hey Peter home hi my name is Peter hi
I'm I'm the vice president for a mere
four red ale a couple of observations
here 1 i'm probably the oldest guy in
the room possibly and the second is i'm
probably the least technical guy in the
room and I can apologize for the second
I can't really do much about the first
much like Chris we were at the pwc
cybersecurity today yesterday presenting
new technology companies and doing
different interesting we think things in
in the space so I'm going to talk a
little bit about you know predictive
risk and security analytics and what
really I'll do particularly around the
insider threat and the people within a
business and talk a little bit about the
challenges just to set the scene who we
are what we do how we approach the issue
a particular case study quickly and some
of the different ages with really are so
what's the problem well sixty percent of
all the attacks come from the insider
and the vast majority of you be very
aware of the technology investments that
organizations make to particular
perimeter and when sixty percent of the
problem it is outside that that that
sphere it changes the dynamic and you
know old guy that i am i've been in the
cyber security business nearly 20 years
and i have yet to see any organizations
outside of our customer base proactively
monitoring for an appropriate behavior
by the employees within the business in
a real way and that will become clear I
think you're all very aware of this you
know the last one in the UK are the most
reason one the sage employee where a
lady was arrested at Heathrow mossack
fonseca the Boozer allen hamilton
consultant who's just been arrested in
the US working for the NSA and and the
challenges is all all the organizations
to you work with work for have got data
and they just haven't had the ability to
actually transform that day to into a
narrative and a store
surface the people of concern the
weather that's a you know a saboteur
somebody's disgruntled about to leave
the business we found people being
blackmailed for intellectual property
obviously you've got the the Snowden
type internal activists who wants to go
out and publish information because they
believe for whatever reason that it's in
the public interest and there's
negligent you know there's three types
of user the malicious and the
compromised and the negligent ruling so
we look at taking a unique risk where
you look at the behaviors of the
individuals within the organization not
just the anomalies and it is very much a
human centric approach the use cases for
us leave regulatory surveillance you've
probably all heard of FX LIBOR market
manipulation the massive fines financial
services have been charged with they
need to proactively monitor what those
traders are doing unfortunately the
behavior hasn't necessarily changed and
they need to join up disparate data sets
of voice email chat trade digital and to
work out who the people are concerned
information security we get to talk more
about that but that is about
intellectual property theft compromised
or negligent users and providing risk to
the business and the more generic one is
more about conduct and behavior in the
business we have HR teams talking to us
about you know people are you know
bullying sexism racism harassment
inappropriate behavior generally and
that were able to float for them as well
a little bit about red owl and it really
comes from guy or CEO who is in the US
military built their big data analytics
platform in the mid-2000s canesten and
iraq subsequently set up a company to
run that for the US government sold that
and in 2012 formed red owl to build a
commercial version of the platform to
surface people of interest people have
concerned and the humans within the
business number of you know high-profile
investors we've got there as well
talked a little bit about this earlier
the perimeter isn't enough everybody's
made investments in it it's easy
customers buy boxes with blinky flashy
lights on to solve problems don't manage
them don't monitor them don't get the
results it's important but on its own
it's not enough and the data without the
context any tools you'll see for
behavior based on analytics today are
still just looking at metadata and log
data from Network endpoints and identity
and access management systems and to
really get the human element you need
the contextual data what's in an email
the content the attachments transcribed
voice and instant messaging whether it's
linked Bloomberg Reuters all of those
can be ingested and happy analytics
applied to it and the enrichment data as
well from a child system and third-party
systems and on the sort of maturity
model if you don't get that you're only
getting half the picture and as we all
know half the picture is is of little
value without communications data so
that's what we do we pull in the email
the chat the voice the SMS messages the
phone records the physical access
control the HR data the digital data
that network the endpoint the I am data
apply models to it score it and
analytically analyze it and surface the
people of concern to allow an analyst to
then look at this probably people going
well that's quite big brother II it is
unfortunately statistically there are
always bear barrels in the barrel and
that's what we do is surface the bear
apples all those that look to be provide
the context around that and and deliver
the ability to flip into a forensic any
discovery platform to validate whether
that's true or not I won't talk too much
about these use cases you know what they
are flight risk is a great one for a lot
of our customers were able to identify
people who are about to leave the
business before they leave why because
that's when they take the IP
and you can focus a little bit more or
more energy I'm looking at those people
and we support the security ops and the
teams within the businesses will so he's
taking what people are doing with data
devices applications and illuminated by
putting that contextual data around it
as well and here's an example with one
of our customers where effectively we
provide a stack rank list of individuals
within the organization with the context
around why we floated them and they are
able to then deep dive into okay as is
real or not and peter hyams totally
busted he's stealing on information and
and one of the key things is to build a
proper program around this you're not
looking for the technology to fire
people you look at people a technology
to help you identify people of concern
and and then validate that before you
make any decision so you need to build a
proper insider threat program around
that and this is really dashboard wise
what it looks like you know we're
highlighting Phil zamudio why because
you know he's doing data recon and
collection he's doing Dana rich
filtration and he's got negative
sentiment in there so no sentiment is
another great thing within the
application as well because when you
have that contextual data you can
actually work out its person happy sad
angry irritated and when you applying
that to the other elements within the
platform you can really find out what's
going on this is where some of the HR
people get excited because more
businesses are concerned about what's
happening in their business and what the
general feeling of the staff our brief
case study investment firm we were
pulling an email chat and HR data and we
managed to surface things like you know
an employee being blackmailed for IP
wall crossing which in investment
banking or investment is not good
because you're talking to people sharing
information you shouldn't be sharing and
we had people actual trading data
stealing our goes it was illuminating to
say the least so the key differentiators
you know we cover the broadest data set
the comms and the unstructured data is
the hardest piece will integrate with
the sim seam and the tools and
infrastructure that organizations are
already invested in and will move people
to a proactive rather than reactive
forensics perspective and we and we
exposed the under on our analytics so
you can build your own use cases it's
not black box very configurable summary
that's it you know the people at the
moment sixty percent of the breach is
related to insiders excuse me that's
only going to get bigger and worse data
privacy wise clearly there are
requirements the just for clarity the
pret the solution can go on premise
private cloud and in fact in on an
appliance so the data that you've got
he's already there you're just making
better use of it thank you very much i
got recorded