Splunk for SecuritySplunk Enterprise Security 6.0 Enterprise Security Key Enhancements User Behavior Analytics Phantom 조사활동에대한보고서 기능추가 SOC의요구사항에따른

© 2 0 1 9 S P L U N K I N C .

Splunk for Security

박순섭 / 최대수매니저December 11, 2019

During the course of this presentation, we may make forward‐looking statements regarding

future events or plans of the company. We caution you that such statements reflect our

current expectations and estimates based on factors currently known to us and that actual

events or results may differ materially. The forward-looking statements made in the this

presentation are being made as of the time and date of its live presentation. If reviewed after

its live presentation, it may not contain current or accurate information. We do not assume

any obligation to update any forward‐looking statements made herein.

In addition, any information about our roadmap outlines our general product direction and is

subject to change at any time without notice. It is for informational purposes only, and shall

not be incorporated into any contract or other commitment. Splunk undertakes no obligation

either to develop the features or functionalities described or to include any such feature or

functionality in a future release.

Splunk, Splunk>, Turn Data Into Doing, The Engine for Machine Data, Splunk Cloud, Splunk

Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States

and other countries. All other brand names, product names, or trademarks belong to their

respective owners. © 2019 Splunk Inc. All rights reserved.

Forward-LookingStatements

© 2 0 1 9 S P L U N K I N C .

What’s New in .conf2019 2019년스플렁크의새로운기술포트폴리오

Platform

Splunk Enterprise

Connected Experiences

Splunk Machine Learning Toolkit

Splunk Cloud FedRAMP

Data Fabric Search

Data Stream Processor

IT Operations

Splunk IT Service Intelligence

Splunk App for Infrastructure

Splunk Business Flow

VictorOps

SignalFX

DevOps

SignalFX

Splunk Investigate

VictorOps

Splunk Developer Cloud

Security

Splunk Enterprise Security

Splunk User Behavior Analytics

Splunk Phantom

Splunk Mission Control

Splunk Security Operations Suite

Enterprise Security

Innovations

User Behavior Analytics

Phantom

Market Trends

Automation Accelerates

Adoption and Results

Digital Supply

Chain Demands

Continuous Risk

Monitoring

ML-AI Usage By Defender and Attacker

Cloud Brings New

Security Paradigm

and Incident

Response

Security Strategy

Reliant on Data

Strategy

Market Trend

Cloud Security Endpoints

OrchestrationWAF & App Security

Threat Intelligence

Network

Web Proxy Firewall

Identity and Access

Splunk as the Security Nerve CenterOptimize People, Process and Technology

Operations

Analytics

Data Platform

Power a collaborative SOC

Address a specific problem

Solve problems across multiple domains

Nerve center for security

Establish your security operations

Journey to the Nerve CenterMaking the Vision Real for Security Operations

User Behavior Analytics Content Updates (UBACU)

Enterprise Security Content Updates

(ESCU)

User Behavior Analytics SDK

Investigation Workbench

Security Orchestration, Automation and Response

Phantom

Splunk for Security


ANNOUNCING

Mission Control Beta


• Cloud-native SaaS

• Common SOC work surface

• Data, Analytics, and Automation

Benefits of Splunk Mission Control

Recover Time Spent Improve Response Optimize SOC

- 통합된자동화

- 컴퓨팅속도로플레이

북실행

- 보안대응계획모델링

- 대규모보안운영감사

- 하나의작업영역에서

위협탐지및조사

CUSTOMER DELIVERY

Other Data Lakes

CLOUDON-PREM HYBRID WITH BROKERS

Platform for Machine DataPLATFORM

APPLICATIONS Future Splunk Solutions 3rd Party Plug-ins+

SOLUTIONSMission Control

Cloud-Based Unified Security Operations

Security Operations Suite Architecture

Firewall

IDS / IPS

Endpoint Management

WAF

Advanced Malware

Forensics

Malware Detonation

ANNOUNCING

Enterprise Security 6.0

I N G E S TD E T E C T

P R E D I C T A U T O M AT E

O R C H E S T R AT ER E C O M M E N D

C O L L A B O R AT E I N V E S T I G AT E

M A N A G E C A S E S

R E P O R T

Artificial Intelligence

Content

Machine Learning

SplunkEnterpriseSecurity

INGEST DETECT COLLABORATEINVESTIGATE REPORT

• Detect advanced threats

• Enrich with Analytics

• Analyze & investigate threats

• Enterprise-wide coordination & response

Splunk Enterprise Security기본 탑재된 검색, 경고, 리포트, 대시보드, 인시던트 워크플로우, 위협 피드

사고 조사 및 관리경고 & 대시보드 & 리포트

통계적 이상치 & 위험 점수 & 사용자 활동 위협 인텔리전스 & 자산 & 신원정보 통합

Splunk Enterprise Security 6.0

Enterprise Security

Key Enhancements

User Behavior Analytics

Phantom

▪ 조사 활동에 대한 보고서기능 추가

▪ SOC의 요구 사항에 따른커스텀 가능 (SPL 지원)

▪ 데이터 수집 성능 증가

▪ 3x 스케일 확장으로 2백만이상의 엔트리 수용

▪ 40% 처리 속도 증가

▪ 20% CPU 리소스 절감

DemoEnterprise Security

© 2 0 1 9 S P L U N K I N C .

Splunk Phantom 4.6Security Orchestration, Automation and Response

© 2 0 1 9 S P L U N K I N C .

귀사의 SOC에서가장큰과제는무엇인가요?

가장많은시간을보내는업무는?

© 2 0 1 9 S P L U N K I N C .

보안운영문제

보안전문가의자원부족

자원 제품 경보 정적 속도 비용

단위보안제품들의

끊임없는연동

대량보안경보의

에스컬레이션

오케스트레이션없이정적이고독립적인통제

탐지, 우선순위구분및대응시간의속도가향상되어야함

비용은계속증가

© 2 0 1 9 S P L U N K I N C .

이러한문제를누가다루는가?운영

피싱 이메일조사

위협 사냥

위협인텔리전스

말웨어조사

이벤트선별

내부자 위협분석팀

Tier 1

보안 분석가

관리

팀 성과

프로세스 & 운영

메트릭 & 리포팅

SOC 팀장 CISOTier 2 위협 대응

Tier 3

위협 대응

© 2 0 1 9 S P L U N K I N C .

보안운영을위한 SOAROODA 루프를통한빠른실행으로보안향상

Decision Making Acting

SIEM

THREAT INTEL PLATFORM

HADOOP

GRC

자동 수동 (현재)

FIREWALL

IDS / IPS

ENDPOINT

WAF

ADVANCED MALWARE

FORENSICS

MALWARE DETONATION

FIREWALL

IDS / IPS

ENDPOINT

WAF

ADVANCED MALWARE

FORENSICS

MALWARE DETONATION

TIER 1

TIER 2

TIER 3

ObservePoint Products

OrientAnalytics

© 2 0 1 9 S P L U N K I N C .

보안운영을위한 SOAROODA 루프를통한빠른실행으로보안향상

Decision Making Acting

SIEM

THREAT INTEL PLATFORM

HADOOP

GRC

자동

FIREWALL

IDS / IPS

ENDPOINT

WAF

ADVANCED MALWARE

FORENSICS

MALWARE DETONATION

FIREWALL

IDS / IPS

ENDPOINT

WAF

ADVANCED MALWARE

FORENSICS

MALWARE DETONATION

TIER 1

TIER 2

TIER 3

ObservePoint Products

OrientAnalytics

ACTION RESULTS /

FEEDBACK LOOP

AUTOMATED WITH PHANTOM

SplunkPhantom 4.6

1) Phantom 모바일

2) AWS에환경에유연하게구성

3) SHC 검색지원

4) ITSI 모니터링

자동화 오케스트레이션(조정, 편성)

권장(추천)

협업(공동작업)

케이스 관리

가장 큰 S O C확장되는

에코시스템이벤트처리

Splunk Phantom 4.6

AWS Athena AWS CloudTrail AWS IAM AWS Lambda AWS Security Hub

NetBIOS

ATP

Management Center

Windows Remote Management Windows ATP

Phantom 앱오픈소스

© 2 0 1 9 S P L U N K I N C .

새로운기능 : 모바일장치의 Splunk Phantom

• Phantom on Splunk Mobile 은 Phantom 보안 오케스트레이션, 자동화 및응답(SOAR) 기능을모바일에서 제공

• 노트북을열 필요가없습니다. 손안에서보안 작업을조정하십시오.

• 어느곳에서나 연락할 수있으므로그어느 때보다빠르게 응답합니다.

• 어디에서나플레이 북을실행하고, 이벤트를선별하고, 동료와 공동작업을수행하십시오.

언제어디서나더스마트하게작업하고더빠르게대응하며방어를강화

© 2 0 1 9 S P L U N K I N C .

Splunk Mobile App for Splunk Phantom(1/3)

설정방법

© 2 0 1 9 S P L U N K I N C .


설정방법

© 2 0 1 9 S P L U N K I N C .

Splunk Mobile App for Splunk Phantom

Splunk Cloud Gateway는모바일장치가 Splunk Enterprise 인스턴스에연결하기위한클라우드기반브리지입니다.

© 2 0 1 9 S P L U N K I N C .

향상된 Splunk Enterprise Search

Splunk Phantom은외부 Splunk Enterprise 인스턴스와 SHC 등분산환경을지원합니다.

Configure search in

Main Menu > Administration >

Administration Settings >

Search Settings.

© 2 0 1 9 S P L U N K I N C .

SplunkSANDBOX QUERY RECIPIENTS

USER PROFILE

HUNT FILE

HUNT FILE

FILE REPUTATION

FILE ASSESSMENTRUN PLAYBOOK

“REMEDIATE"

EMAIL ALERT

자동화된말웨어조사분석

“말웨어 이메일 경보를 팬텀으로자동화하여 기존에 30분이상

소요되던 작업을 40초로단축하였다.”

아담 플래처CISO

어떻게 동작하는가?고객 팬텀 활용사례 : Blackstone

© 2 0 1 9 S P L U N K I N C .

왜 Splunk UBA인가?

Splunk UBA 프로세스

비정상적인 머신 접근

머신이 생성하는 신호

비정상적인 네트워크활동

정보 탈취 우려 사용자

의심스러운 데이터이동

Anomalies (낮은 정확도)

위협 내부망 이동확산

수상한 행위

탈취 계정

말웨어 활동

데이터 유출

Threats (높은 정확도)

데이터

머신 러닝(Logistic Regression,

Random Forest, etc.)

1 단계

머신 러닝(Graph Mining, Time Series

Behavioral profiling)

2 단계

비정상적인 네트워크활동

정보 탈취 우려 사용자

의심스러운 데이터이동

데이터 유출

© 2 0 1 9 S P L U N K I N C .

무엇이필요한가?

데이터플랫폼 데이터소스 사양

Web Proxy

Firewall

Active Directory

DNS, DHCP

DLP

Endpoint

VPN

CPU: 16 Cores

Memory: 64GB

Disk: 1200 IOPS

최소 옵션 최소

© 2 0 1 9 S P L U N K I N C .

클라우드 파일 공유(Onedrive, Sharepoint, Box)

데이터베이스, 물리적인 배지 접근, 프린터

데이터 카테고리 범위H A / D R 웜스탠바이

Splunk User Behavior Analytics 5.0

© 2 0 1 9 S P L U N K I N C .

Splunk 보안포트폴리오Splunk + Phantom은최신 SOC 구현을위한, 세계최고의데이터, 분석및운영플랫폼제공

데이터 분석 운영

Machine Learning Toolkit

(MLTK)

ES CONTENT

UPDATE

ADAPTIVE RESPONSE

© 2 0 1 9 S P L U N K I N C .

협력적인SOC로 강화

자동화 와오케스트레이션

상호 연결된 보안 스택

인간의 기술을 향상 시키는기계 학습

ADAPTIVE RESPONSE

협력적인 SOC

여러 도메인을 거쳐 해결함

보안 운영 수립

특정 문제

보안에 대한 중추신경센터

Documents

Splunk for SecuritySplunk Enterprise Security 6.0 Enterprise Security Key Enhancements User Behavior Analytics Phantom 조사활동에대한보고서 기능추가 SOC의요구사항에따른