
access because you want to patch that
hole so you you have a need to be able
to go back in time and figured out what
happened and figured out what other
systems got
compromised and one of the ways to do
that is to keep data searchable for
extended period of times and many
organizations actually most
organizations commercially andn they
also have compliance requirements that
require them to keep data around for
like one year or more and uh that is
typically very expensive what different
vendors and Technology vendors have done
is to introduce the concept of data
tearing so you use different type of
compute and hardware at different stages
of the data life cycle so at elastic we
have done something similar but uh a new
feature that has been a game Cher for
security is the introduc introduction of
a feature called searchable snapshots so
the idea is that as data ages
move it off your deployment store it in
S3 or in an object store and still you
want to still be able to search it
without having to rehydrate it or
restore the data into the deployment
first and that's exactly what searchable
snapshot allows you to do and the
performance I'm talking about is minutes
I'm not talking about wait 24 hours
before you have access to the data or
wait several hours before you get search
results so all of this is automated by
elas
depending on the typee of data that you
ingest you can choose how you want to
manage it I want to keep it a couple of
days searchable in the cluster then move
it to to Frozen maybe I want to delete
it all of that can be
automated so this is the first challenge
that we covered right so elastic and
allows you to easily capture data from
with many out of the box data
Integrations and also manage life cycles
to gain to keep control over also your
your cost that you pay because your
deployment size can stay the same you
can ingest more data just move data to
Frozen
faster the Second Challenge in uh you
can only have so many eyes on a
dashboard right you want to leverage
automation as much as
possible if your students are looking to
get start a career in cyber security
that's a very smart choice because there
is very there's very high need for
Professionals in this space uh that's
said you want to leverage automation as
much as possible when we talk about
security and Automation in the context
of security information event management
there are different types of automations
that are used the first type of
automation is called detection rules
this is looking for common techniques
that we know adversaries use when they
do attacks and miter as being
instrumental in developing what
what they called miter attack they
basically cataloged all the techniques
that adversaries commonly use and many s
vendors including elastic now when they
release their content they map their
detection rules to MIT attack
ttps so when you just get this content
out to the Box you enable these
detection rules and whenever any of
these activities is seen within your
environment you get an alert it doesn't
necessarily mean that something bad is
going on
but it's certainly an indicator that you
should look into it and that's really
the job of tier one security analysts
they look at this detection alerts they
make a determination is this a true
positive a false positive should be wor
should should we be worried about this
or was this just an administrator doing
something as part of their
job so this is all very helpful but it's
not
everything the majority of the customers
I work with when they're asked what are
the use cases that are top of mind what
are you concerned the most about they
tell me compromised accounts malicious
insiders and the way to detect
compromised accounts again this is a a
from from the logs it's a authenticated
user with the right of
access but someone is impersonating that
user how can you figure out if there is
the right person that is attached that
should use that account behind the
keyboard or if an adversary is doing
that this is where machine
learning and the user entity Behavior
analytics comes into
play any data that you store inside
elastic search can be used to train
machine learning job models so the idea
is that you use the machine to observe
what's
normal for a user for an entity like a
machine
build a model so there is a lot of
mathematical complexity behind it right
but we hide all of that and let you know
whenever there is a deviation from What
was seen as
normal if Matel working accounting I
work 8 to5 every day from the
Minneapolis office suddenly I log in
from Russia at 3:00 a.m. in the middle
of the night and they try to access a
Google drive folder that I never
accessed before maybe it's not mat
behind the keyboard right but try to
keep track of that when you have
thousands and thousands of employees
that you don't know directly right
machine learning is really helpful for
this all the alerts uh in elastic
whether they're generated through
traditional detection alerts whether
there is some malware detected on an
endpoint whether it's an anomaly
detected by Machine learning they are
display to the analyst using the same
alerts view so this is basically the
to-do list for the tier one analyst when
they show up at work in the morning say
okay these are the alerts that triggered
I need to start investigating them but
what should I look at first so one of
the key aspects is being able to
prioritize these alerts in a way that
makes sense to minimize the risk for
your organization so what what we have
added to elastic security is a entity
analytics what this means is that we
start looking at users and hosts and
attach a risk score to them based on the
activity we see happening if a user mat
has many detection alerts like maybe
some malware detections some unusual
behavior all of a sudden attached to my
account then there should be a very high
risk tied to me likely my account was
compromised so any detection alert that
includes my username should have a
higher risk score or maybe you have some
critical assets where you store your
secrets your intellectual property the
secret Coca-Cola
recipe you want to keep an eye on those
so whenever there is any alert that
includes that specific machines you want
to Bubble Up and increase the the
priority based on
risk all of this can also be used to in
entity analytics dashboard to kind of
show you what's what are the top uh top
risky users or or
assets right this is part of the autom
let the machine do the work again a lot
of content that you get out of the box
all the detection rules that we have
many of those most of those are mapped
to this miter attack ttps again
techniques that adversaries commonly
use streamline detection or
response so we put a lot of thought into
the the work of an analyst which by the
way can be quite tedious right the
analyst is the one that is looking at
those alerts and is doing investigations
every
day and it's really there is a lot of
turnover in that role right it's not
really necessarily an easy job to do
especially because you never in in many
occasions you feel like you're never
winning right you're always trying to
play
catchup and uh a lot of the new analysts
that companies hire they're coming out
of boot camps or cyber security classes
because it's really hard to
hire uh professional that have
experience in that field because there
is a lot of demand again there is more
demand and availability of
resources so what we have been doing at
the lastic is Right trying to think
about investigation workflows that are
intuitive for the analyst where you
don't have to learn a complex data
processing language to do a query you
can just do drag and drop to build your
investigation we use a graphical
representation of the action described
by log messages so you don't have to
open up a log message and look at all
the different fields to understand what
is this telling me we make it very very
simple again probably you're not able to
see the details but this is a brand new
interface for those of you that know ALK
a little bit that really replaces the
need for to use this discover and it's
specifically designed for the analyst as
an analyst as you use timeline to go
through all your loog sources and the
time Dimension searching through data
you can ping interesting events that
that are tied to a possible incident you
you can create a case we have case
management and all of that is part of
the product as
well so we just saw the uh how fast
intuitive workflows for security analy
that thanks to timeline that we added to
to elastic
security so the last true bullets here
uh stop attacks at the source so still
today the majority of the attacks starts
at the edge what do I mean the end point
points that your employees are using the
servers that you're using to power your
Fleet powering your
applications and that what has made
really
popular the the vendors that do endpoint
security EDR endpoint protection it's
not just malare but it's also gaining
visibility on the endpoint to see what
happens on the end point if you look at
mitro attack and if you look at those
ttps those techniques that adversaries
commonly use if you look at the the type
of logs and visibility that you need to
have in order to see those you need to
be able to see what processes are being
run what files are being created what
registry key are being changed in the
registry and that type of
telemetry are not logs that are natively
generated by an operating system so if
you look at Windows event logs on
Windows you don't see when a new a file
is changed you don't see when a
registry is changed unless you add sism
or there other ways to do it but
natively you don't see that so what we
have done at the last thing in a in a
true xdr fashion this new acronym that
basically describes endpoint security
and Sam
together we added endpoint security
capabilities to the same agent that
elastic uses to observe to ingest locks
you can enable an integration called
elastic defend that will turn that same
agent running on an endpoint and by
endpoint I mean Windows Linux or
Mac and that agent will add malware
protection ransomware protection it will
block memory threats and at the same
time while you're are you are on the
Endo you can gain visibility from the
kernel and you can configure that same
agent to stream to act as a sensor tap
into the kernel every time there is a
change to a file or a process generate a
log message and send it back to elastic
so you can visualize
that and all again going back to the
alerts View for the analyst whether
you're looking at a miter attack
detection or a machine learning anomaly
or something that happens at the end
point it's all displayed in the same
view so same platform the analyst
doesn't have to learn multiple systems
to do their
job for those of you that are into
malare and I think think many of the
tenis Year may like to go deep with the
malware and learning how malware
Works uh we created a one of my my my
team members created a website uh called
om my M where we publish a series of
episodes and each of them is related to
a different type of malare you can have
access to elastic you can see what the
malware did learn about the malware so
om mare.com
for
that all right so we saw our elastic
provides full xdr capability in one
Platform One agent for both to both
observe and protect all your end points
uh we also have as part of HDR response
capabilities on the endpoint as an
analyst when you detect that an endpoint
is compromised you can isolate the end
point meaning that there is no lateral
movement you can retrieve files and and
you you cannot do other actions on end
point so 3 minutes left for the last
bullet takes security to new
heights pretty much any organization I
work with they're moving work close to
the
cloud and that has
become of attention also for the bad
guys right so it's like it's very easy
to stand up workloads on the cloud
Gartner predicts that by 2025 95% of the
new workloads will be Cloud
native and guess what through 2025 also
pretty much every single crowd bridge is
not going to be caused by malare but by
misconfigurations right cloud is new to
many even if you think you're an expert
in AWS maybe your employer will tell you
oh now we want to implement a multicloud
strategy I want you to start using Asia
and guess what why they may look similar
when you start looking at the security
policy and all of that that there
changes that you have to learn that's
part of it so we are we started adding
Cloud security
capabilities starting with the cloud
security posture management
cspm uh that also includes support for
kubernetes so the idea here is to use
CIS benchmarks think of them as best
practices for hardening the
configurations of system whether you're
looking at the kubernetes cluster or
Cloud native
and you configure elastic in this case
to keep checking on the configurations
of your system and it will let you know
if you have any opportunities to improve
the posture it will also tell you what
you have to change in the configuration
to do that the other aspect of these is
uh gaining visibility within containers
uh kubernetes and containers are
becoming really popular as a way to
deploy production workloads and one of
the reasons for that guest attention all
guest for the Midwest Gaming classics
will the owner of a U-Haul trailer with
an Arizona license plate a as an apple e
as an echo
3119 again U-Haul Arizona plates AE
3119 please come out to the dock and
move your vehicle immediately you're
blocking
traffic I guess that's the only way to
find
someone and uh so the I was saying
kubernetes is becoming really popular
because if you start designing
applications to run on kubernetes
kubernetes make make it makes it really
easy to move them from on Prem to a
cloud provider and from a cloud provider
to another one of the challenges with
kubernetes is to gain visibility what's
going with what's going on within a
container and also how can you add the
same level of protection that you can
have on an endpoint with DDR Within in a
container so using a technology called
ebpf that many of you probably have
heard of elastic allows to tap into the
kernel you can deploy elastic agent in
um within kubernetes we don't have to
instrument your
applications and uh and gain visibility
within the container
itself the visibility can look like this
you can see as if you're standing behind
a keyboard of someone typing a command
and seeing the output you can get all
this Telemetry we call it console View
and we also added the an initial release
with drift protection that will allow
you to see if a container starts acting
differently than what was seen in the
past so more to Common these and uh and
again one plat and our vision in general
with elastic Security is to provide the
S visib level of visibility and
protection across the entire attack
surface from traditional endo Point
Windows Linux or Mac Cloud native and
kubernetes so this is what we cover
today was this
helpful you have any questions about
elastic in general
yeah no you cannot so uh there there are
two components in elastic one is the
platform right that you have uh it's
usually a cluster of nodes
it it's based on Java Lucin the Lucin
open source library and then you have
elastic agent elastic agent can be
deployed on Windows Linux or Mac or can
can be deployed in um uh within
kubernetes but you cannot install an
agent inside a device like an appliance
in the case of routers firewalls Network
appliances usually you use sis log over
the network as a way to get logs out of
the devices and you will configure
elastic agent somewhere to listen on a
specific port for those
messages okay we're out of time thank
you everyone for joining and for
sticking around on a Friday
[Applause]
afternoon