More on SILAS: Security Intelligence-as-a-Service

In a previous blog post of mine I introduced our HPL/HP work on the Security Intelligence-as-a-Service (SILAS) solution and the fact we achieved an important milestone, in collaboration with HP business groups: a full working implementation is available.


Thanks for your questions. I am providing some additional details. The SILAS solution can now be showcases to HP customers and (potential) business partners.

As previously mentioned, SILAS consists, at the very base, of an Analytics Technology that provides: statistical analysis of data; predictions based on simulations.

There is currently a major gap in organizations’ security lifecycle management processes. On the one hand, organizations carry out strategic, long-term risk assessment activities - at the business level - to identify threats and mitigate them with suitable policies and controls. This involves periodic re-assessment of their security investments. On the other hand, they heavily invest in monitoring and Security Information and Event Management solutions (SIEM - e.g. HP ArcSight) to collect information from their IT infrastructure, for compliance and governance purposes. However information gathered at this level is seldom leveraged for higher-level strategic security risk assessment, except by means of expensive and manual processes. It is primarily used at the IT Operational levels. There is increasing demand for better integration and simplification of these processes in order to maximize investments and improve the overall risk assessment.

This gap is even more evident in the context of managed services and/or disaggregated IT in the Cloud, where the organisation further loses control on their IT along with related information flows. SILAS aims at addressing this gap.

A typical scenario (where SILAS can be deployed to add value) consists of a multitenant Security Operation Center (SOC), as shown in the following picture:

In this scenario the SOC manages incidents and IT operation issues for multiple customers. SILAS calculates and provides a wide variety of strategic metrics:

• customer metrics, reflecting the effectiveness of their processes (e.g. vulnerability and threat management - VTM, identity and access management - IAM, etc.), based on the data they shared with the SOC; metrics related to external threat environments (e.g. derived from information collected from HP ArchSight, HP TippingPoint, DV Labs, OSVDB, etc.);

• metrics providing an assessment of SOC processes, e.g. how effectively they identify incidents, close alerts, deal with false positives;

• what-if analysis and predictive metrics.

SILAS is meant to:

• provide estimation of strategic (security, risk and business) metrics to decision makers and customers, in multi-tenancy, multi-customer contexts, such as Security Operation Centers and Cloud Operation Centers

• use these metrics to enable predictive and what-if analysis, by leveraging the HP/HPL Security Analytics Solution (based on modelling and simulation techniques)

• provide customers with strategic reports - based on processed metrics and prediction - to illustrate historical trends and benchmarks

• leverage Cloud infrastructure for data processing and metric estimations

The following picture illustrates the SILAS core capabilities and high-level architecture:

SILAS is not meant to be a reactive, real-time analytic solution. It leverages existing solutions such as HP ArchSight, HP TippingPoint/ThreatLinq, OSVDB, etc. to gather the relevant data. As unique differentiation, it provides longer-term estimates of critical metrics and uses them to make predictions. It provides decision support capabilities to key stakeholders (risk management teams, customers, etc). As such it nicely complements current HP SW offerings.

We are currently trialling this solution in collaboration with HP business groups.

A few screenshots of a public version of SILAS (we use for demonstration purposes) follow:

Figure 1: SILAS main dashboard. Links to various metric processing, prediction and reporting capabilities

Figure 2: SILAS metric estimation. Example of estimation of "patch take-up curve" metric estimation (i.e. how quickly an organisation patches its systems against a vulnerability), over a period of time, calculated on data collected from HP ArcSight

Figure 3: SILAS predictions and "what-if" analysis. Example of prediction to vulnerability "risk exposure", calculated with HP/HPL Security Analytics models and related simulations. Models are instantiated with previously calculated SILAS metrics, e.g. the "patch take-up curve" metric.

Figure 4: SILAS Report. Example of customer report illustrating, for a given time period, the "patch take-up curve" metric and compareing it against an anonymised version of the same metrics (in the same time period)/benchmark,  calculated by using information collected from other customers (in a multi-tenant SOC).

Figure 5: SILAS Report. Another example of customer report showing the outcomes of various "what-if" analysis, calculated with HP/HPL Security Analytics models and related simulations. Models are are instantiated with both previously calculated SILAS metrics, e.g. the "patch take-up curve" metric and the various "what-if" assumption to be explored (e.g. using specific IT security controls).

Figure 6: SILAS Report. Another example of customer report showing the historical trends of some relevant SOC process metrics indicating how effectively a SOC handles customer's incidents (e.g. in terms of time to close an alert, identify false positives or identify an incident). The report shows historical trends and anonymised benchmarks against similar, aggregated metrics, obtained from other customers.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

HPL Security Intelligence-as-a-Service (SILAS)

As discussed in previous posts, our HPL Security Intelligence-as-a-Service (SILAS) solution consists, at the very base, of R&D Analytics Technology that provides: statistical analysis of data; predictions based on simulations.
We now have achieved an important milestone in collaboration with HP business groups: a full working implementation is available.

Additional details and a few screenshots of the public, R&D version of SILAS are available online. Below I attach a screenshot of the SILAS main dashboard.

A typical scenario (where SILAS can be deployed and add value) consists of a multitenant Security Operation Center (SOC),

In this scenario the SOC manages incidents and IT operation issues for multiple customers. SILAS calculates and provides a wide variety of strategic metrics: customer metrics, reflecting the effectiveness of their processes (e.g. vulnerability and threat management - VTM, identity and access management - IAM, etc.), based on the data they shared with the SOC; metrics related to external threat environments (e.g. derived from information collected from HP ArchSight, HP TippingPoint, DV Labs, OSVDB, etc.); metrics providing an assessment of SOC processes, e.g. how effectively they identify incidents, close alerts, deal with false positives; what-if analysis and predictive metrics. All these metrics can be conveyed to customers (and/or other stakeholders) via reports, by highlighting trend analysis and benchmarks.

SILAS is meant to:

• provide estimation of strategic (security, risk and business) metrics to decision makers and customers, in multi-tenancy, multi-customer contexts, such as Security Operation Centers and Cloud Operation Centers

• use these metrics to enable predictive and what-if analysis, by leveraging the HP/HPL Security Analytics Solution (based on modelling and simulation techniques)

• provide customers with strategic reports - based on processed metrics and prediction - to illustrate historical trends and benchmarks

• leverage Cloud infrastructure for data processing and metric estimations

SILAS is not meant to be a reactive, real-time analytic solution. It leverages existing solutions such as HP ArchSight, HP TippingPoint/ThreatLinq, OSVDB, etc. to gather the relevant data. As unique differentiation, it provides longer-term estimates of critical metrics and uses them to make predictions. It provides decision support capabilities to key stakeholders (risk management teams, customers, etc.). As such it nicely complement current HP SW offerings.

We are currently trialling this solution in collaboration with HP business groups.


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

On Security Analytics – Risk Analysis for Incident Management Processes

Thanks to all the people that contacted me with interest on how HP Labs has applied HP Security Analytics techniques for Risk Analysis in the context of Incident Management Processes. I would like to remind that this HP Labs capability (along with related technologies and know-how) have now been transferred to HP Enterprise Security Services (HP ESS). Please feel free to contact HP ESS representatives if you would like to use the service.




An example of the benefits and risk assessment capabilities that can be achieved with Security Analytics (specifically in the space of Security Operation Centers and their Incident Management Processes) has been docuemented in a recent HP Labs Technical Report has been recently called “Security Analytics – Risk Analysis for an Organisation’s Incident Management Processes”:



“This document is an example of the type of report an organisation would receive at the end of a HP Security Analytics engagement. The focus is on the analysis of the security risks and performance of the organisation’s Security Incident & Events Management (SIEM) Processes and related Security Operation Centre (SOC)’s activities. HP Labs carried out the underlying R&D work in collaboration with HP Enterprise Security Services and involved analysis of processes, probabilistic modeling, simulation and “what-if” analysis for some of HP’s key customers. The outcome of this was a set of case studies from which we have been able to create this more general anonymised report illustrating the richness of the risk assessment and “what-if” analysis that has been carried out.

The lifecycle management of security is critical for organisations to protect their key assets, ensure a correct security posture and deal with emerging risks and threats. It involves various steps, usually carried out on an ongoing, regular basis, including: risk assessment; policy definition; deployment of controls within the IT infrastructure; monitoring and governance. In this context, Security Incident & Events Management play a key role. Even the best information security practices and investments in security controls cannot guarantee that intrusions – accidental and criminal activities – and/or other malicious acts will not happen. Controls can fail, be bypassed or become inadequate over time; new threats emerge. Managing such incidents requires detective and corrective controls to minimise adverse impacts, gather evidence, and learn from previous situations in order to improve over time. These incident management processes are usually run in the context of a SOC and/or as part of specialised Computer Security Incident Response Teams (CSIRTS), built on top of SOCs.

Even with SIEM in place, a potential major risk for the organisation arises due to delays introduced in assessing and handling known incidents: this may postpone the successful resolution of critical security incidents (e.g. devices exposed on the Internet, exploitation of privileged accounts, deployed malware, etc.) and allow for further exploitation. Another related risk can be introduced by sudden and/or progressive changes of the threat landscape, due to changing economic and social scenarios, new business activities or process failings within the existing IT services. This might create unexpected volumes of new events and alerts to be processed by the security team and as such, introduce additional delays. Hence, it is important for an organisation to understand the risk exposure due to their Incident Management processes, explore potential future scenarios (e.g. changes in available resources or threats landscapes or adoption of Cloud solutions) and identify suitable ways to address related issues, e.g. by introducing process changes and/or making investments in security controls.

HP Security Analytics is uniquely positioned to provide the analysis of the involved risks, explore what-if scenarios and provide decision support for decision makers. This type of Security Analytics assessments is now available as a service, provided by HP ESS.”.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

New HPL TR: Security Analytics – Risk Analysis for Incident Management Processes

A new HP Labs Technical Report has been recently released called “Security Analytics – Risk Analysis for an Organisation’s Incident Management Processes”. It is currently available online here.




The abstract of the HPL TR follows:

“This document is an example of the type of report an organisation would receive at the end of a HP Security Analytics engagement. The focus is on the analysis of the security risks and performance of the organisation’s Security Incident & Events Management (SIEM) Processes and related Security Operation Centre (SOC)’s activities. HP Labs carried out the underlying R&D work in collaboration with HP Enterprise Security Services and involved analysis of processes, probabilistic modeling, simulation and “what-if” analysis for some of HP’s key customers. The outcome of this was a set of case studies from which we have been able to create this more general anonymised report illustrating the richness of the risk assessment and “what-if” analysis that has been carried out.

The lifecycle management of security is critical for organisations to protect their key assets, ensure a correct security posture and deal with emerging risks and threats. It involves various steps, usually carried out on an ongoing, regular basis, including: risk assessment; policy definition; deployment of controls within the IT infrastructure; monitoring and governance. In this context, Security Incident & Events Management play a key role. Even the best information security practices and investments in security controls cannot guarantee that intrusions – accidental and criminal activities – and/or other malicious acts will not happen. Controls can fail, be bypassed or become inadequate over time; new threats emerge. Managing such incidents requires detective and corrective controls to minimise adverse impacts, gather evidence, and learn from previous situations in order to improve over time. These incident management processes are usually run in the context of a SOC and/or as part of specialised Computer Security Incident Response Teams (CSIRTS), built on top of SOCs.

Even with SIEM in place, a potential major risk for the organisation arises due to delays introduced in assessing and handling known incidents: this may postpone the successful resolution of critical security incidents (e.g. devices exposed on the Internet, exploitation of privileged accounts, deployed malware, etc.) and allow for further exploitation. Another related risk can be introduced by sudden and/or progressive changes of the threat landscape, due to changing economic and social scenarios, new business activities or process failings within the existing IT services. This might create unexpected volumes of new events and alerts to be processed by the security team and as such, introduce additional delays. Hence, it is important for an organisation to understand the risk exposure due to their Incident Management processes, explore potential future scenarios (e.g. changes in available resources or threats landscapes or adoption of Cloud solutions) and identify suitable ways to address related issues, e.g. by introducing process changes and/or making investments in security controls.

HP Security Analytics is uniquely positioned to provide the analysis of the involved risks, explore what-if scenarios and provide decision support for decision makers. This type of Security Analytics assessments is now available as a service, provided by HP ESS.”.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

HP SILAS: Security Intelligence-as-a-Service

We are making good progress in the development of the HP SILAS service (Security Intelligence-as-a-Service), a project in collaboration with HP Enterprise Security Services.




SILAS aims at providing key decision makers within organisations with strategic metrics, predictions and “what- if” analysis (leveraging HP Security Analytics) for risk assessment, scenario planning and decision support.



SILAS uses information provided by current SIM/SEM solutions (e.g. HP ArcSight), threat intelligence services (e.g. HP DV Labs and HP TippingPoint/TreatLinq) and other logging systems to ground the statistical estimation of risk metrics and to provide input parameters to HP Security Analytics’ predictive metrics and simulations.



We are currently considering the deployment of SILAS within Security Operation Centres (SOCs). SOC customers will receive strategic reports consisting of trend analysis and benchmarks (against other customers in a community) on key, agreed metrics.



Current risk metrics relate to organisation processes (e.g. vulnerability management processes, incident management & user account provisioning/deprovisioning), assessment of SOC incident management processes (of relevance to the customer), external threats (e.g. Zero Day Threats) and predictive metrics (related to all the above areas).



They are meant to be delivered to key decisions makers (C*O). Looking forward to get suggestions about additional metrics that might be of relevance – at that level - in the security context and beyond it.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

On Incident Management, Security Analytics and the Cloud

In previous posts of mine I discussed the fact that HP Labs have developed an approach and capabilities to assess the risks associated to organisations’ Incident Management and Remediation processes. These capabilities, centred on HP Security Analytics, enable decision makers not only to assess the performance and security risks associated to current processes but also to explore potential what-if scenarios (e.g. changes of SLAs, changes of processes/resources, changes of threat environments) and identify suitable investments.

These capabilities are now offered as a service by HP Security Business (HP ESS).

I am interested in exploring the implications of doing this in emerging scenarios involving organisations that increasingly rely on outsourcing, supply-chains and the Cloud. What are the implications in terms of Incident Management and Response? How to effectively enable Information Sharing? How to enable accountability among the involved parties?

There is an opportunity in designing and building the next generation of Security Analytics and Risk Management services that can scale and cope with these emerging scenarios. More to come.

In the meanwhile, I am looking for additional requirements and use cases in the above space. Please contact me if you are interested in engaging in this area.


--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---

Security Analytics for Incident Management and Remediation Processes

A Security Analytics solution is now available for strategic risk assessment and decision support in the area of organisations’ Incident Management and Remediation Processes.

This solution has been fully transferred to HP Enterprise Security Solutions.

It is now available an overview of the Security Analytics Report that will be created and customised for customers.

In case you’d like to get a copy, learn more and/or are interested in carrying out a Security Analytics assessment in your organisation, please let me know.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Security Analytics applied to Security Event & Incident Management Processes

I just finished carrying out a case study with a key HP customer, involving the usage of the HP Security Analytics methodology for risk assessment and productivity analysis of their Security Event and Incident Management Processes.

This is a complex area, that goes beyond the simple usage of Security Event & Incident Management (SIEM) solutions and involves people, skills and processes to analyse events, identify false positives and/or security incidents to remediate. These processes are very important to minimise organisations’ exposure to additional security risks.

The case study has been successful. Models and simulations indentified (and provided evidence about) key process bottlenecks and root causes of risk exposure. A full Security Analytics report has been produced for the customer.

Template Security Analytics models and result diagrams have also been produced, in order to support a repeatable analytics service for other customers.

This Security Analytics area is now ready to be offered as a service.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Presentation: Risk Assessment and Decision Support for Enterprise Security Policies

I recently gave a presentation at the IEEE Policy 2011 Symposium, about “Risk Assessment and Decision Support for Enterprise Security Policies”. Good discussions and debates.

My presentation is now available online. The abstract of the related paper follows:

“This paper presents and discusses our work to provide organizations with risk assessment and decision support capabilities when dealing with their strategic security policies. We aim at achieving this by using a rigorous and scientific methodology (and tools) which leverages modeling and simulation techniques. This methodology helps organizations to assess their risk exposure. It factors in policy implementation at the operational level along with relevant threats, processes, interactions and people behaviors. It provides “what-if” analysis by illustrating the consequences of making policy changes and investments. We introduce our methodology and tools and then illustrate how this approach has been successfully used in a real case study with one of our major customers. This case study focused on the organization’s access management processes and related policies: it helped to inform strategic security policies and support changes of current processes. Additional work is planned in this space.”



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Applying Security Analytics in the Space of SOC and Incident Management

Here is another exciting area in the space of Security Analytics.

I and colleagues of mine have been carrying out a few case studies, jointly with HP Customers and HP businesses, in the space of situational awareness by using Security Analytics.

This is an exciting area, very suitable for the HP Labs and HP IS Security Analytics methodology and tools, as it involves modelling critical processes, people behaviours and dealing with risk assessment issues.

The aim is to provide decision support to strategic decision makers (CISOs, CIOs, risk managers, etc.) and support the definition of related security policies.

Of particular interest and relevance is the application of our modelling & simulation methodology (along with related tools) to the processes involved in Security Operations Centres (SOCs) and related Incident Management & Remediation.

Specifically, we aim at assessing the risk exposure of organisations due to their SOC/incident management processes and the involved performance (e.g. time wasted in handling false positives). A series of metrics have been identified to measure the involved risks, e.g. time to fully manage incidents (the higher the wider the risk exposure window).

We used our analytics models to explore “what-if” scenarios e.g. the impact of changing SOC/incident management process steps, introducing automation and/or changing the number of involved personnel.

Interesting trade-offs are currently explored based on the priorities of decision makers, e.g. costs vs productivity vs security risks.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Identity and Security Analytics: Paper Accepted at IEEE Policy 2011 Symposium

We got a paper accepted at the IEEE Policy 2011 Symposium focusing on the Identity and Security Analytics work we did with a major HP customer:

“Marco Casassa Mont, Richard Brown
Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes”

The abstract of the paper follows:

“This paper presents and discusses our work to provide organizations with risk assessment and decision support capabilities when dealing with their strategic security policies. We aim at achieving this by using a rigorous and scientific methodology (and tools) which leverages modeling and simulation techniques. This methodology helps organizations to assess their risk exposure. It factors in policy implementation at the operational level along with relevant threats, processes, interactions and people behaviors. It provides “what-if” analysis by illustrating the consequences of making policy changes and investments. We introduce our methodology and tools and then illustrate how this approach has been successfully used in a real case study with one of our major customers. This case study focused on the organization’s access management processes and related policies: it helped to inform strategic security policies and support changes of current processes. Additional work is planned in this space.”


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Security and Identity Analytics

I have got a paper accepted at the coming IEEE Policy 2011 Symposium.

This paper is based on a recent HPL Technical Report I published, on “Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes”.

Looking forward at presenting this work.

Interestingly, this paper describes work that we did jointly with a major HP customer, in the space of Security Analytics and Identity Access Management.

This work de-risked Security Analytics in this area: it is now one of the Security Analytics capabilities offered as a service by HP Information Security.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

New HP Labs Report: Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes

We recently published a new HPL Technical Report illustrating the practical usage of Security Analytics in a case study involving one of our major customers:
“Marco Casassa Mont, Richard Brown - Risk Assessment and Decision Support for Security Policies and Related Enterprise Operational Processes”
The paper abstract follows:
“This paper presents and discusses our work to provide organizations with risk assessment and decision support capabilities when dealing with their strategic security policies. Traditional work in the policy management space primarily focuses on technical languages and frameworks to manage and enforce operational policies. These contributions are important but they do not address strategic decision makers’ needs and questions such as: What business and security risks is my organization exposed to, due to the current security policies and related operational processes? How effectively are these policies enforced at the operational level? What is the impact of changing them? We aim at providing strategic decision support in this space by using a rigorous and scientific methodology (and tools) which leverages modeling and simulation techniques. This methodology helps organizations to assess their risk exposure. It factors in policy implementation at the operational level along with relevant threats, processes, interactions and people behaviors. It provides “what-if” analysis by illustrating the consequences of making policy changes and investments. We briefly introduce our methodology and tools and then ground the discussion by illustrating how this approach has been successfully used in a real case study with one of our major customers. This case study focused on the organization’s access management processes and related policies: it helped to inform strategic security policies and support changes of current access management processes. Additional work is planned in this space to further validate our approach and build template solutions for different types of organizational policies and processes.”


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

New IEEE Computer Article - Using Modelling and Simulation to Evaluate Enterprises’ Risk Exposure to Social Networks

In collaboration with Penn State University, we recently published an IEEE Computer article (Research Feature) illustrating how Security Analytics can help to evaluate risks in the context of Social Networking:
“Anna Squicciarini, Sathya Dev Rajasekaran, Marco Casassa Mont – Using Modelling and Simulation to Evaluate Enterprises’ Risk Exposure to Social Networks”
The abstract follows:
“An analytic methodology involving modeling and simulation could help decision makers determine how their employees' use of social networks impacts their organization, identify how to mitigate potential risks, and evaluate the financial and organizational implications of doing so.”


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

On the Benefits of Combining Security Analytics with SIEM Solutions

In previous posts of mine I discussed the importance of Security Information and Event Management (SIEM) solutions in providing organisations with compliance and assurance capabilities, hence improving organisation’s situational awareness.

I often referred to these solutions as based on a bottom-up approach, i.e. starting from the collection of data, correlations and subsequent deductions of alarms, trends and analysis of organisation’s risk exposure.

In other posts I compared and contrasted this approach against the top-down approach provided by Security analytics (in particular in the IAM space – “HP Labs Identity Analytics – What is this all about?”), where models and simulations are used to provide strategic decision support. These models need to be grounded by using empirical data.

I actually believe that these two approaches can be combined to get greater benefits:

• A key part of Security Analytics activities, is to identify the most relevant parameters, measures and metrics relevant to assess risks, provide suitable decision support and what-if analysis. Now, this information can be used to drive the configuration of SIEM solutions, by recommending which measures and metrics to focus on and their impact in enabling risk assessment and deductions;
• SIEM solutions can collect, aggregate and process large amounts of data. This capability can be used to provide up-to-date empirical data to fuel Security Analytics models;
• Finally, Security Analytics can be used to provide strategic decision support in the area of event and incident management, situational awareness compliance. By modelling and simulating processes related to the collection and manipulation of data, correlation of information, deduction, incident and change management, it is possible to explore the presence of potential weaknesses, faults and check for the appropriateness of the allocated resources. This would help to inform security policies and investments

Related to the third point, Security Analytics can enable the exploration of questions such as: “Are the current SIEM investments and related processes appropriate?”; “Am I focusing on the collection of the relevant data? Are my processes adequate to detect and handle specific threats?”; “What are the consequences of changing some of the processes/investing more in specific solutions and resources?”

I indeed believe that an interesting R&D area to work on is exploring how to leverage and combine these two approaches.


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Identity and Access Management: The Next Big Thing …

One of the drivers and motivations of this blog is to debate and explore the evolution of Security and Identity and Access Management (IAM) – beyond the current solutions and approaches – and identify new trends and opportunities.

Let’s focus on the IAM area – at least in this blog post.

I must say that in the last 5 years there has been a strong consolidation of the IAM offerings and suites available on the market. They are pretty much equivalent as they offer similar functionalities in a well defined set of areas.

A promising area (perceive as the next big thing, 3-5 years ago), Identity Federation Management, has not really (yet) taken off, as far as I know, outside enterprise environments and for low-risk transactions on the web. New challenges posed by access control and identity management in the Cloud might indeed revamp this area, but it has to be fully proven …

Is “classic” IAM rapidly commoditising? I really think so … Are there major margins of growth for traditional IAM solution providers? I am not convinced (but I’ll like to hear about rigorous and substantiated market forecasts …).

So, what is the next big thing in this space? What is really going to change the IAM landscape and differentiate from what is currently out there?

This is a question open to all readers. Feel free to send your views and opinions.

Here are my initial thoughts.

First of all, it would be more correct to think about what “the next big thing” is going to be for specific verticals (e.g. consumers, enterprises, etc.) …

In the context of enterprises, I am currently reflecting on various inputs and experience that I am maturing by interacting with customers and consultants.

Organisations are increasingly questioning the large and expensive investments in the IAM space. The classic message that “you should buy this IAM suite and related service as it will help you reduce costs & risks and increase productivity (trust us)” is not going down so well anymore. From what I understand, customers increasingly want a clear assessment and evidence underpinning these statements.

This is more and more reflected by an approach to IAM driven by rigorous Risk Assessment – driven by business awareness, knowledge of suitable trade-offs and an understanding of the risk appetite of the organisation as well as the threat landscape. Decision makers in this space are moving up the management ladder, from the lower-level IT/CISO office to Risk Managers and/or CIOs.

Today risk assessment and investment decisions are achieved with ad-hoc approaches by using (effective but) general purpose Risk Assessment frameworks, such as ISO 2700x and equivalent. How to simplify this process? How to provide fine-grained risk assessment that takes into account the analysis of various options and scenarios as well as providing what-if analysis? How to evaluate the actual appropriateness and impact in investing on specific IAM controls? How to package all this as a service to be offered (among others) for making informed decisions in the IAM space?

I am more and more convinced that one of the next big things in IAM will be in addressing this gap, i.e. providing a simplified, rigorous and scientific approach to evaluate risks in organisations and pinning down (among other security aspects) to the suitable IAM investments and solutions, tailored to the specific organisational realities.

This is what we are exploring at HP Labs, in the broader space of security, with Security Analytics and, for IAM, in the specific context of HP Labs Identity Analytics.

I am very interested in your opinion and the (inevitable) different views of what the next big thing in IAM is going to be …


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Security Analytics as a Service - Important IAM Case Study Successfully Delivered

Good news. We successfully delivered an important case study in Security Analytics, in the context of IAM (provisioning and deprovisioning processes) for a major customer (no details can be provided due to confidentiality agreements).

This consisted of a detailed risk assessment analysis of their current IAM access management processes – based on agreed metrics – and a related “what-if” analysis of the consequences of adopting degrees of IAM automation.

This provided good insights and key taking points to the customer as well as useful feedback for our Security Analytics work, in particular in the context of HP Labs Identity Analytics.

We indeed want to run Security Analytics as a business Service. In this context, Vistorm is going to play a key role, as described here. Specifically, for Security Analytics applied to IAM, we can think at “Identity Analytics as a Service”.

I can see two main threads of coming activities:

• Paid Security Analytics Services (carried out by Vistorm, in collaboration with HP Labs) – for standard security analytics assessments, in IAM areas that have already been templated and explored
• Exploratory case studies (lead by HP Labs, in collaboration with Vistorm) in IAM areas that require additional investigations, for examples a few leading-edge ones, discussed here
  

Security Analytics as a Service - in particular in the context of IAM, is going to help strategic decision makers to clarify their priorities and support their decisions, in processes and investments that quite often are in the order of million of dollars.


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Applying Security/Identity Analytics to Cloud Computing

In previous posts of mine, I provided additional information about what the HP Labs Identity Analytics is and how it relates to the Security Analytics initiative. I then provided an overview of various IAM areas where to apply Identity and Security Analytics.

Related to this, an interesting area where Identity/Security Analytics can be applied is Cloud Computing.

Organisations (and their decision makers) need to make decisions about adopting cloud-based resources and services in their businesses. They need to explore relevant trade-offs, i.e. lower costs (and perhaps better efficiency) vs. potentially losing control on IT and exposing themselves to additional threats and risks.

In this context, IAM solutions and emerging related frameworks can provide some of the required controls (e.g. via trusted federation, cloud-based compliance and assurance management, etc.).

On the other hand, the IAM frameworks and solutions we know are too enterprise-biased/focused: IAM needs to go through a profound transformation to fully address the needs and requirements of managing identities, profiles and user access rights in cloud environments.

This without keeping into account that individuals - both as private people and employees - are themselves increasingly making decisions about adopting cloud computing solutions for personal and work related matters (consumerisation of the enterprise).

I discussed some of these concepts and dynamics in previous presentations, such as “The Future of Identity in the Cloud” and “The Future of the Information Society”

Security/Identity Analytics can help to explore these trade-offs, related investment options and threats.

Furthermore, Security/Identity Analytics can be used to explore “what-if” scenarios, based on different assumptions and risk mitigation capabilities introduced by different IAM frameworks and other related controls (based on different models and assumptions).

I indeed believe that there is a need for a more rigorous, scientific analysis of this space as well as a better understanding of the impact of various IAM approaches in the Cloud and their actual added values.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

On Security Analytics: Putting the Science into Security Management

In a previous post of mine, I mentioned the Security Analytics initiative. I promised to provide more details. Here they are.

I attach a datasheet called “Security Analytics: Putting the Science into Security Management”, by Vistorm (an HP Company).

The IAM area (and the HP Labs Identity Analytics activity) is covered in Security Analytics. Hopefully the datasheet will provide more details.

Here is an extract from the introduction:

“As the pressure on business increases so does the complexity of the security challenges. As a result security teams are finding it increasingly harder to achieve, measure and communicate a measurable reduction in business risk.

So how should a security team determine the best possible strategy: How much should be spent; what should be prioritised; what trades-offs to accept between lowered risk and business disruption; how to champion and justify security decisions to the business?

Vistorm, an HP Company and HP Labs have a shared vision for next generation security management: one that helps our clients achieve a measurable reduction in business risk along with a lower long term investment in information security.

Security Analytics is at the heart of this vision and is about creating tools and methodologies to address rigorously the challenges that security teams face in driving more effective security strategies. …”

Here are more details about the currently available Packaged Security Analytics:

“By combining Vistorm’s expertise in security governance with HP Labs’ expertise in security research we are able to offer a packaged consulting engagement featuring repeatable, short term engagements to address security management challenges (people, process, policy and technology) in two key areas:

• Vulnerability and threat management (VTM), and
• Identity and access management (IAM).

The value of these engagements is:

• a rigorous exploration of your (VTM or IAM) system, with prediction and ‘what-if’ capabilities
• shared multi-stakeholder understanding of the business and security trade-offs
• justified decision making
• the introduction of science into your information security management system (ISMS), and the opportunity to expand.”

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Looking for a customer engagement (case study) in Security Analytics – IAM, Access Management & Provisioning/Deprovisioning Processes

I am in the process of successfully finalising a case study with a major HP customer, in the government area, in collaboration with Vistorm (an HP company).
The customer was interested in better understanding their current risk exposure due to their access management processes and the impact of adopting IAM automation.
An IAM case study has been jointly run to:
1. Identify suitable metrics to convey their risk exposure (e.g. in terms of verall time to provision/deprovision user accounts, impact of hanging accounts, shared accounts, super user accounts, etc.)
2. Model their current access management processes (specifically their provisioning and deprovisioning processes) and run simulations
3. Convey to the customer an estimate of their current risk exposure, based on shared assumptions
4. Model and simulate the impact on the risk exposure in case IAM automation were adopted
In this case study I used our HPL Security and Identity Analytics methodology, jointly with our modelling and simulation tools.
It really helped us to refine our approach, get a template of IAM provisioning/deprovisioning processes and the customer to have a better understanding of their risk exposure and impact of various investment options.
I am now looking for another “customer” (medium-large organisation, possibly), interested in running a similar case study, to have a second validation point and get further input, possibly in a different business context. As counterpart, you will an assessment of your IAM processes and a “what-if” analysis.
Please do not hesitate to contact me for any question and/or to get more details about engaging in a Security Analytics case study with HP Labs.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---