Youtube subtitles download by mo.dbxdb.com
good morning my name is melody
Hildebrandt my colleague Shawn hunter
welcome to Palantir cyber in action so
this is a talk about who should care
about cybersecurity what are some of the
key threats that we're seeing in the
field and how to overcome many of the
technical challenges that we see and
building a effective network security
program so Shawn and I are going to
decompose the cyber challenge into a few
of the key components that we've seen
working with commercial and government
institutions alike and offer a framework
for how organisations can better tackle
this shared threat so who's vulnerable
to cyber threats does your organization
have access to sensitive data so this
could be information about your
employees information about your
customers potentially intellectual
property from your company or classified
data or do you have some type of
physical or critical infrastructure this
could be a publicly facing website or a
utility pipeline if your organization is
really any of these things this means
potentially that you are susceptible to
cyber threats and what that means is
that this translates to essentially all
industries both in the public and the
private sectors so major financial
institutions oil and gas giants media
companies law enforcement agencies
Defense Department's all have at least
some criteria that they've met from the
previous slide and no one is exempt from
this threat and we're speaking to
companies every week now who are
identifying this really as their primary
concern right now but what is it that
they're exactly vulnerable to the word
cyber has really been used to describe
at a high level a wide variety of
discrete threats so a few that we've
seen particularly rising in an interest
distributed an aisle of service or DDoS
incidents and these are relevant for any
institution that has a forward-facing
website either to customers or to the
public and we've seen very high profile
incidents just in the last year in the
United States where many financial
institutions had their websites
essentially rendered inoperable do you
do
most likely Iranian hackers and this
prevented average citizens
I mean unable to conduct online banking
for extended periods of time spear
phishing attacks or social engineering
is something that probably all of us
have had some personal experience with
where a malicious person may attempt to
send an email that appears to be
legitimate but in fact contains
malicious code again we have very high
profile incidents of spear phishing in
the last year when RSA itself o a
premier security organization was
compromised this way when one of their
employees himself a professional
security engineer fell susceptible to an
email that he believed to be legitimate
but in fact contained malware insider
threat one that you know emanates from
employees within an organization often
associated with risks of media leaked
potential data exfiltration or fraud we
actually have an entire talk this
afternoon dedicated to looking at this
threat so as you might imagine all the
organizations in the center here maybe
Jillian with one or many of these
threats simultaneously and what they all
have is the ability to disrupt the
availability and the integrity of the
systems within an organization and
despite their diversity the
organizations at the center are actually
really all fighting a shared threat
because malicious actors attempt to
simultaneously direct disrupt a wide
range and diversity of organizations so
the more that we've seen organizations
collaborate with each other and with the
government the more successful effective
cybercrime prosecution can be so
tactically how do we begin to fight this
battle and what are some of the key
challenges that we've seen so cyber
security is fundamentally a data problem
the information that can be collected
around these threats is extremely
diverse so depending on an incident that
an analyst might be investigating email
data for example may be relevant and
this means not just metadata such as the
sender receiver or the subject line but
potentially the entire body of the email
so it means entirely unstructured
information also relevant might be
something like weblog which is every
single action that any customer takes on
a bet bank website
or proxy data which is every single
action an employee takes on the internet
when behind that company's firewalls
most use cases rely on the fusing of
this unstructured and unstructured data
together and the complexity is
compounded because of the scale of data
that we're looking at so at a large
institution email weblog proxy may each
be in the terabytes of data per day
effective analysis usually involves
looking at days weeks or months of data
so you're quickly approaching a petabyte
scale when you're actually looking at
looking to this data over to a wide
temporal horizon and really this is an
order of magnitude greater and scale
than we've seen dealing with other types
of use cases and the massive data scale
isn't actually just contained to those
few data sets the challenges of data
scale and data type diversity compound
over dozens or hundreds of different
data sets so we don't have a few data
sets with large-scale nor many data sets
with moderate data scale but the dual
challenges of very large scale and many
discrete data sources as technologists
we've actually found this latter problem
of the number of discrete data sources
to be the more difficult technical
challenge because scale is something
that you can throw hardware at often
that can help alleviate that challenge
but each marginal data set requires
additional engineering and effort so
before you can actually do anything with
this data to make it useful I mean needs
to be translated to a common language
and brought into a unified environment
and this first step of data integration
is really at Palantir score capabilities
so our dynamic ontology is what allows
engineers to map any type of disparate
data of any type of data format into a
common language or we would describe as
a unified object model and this was this
is what allows an organization to ask a
question like what do I know about this
IP address what gnostic to the fact that
that answer may actually be federating
to dozens of data sources under the hood
each of which expressed that concept in
a slightly different way Phoenix which
will see it during the demonstration is
our solution of a distributed database
technology that can scale to the
billions of log lines that are
wired in this type of analysis so using
in Phoenix plus the dynamic ontology
we're able to tackle the dual problems
of data scale and data type diversity so
once all the data is unified into one
environment and written against a common
object model what is ultimately what we
want to do with it so for any vector in
the security life cycle we can imagine
that they're kind of for interesting
stages of looking at this analysis we're
gonna go through each of these slightly
in detail preparation detection response
and hardening so preparation is about
the requirement to be able to identify
anomalies based on what your normal
behavior you'd expect to see on your
network is so you need to have
situational awareness of what you should
expect to see at a given time of day at
a different time of the year but once
you have this understanding of the norm
that's when you can actually do
detection when you can run different
types of analyses at scale over your
data to identify potentially irregular
behaviors complex temporal changes of
events that that are out of out of out
of the norm
next in response this is recognizing
that really no matter how robust a
network may be they're always going to
be breaches and it's really about how
rapidly you can respond to that breach
to understand what was the initial
vulnerability that caused it and how
potentially it's moved for your network
and what has been exposed that is
critical the speed and the ease of this
investigation relies upon having it
end-to-end integration platform and it
has all the data available within it and
finally hardening which is really about
ensuring a feedback loop between what
you've learned in your investigation and
bringing it back into the proactive
analysis that you can then conduct on a
regular basis and so while each one of
these steps you might imagine there's a
variety of collaboration among teams
within an organization this final step
is really about taking those lessons and
bringing them back into your own
organization as a whole as well as to
the broader ecosystem of your peers my
colleague has use the analogy of have
enhancing a collective immune system if
you think about the ways that malicious
actors attempt to probe
a wide number of organizations
simultaneously looking for the weakest
link to exploit once they're inside they
then have the ability to refine their
methods hone the way that they can go
after potentially stronger organizations
it's about sharing collectively and
being able to enhance one another's
defenses that can prevent this virus
from strengthening and then can enhance
the security for all of us so now given
that kind of theoretical look I'm going
to turn it to my colleague Sean to go
into a demonstration Thank You melody so
we take the part here of a network
security analyst just got in the morning
we log in to Palantir we've got our
first coffee of the day we go to the
Hercules work flow app to see what
clusters have been provided for us to
investigate we immediately get a cluster
and bring that back to our graph now
what's just happened there what has
happened is that parent has distributed
algorithmic technology he has built out
a network of events objects and
relationships to describe some network
information that's happened some
activity that's happened on our network
the picture is kind of complex so I want
to clear up my network a little bit so I
can understand it better it's the first
thing I'm doing here is just trying to
hone down this very complex web of
relationships is just to focus right in
on the most important type of
information so for example I've got a
number of proxy servers here well
they're not really that relevant to my
raw picture I know my proxy servers
there okay so I'm going to zoom right in
here and
and now what I'm going to do is I'm
gonna make a hierarchy so I can
understand the relationship better okay
now it's much clearer than our initial
Network we have these four computers on
our internal network that have been
connecting out to two external IP
addresses these four computers belong to
these four users here so my first
question as an analyst that I want to
answer is what are these four users been
doing on my internal network to answer
that question I'm going to turn to
Phoenix and search the single sign-on or
SSO logs as iso is very cumbersome data
set because each line every time a user
logs into anything at all on our network
it results in a line on SS serves as so
each of these lines represents a time
that an individual employee has logged
on to some kind of resource so in this
case it's a staging database it might be
exchanged for their email it might be
production file systems for their user
directory or other work now what's
happening now is that Palantir is
converting those raw log lines which are
very difficult to understand and do
anything useful with in to objects and
relationships that i asmin as an analyst
can understand it's a straight away I've
got an interesting picture that's
developed each around each of these
users
I got a cluster of servers and showing
all the activity but I would really want
to focus on the most critical production
databases rather than just looking at
all of this so what I'm going to do here
is I'm going to remove everything that
has a criticality rating of less than 10
so I know that criticality 10 means our
most critical production databases so
I'm going to remove everything else so I
get a much clearer picture it's right
away something interesting okay so I can
see that these four users have been
logging into a number of critical
production databases okay and then
there's also been communication with
these external IP addresses so now the
question I want to answer is what is the
relationship between the logins and the
external communication so I can
understand better what has occurred to
answer this question what we're going to
do is we're going to drill into the
events and here I'm looking at a
timeline
each of these blue doubt bars represents
some external communication and each of
the green bars represents a login to a
crucial production database by drawing a
window here I'm able to highlight
certain events and I can start to see
each time I roll the window over I can
see which things happen in our temporal
window but you know to be honest this
picture is still kind of confusing I
mean there's a lot of different
information on there so what I'm going
to do is I'm just going to tidy it up a
little bit focus on one individual user
hopefully I'll be able to see a pattern
with one user and then maybe I can
generalize that to all of the users
thanks to the Palantir knowledge
management capabilities I can always go
back and bring my graph back to the
state that it was before I haven't lost
any of the information a threeway here a
pattern starts to emerge so user logs in
a few hours later some data goes out to
an external network again they log in to
a production database and then there's
external communication and this pattern
is repeated again and again and again
this is kind of interesting what's
happening here this is actually probably
some legitimate activity by the user
right then here's another log into a
production database and then an external
event ok so let's go back and see if we
can see that pattern across all the
users as a subject matter expert I
recognize that it's proxy beaconing so
typically a a internal compromised host
will send data out of my network on a
regular basis to a malicious hub and if
you focus you can see that after each
event by a user on the internal
production server data is shipped to one
of these two malicious IP addresses so
an interesting pattern is starting to
emerge I can see that pattern developing
now this is kind of interesting as well
we've got a bunch of activity right at
the beginning before any of the logins
so perhaps if this is some kind of
compromise perhaps during this window
this is when the hosts were infected
we'll investigate that perhaps later ok
so let's focus on what we have now so we
know we have four users
being on to various critical production
servers and then data is exfiltrated to
these two IP addresses but what we don't
know is how this has occurred and we
also don't know much about for example
whether these are malicious insiders or
whether they perhaps innocent victims of
some malware perhaps they clicked on a
link in an email that they shouldn't
have or something like that
so our next step is to look at all the
information across structured and
unstructured sources that we know about
these two IP addresses here so now I'm
going to search across unstructured data
and we get a bit of interesting
information so look at this first of
these documents this is a network
advisory report and this is typical of
an advisory report so it's got lots of
useful information but in a very
unhelpful format so what I'm doing here
is I'm tagging this document to make
some sad some structure so it's useful
for our investigation and contains some
objects which we can do analysis on what
this advisory report is telling us is
that there's a malware or virus called
net spy and this net spy has a signature
called an md5 sum or a message digest
that will allow us to scan for this on
our network so that's kind of useful in
itself it's associated with this domain
so we're gonna add these bits of
information I'm also going to link this
IP address to say that this particular
IP address is associated with this
malware okay now while I was working on
this document as you can see I'm adding
some structure but my graph has been
flashing and the reason for that is that
pawns here is adding the objects that
I've created to my graph okay so now we
know this IP address and this IP address
which is malicious are the same so let's
resolve them to say yep they're the same
object we we know it's malicious in
actual practice this cell the IP address
here is probably malicious too but we're
not going to jump to the conclusions yet
we straight away got some actionable
intelligence okay we've got
two very probable malicious ip's we've
got some malware and we know these four
hosts are very likely to have been
compromised with this net spy malware so
let's go right ahead and use
collaboration we're going to send a
message to ite antivirus team hey guys
these four hires who probably got net
spy okay
so we're sharing that immediately and
that allows a team while I'm conducting
my investigation to immediately go out
and do their thing and they're gonna
scan our network presumably and find out
whether those four hosts been remediated
being infected and you know take some
kind of remedial action alright so let's
see what else we know about these IP
addresses so we we also saw another
document which is an intelligence report
now this is sort of interesting so
somebody's already been doing some work
on this report perhaps another team in
our organization so I'm just going to
take advantage of the work they've done
by tagging this document up and drag
this straight back down onto our map
all right so
so what do we got here
we've got a blackhat organization called
revelation and we've got various
intelligence reports and we've also got
let's search around them a little bit
more and see what else we can find
okay that's interesting so these this
organization is associated with one of
our two malicious IP addresses let's get
all the IP addresses and grade them up
I'm just organizing my map so that it
makes it easier for me to understand the
relationships between the things and
people involved I've got some people
here that's kind of interesting well
have a look at that in a second okay
cool so we've got our organization here
called revelation about three of the
members we know they're responsible for
one of these malicious IP addresses
which means they're also probably
responsible for the Nets by malware we
can drag these people and the
organization onto our browser
application which gives us a baseball
card type view here we can see what we
know about Revelation okay so they're a
hacktivist group they operate out of
Samara Russia and they focused on
warning people about the end of the
world well guess what the world's gonna
end it's kind of nice of them to warn
people so right and we've got some
pictures of the people involved we've
got this guy at her pad low about him
looks like he's worried about swine flu
or something yeah and probably right to
be worried this guy looks a bit peaky
okay we say we've got these people so
what we want to do is now share the
results of our investigation Oh
so firstly I'm very interested in this
group and what they've been up to and if
anybody else does any work on this group
I want to make sure that I get them
informed so I'm gonna just immediately
select all these guys and I'm gonna make
a filter so I make a new filter and I'm
going to call it revelation
[Music]
u.s. keyboard right so I make a new
filter and this filter now know that I
just drag and drop a bunch of objects
onto the filter helper now instantly
it's going to find find any documents
which relate to any of those objects and
I'm going to save this as a search feed
and what this means is in future as soon
as I log into Palantir so down here I
have a search feed and that contains all
of my dog documents relating to this
group called Revelation and if anyone
changes anything relating to those
objects or uploads any new documents
which match my search terms
I'll get notified because this number
here will update and I'll instantly get
the change pushed out to me so I can
instantly see if anyone with my
colleagues doesn t work on this group
called revelation the other thing I'm
going to do is I'm going to share this
intelligence that I've created here with
other groups within our organization and
also across my mash of collaborating
organizations so I'm going to send this
using collaboration to my Fi cyber mesh
team and say that there's these are the
threat actors responsible for a data
breach using that spy malware talking
and typing has never been my forte ok so
I'm going to share that and what that
immediately means is that anyone who's
collaborating with me will instantly get
the results of my intelligence and I've
shared everything back with the
ecosystem so what just happened there
how does Palantir help with the cyber
threat cycle well firstly we prepare
using operational dashboards to give a
situational awareness of our entire
network and features such as folders and
feeds which mean that as soon as
anything that we're interested in
updates we get notified we detect threat
using Hercules clustering technology
which uses bespoke algorithms to search
across gigabytes or even petabytes of
data in disparate data sources bring
those back score them and so we know
we're always tackling the most
significant threats first we respond
using workflow management we can respond
quickly and effectively to investigate
threats and Palantir as dynamic ontology
allows us to combine structured and
unstructured data within a single
intuitive and responsive user interface
and Palantir phoenix means we're not
overwhelmed by the data scale we can
focus on our analysis and finally using
collaboration we can share our
intelligence across the enterprise which
allows us to harden our network not only
that balances network Nexus peering
technology means we can share our our
intelligence across a network of
collaborating organizations so that any
attack on one institution is stopped
before it gets to all of the others
you know cyber defense isn't an area of
competitive advantage all important
institutions face these threats and
everyone benefits if they share
intelligence and insights with each
other as long as that can be done in a
secure manner with respect for data
protection volunteers Nexus peering
means that is when you share any
sensitive internal data is automatically
redacted so that anything you don't want
to share won't be I'd like to thank you
for coming and hearing us today I know
it's late and you're all waiting for
lunch if you have any questions melody
and I will be available in demo station
one in the gallery after lunch thank you
very much
[Applause]
they Subtitles End: mo.dbxdb.com