HPL Situational Awareness-as-a-Service, in the Cloud

In the context of the HPL Safe Cloud project, I have been working on an HP Labs R&D demonstrator, jointly with HP businesses, to illustrate:


• Next generation Business Operation Centers in Disaggregated IT scenarios, i.e. where an organisation relies on service providers (SaaS) and infrastructure providers (IaaS) in the Cloud to run their IT operation

• Information Sharing as a key requirement for the organisation to improve its (security, business, etc.) situational awareness, now that it has not anymore control over their IT operations- issues and trade-offs involving information sharing, involving the company and the other stakeholders, including SaaS and IaaS providers

• Next generation war rooms

• Our vision in the areas of Safe Cloud and controlled information sharing

We have achieved an important milestone: a full working implementation is available. Additional details and a few screenshots of the public, R&D version of the demonstrator are available online.

This demonstrator is now available and can be shown to HP customers and business partners. Below I attach, as an example, a screenshot:

We focus on a scenario involving a company that increasingly relies on SaaS and IaaS Cloud Providers to run their IT Operations. The demonstrator uses advanced visualisation and back-end processing techniques to show a futuristic, next generation Business Operation Center, supporting a company to monitor/manage their disaggregated IT.

The demonstrator provides an overview of the various company's SaaS providers along with the dependencies they have on IaaS Cloud providers and the high-level “health” status of their services.

We then use the demonstrator to illustrate the need that a company has for information sharing - to enable better situational awareness - now that the company has lost control on its IT Operations. We highlight the tension-points involved in information sharing, the trade-offs that are acceptable by the various stakeholders and the consequences of sharing data.

The demonstrator shows various view points, in terms of available information and what can be shared. For example it is possible to focus on a SaaS Provider and/or an IaaS Provider, show the locally available information and which information can actually be collected, processed and shared with the company - based on agreed policies. The demonstrator highlights some of the implications of sharing data, i.e. via live metrics, highlighting risk points and related alerts.

The demonstrator can also show the dependency on the IT infrastructure used in the Cloud and various types of metrics/information that can be exchanged with the company (right - as part of a mutual agreement). This include information on IT performance, security and incident management aspects.

A key capability of the demonstrator is to enable the audience to interactively play different roles, such as acting as the company or one of the SaaS providers. A player can interact with the system and the other players, decide which information to share (for example with other SaaS providers and/or the company) in order to accomplish common goals (e.g. dealing with an incident or an attack). We believe this creates further awareness about the importance of information sharing, the implications and tension-points in doing it, and the needs for information sharing controls.

In our HP Labs vision, HP could provide these capabilities (dashboards, controlled information sharing, analytics, etc.) as a (Security) Service to its customers, for example in the context of Managed Services and/or Next generation SOCs.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

HP Labs SAaaS: Situational Awareness-as-a-Service

At HP Labs Bristol we are making good progress towards the development of a futuristic demonstrator in the space of Situational Awareness, named “Situational Awareness-as-a-Service (SAaaS).




This demonstrator focuses on the disaggregated IT of current/future organisations which increasingly rely on third parties (IaaS, SaaS providers in the Cloud, etc.) to carry out their IT and business activities.



We demonstrate the issues and opportunities related to safely handling information sharing between the organisation and its various providers, in a context of a future Next Generation IT Operation Centre and Security Operation Centre (SOC).



This includes illustrating the trade-offs in defining information sharing policies and handling queries to gather data from the involved parties, the clever analytics processing that can be performed on top of shared data (e.g. by leveraging HP Software solutions, HP/HPL SILAS, etc.) and the role of external, trusted information aggregators.



HP Labs will use the SAaaS vision to develop further innovative technologies in the area of controlled analytics and information sharing for large data sets.



The demonstrator currently consists of various storyboards focusing on IT and security information sharing stories. I am looking for public, real stories within organisations highlighting the pain points and issues in current disaggregated IT and security operations. The goal is to showcase them and illustrate how they could improve by leveraging SAaaS and future HPL/HP technologies.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Next Generation Situational Awareness and Information Sharing

I am particularly interested in innovating in the space of Situational Awareness and Information Sharing.

These areas are getting more and more relevant within organisations, beyond the traditional military and government contexts.

Situational Awareness is usually related to the process of collecting and processing large amount of information to understand risks, threats and issues and enable decision support.

I believe there are great innovation opportunities in this space, including:

· Leveraging longer-term risk assessment, what-if analysis and decision support capabilities, such as the ones provided by Security Analytics

· Leveraging Cloud computing and related services for the provisioning and management of situational awareness capabilities

· Innovation in the information flow management, involved in situational awareness scenarios, by using advance policy and context based techniques

· Leveraging assets such as HP ArcSight, HP TippingPoint and Autonomy in this space

· Designing SOC 2.0, the next generation of Security Operations Centers for Incident Management and Remediation to adapt to new emerging scenarios and technologies

· Intelligent detections of threats and risks and reactions (e.g. via dynamic playbooks)

More to come.


--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---

Survey on Situational Awareness and Information Sharing

The Multinational Experiment 7 (MNE 7) is carrying out a Survey on Information Sharing and Situational Awareness. It is open to organisation (industry, academia, etc.). No confidential information has to be disclosed.

Please let me know if you’d like to get involved. The deadline is by the end of November.


--- Posted by Marco Casassa Mont(here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Applying Security Analytics in the Space of SOC and Incident Management

Here is another exciting area in the space of Security Analytics.

I and colleagues of mine have been carrying out a few case studies, jointly with HP Customers and HP businesses, in the space of situational awareness by using Security Analytics.

This is an exciting area, very suitable for the HP Labs and HP IS Security Analytics methodology and tools, as it involves modelling critical processes, people behaviours and dealing with risk assessment issues.

The aim is to provide decision support to strategic decision makers (CISOs, CIOs, risk managers, etc.) and support the definition of related security policies.

Of particular interest and relevance is the application of our modelling & simulation methodology (along with related tools) to the processes involved in Security Operations Centres (SOCs) and related Incident Management & Remediation.

Specifically, we aim at assessing the risk exposure of organisations due to their SOC/incident management processes and the involved performance (e.g. time wasted in handling false positives). A series of metrics have been identified to measure the involved risks, e.g. time to fully manage incidents (the higher the wider the risk exposure window).

We used our analytics models to explore “what-if” scenarios e.g. the impact of changing SOC/incident management process steps, introducing automation and/or changing the number of involved personnel.

Interesting trade-offs are currently explored based on the priorities of decision makers, e.g. costs vs productivity vs security risks.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

On the Benefits of Combining Security Analytics with SIEM Solutions

In previous posts of mine I discussed the importance of Security Information and Event Management (SIEM) solutions in providing organisations with compliance and assurance capabilities, hence improving organisation’s situational awareness.

I often referred to these solutions as based on a bottom-up approach, i.e. starting from the collection of data, correlations and subsequent deductions of alarms, trends and analysis of organisation’s risk exposure.

In other posts I compared and contrasted this approach against the top-down approach provided by Security analytics (in particular in the IAM space – “HP Labs Identity Analytics – What is this all about?”), where models and simulations are used to provide strategic decision support. These models need to be grounded by using empirical data.

I actually believe that these two approaches can be combined to get greater benefits:

• A key part of Security Analytics activities, is to identify the most relevant parameters, measures and metrics relevant to assess risks, provide suitable decision support and what-if analysis. Now, this information can be used to drive the configuration of SIEM solutions, by recommending which measures and metrics to focus on and their impact in enabling risk assessment and deductions;
• SIEM solutions can collect, aggregate and process large amounts of data. This capability can be used to provide up-to-date empirical data to fuel Security Analytics models;
• Finally, Security Analytics can be used to provide strategic decision support in the area of event and incident management, situational awareness compliance. By modelling and simulating processes related to the collection and manipulation of data, correlation of information, deduction, incident and change management, it is possible to explore the presence of potential weaknesses, faults and check for the appropriateness of the allocated resources. This would help to inform security policies and investments

Related to the third point, Security Analytics can enable the exploration of questions such as: “Are the current SIEM investments and related processes appropriate?”; “Am I focusing on the collection of the relevant data? Are my processes adequate to detect and handle specific threats?”; “What are the consequences of changing some of the processes/investing more in specific solutions and resources?”

I indeed believe that an interesting R&D area to work on is exploring how to leverage and combine these two approaches.


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Analysis of state-of-the-art of Event Management/SIEM Solutions

I am interested in public documentation providing reviews of the state-of-the-art in the Event Management/SIEM Solutions.

In particular I am looking at how the following critical aspects are supported:

• Scalability: how these solutions scale in case of complex organisation, supply-chains and future utilisation of IT infrastructure/services in the cloud;
• Comprehensiveness of the type of data that can actually be gathered and stored
• Support for unstructured event data: how is unstructured data managed by these systems and processed;
• Type of supported data mining, correlations and deductions;
• How cultural and human behaviours are factored in/taken into account by the event management system;
• How compliance, governance and incident management processes are affected by introducing these solutions

I am interested in exploring how HPL Security Analytics can be of help, in investigating different investment options and provide strategic decision support.

The above information would be extremely valuable to build grounded models and related simulations.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

On Situational Awareness in Enterprises

“Situational Awareness” is an area that I am interested in exploring, in particular in the context of enterprises. How can an organisation be reasonable reassured that its risk posture is appropriate and the relevant threats are mitigated?

Indeed both risk assessment and the deployment of suitable control points are key to deal with risks. However situations can change, new threats can materialise or the controls that are put in place could actually be ineffective.

To close the loop, organisations usually invest in monitoring and event management controls to get a “picture” of what is actually going on.

However, how much is this “picture” an accurate representation of the reality? Are the relevant pieces of “intelligence” taken into account? What are their impacts in the overall risk assessment? Which key areas and elements should be cover? Which correlations are necessary to distillate meaningful information? Which investments are required to achieve all this?

Security Incident and Event Management (SIEM) tools and solutions can indeed help, from a technical perspective. But strategic decisions still need to be made (by Risk Managers, CIOs, CTOs, CISOs, etc.). These decisions are usually made in an economic framework.

How to provide decision support in terms of which investments to make, which monitoring areas to cover, which inferences and data correlations to look for, which trade-offs to consider (e.g. costs vs productivity vs risk exposure)?

I am interested in exploring how the HP Labs Security Analytics approach (i.e. applying modelling and simulation to provide decision support) can help in this space, by introspecting current strategic decision making activities and the involved processes, as well as exploring suitable trade-offs and the impact of existing controls, such as SIEM tools.

In this context, I am looking for public case studies, information/documents illustrating the current “assurance processes”, criteria adopted to deploy SIEM tools, as the key decision making steps adopted in this area.


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---