{"id":338,"date":"2023-05-11T14:29:46","date_gmt":"2023-05-11T04:29:46","guid":{"rendered":"https:\/\/andyhowes.local\/?p=338"},"modified":"2023-05-28T15:21:35","modified_gmt":"2023-05-28T05:21:35","slug":"boosting-cyber-security-at-kpmg","status":"publish","type":"post","link":"https:\/\/andyhowes.local\/boosting-cyber-security-at-kpmg\/","title":{"rendered":"Boosting cyber security at KPMG"},"content":{"rendered":"\n<p>To stay cyber secure, organisations need to have robust Security Information and Event Management (SIEM) systems in place. My internship helped KPMG to achieve just that by strengthening their SIEM capabilities.<\/p>\n\n\n\n<p>As part of my <a href=\"https:\/\/andyhowes.local\/cv\/master-of-computing\/\" data-type=\"page\" data-id=\"231\">Master of Computing degree<\/a>, I undertook a three month internship at KPMG. Throughout this internship, I worked on a range of projects for both internal tools and on behalf of clients.<\/p>\n\n\n\n<p>In one of my favourite projects, I was tasked with working with KPMG&#8217;s internal cyber security team to integrate their tools with new threat intelligence data sources. To demonstrate my work, I was asked by the ANU to produce a poster, and a pitch video.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Boosting cyber security at KPMG\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/aram2cAFKRU?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">SIEM and CTI<\/h2>\n\n\n\n<figure class=\"wp-block-image alignright size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/andyhowes.local\/wp-content\/uploads\/2023\/05\/SIEM-Dashboard-1024x858.png\" alt=\"\" class=\"wp-image-342\" width=\"512\" height=\"429\" srcset=\"https:\/\/andyhowes.local\/wp-content\/uploads\/2023\/05\/SIEM-Dashboard-1024x858.png 1024w, https:\/\/andyhowes.local\/wp-content\/uploads\/2023\/05\/SIEM-Dashboard-300x251.png 300w, https:\/\/andyhowes.local\/wp-content\/uploads\/2023\/05\/SIEM-Dashboard-768x644.png 768w, https:\/\/andyhowes.local\/wp-content\/uploads\/2023\/05\/SIEM-Dashboard-1536x1288.png 1536w, https:\/\/andyhowes.local\/wp-content\/uploads\/2023\/05\/SIEM-Dashboard.png 1880w\" sizes=\"(max-width: 512px) 100vw, 512px\" \/><figcaption class=\"wp-element-caption\">Part of the threat intelligence dashboard I built for KPMG<\/figcaption><\/figure>\n\n\n\n<p>SIEM tools provide real time threat monitoring by analysing network traffic and log feeds to find indicators of compromise (IOC). IOC are signs that a system may have been breached. Looking for IOC in logs enables organisations to respond quickly to real-time alerts of suspected breaches. <\/p>\n\n\n\n<p>SIEM tools are powered by cyber threat intelligence (CTI), which provide the IOC to search for. KPMG recently invested in a new source of CTI that they wanted to integrate into their SIEM tool.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Using new CTI sources<\/h2>\n\n\n\n<p> I was tasked by KPMG&#8217;s Cyber Security Operations team with integrating this new CTI source into their SIEM tool, with the aim of boosting the system&#8217;s threat detection capabilities and empowering the team with insights into emerging threats. <\/p>\n\n\n\n<p>To integrate with the new data source, I configured a third-party connector in KPMG&#8217;s SIEM environment. Next, I assessed the threat data to determine the kinds of insights I could extract from it. Based on this analysis, I developed a threat intelligence dashboard which enabled KPMG to easily understand the threat landscape.<\/p>\n\n\n\n<p>Next, I configured and tested IOC detection rules for accuracy, efficiency, and validity. These rules generate alerts when IOC are found and indicate that a system may be have been compromised. The rules that passed the tests are now ready to be activated, which will further enhance KPMG&#8217;s cyber security posture.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Results and benefits <\/h2>\n\n\n\n<p>Integrating this CTI source into KPMG&#8217;s SIEM tool benefited multiple stakeholders. The security team gained enhanced cyber security capabilities, and their management gained additional oversight. KPMG employees now have added protection, and KPMG&#8217;s clients have peace of mind about their data and systems.<\/p>\n\n\n\n<p>I have strengthened KPMG&#8217;s SIEM system by integrating new CTI sources, configuring new detection rules, and developing insightful dashboards. These efforts have bolstered the organisation&#8217;s ability to resist ever-evolving cyber threats.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button has-custom-width wp-block-button__width-100\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/andyhowes.local\/wp-content\/uploads\/2023\/05\/Boosting-cyber-security-at-KPMG-web.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Download poster<\/a><\/div>\n<\/div>\n\n\n\n<p><em>The views expressed in this blog, poster and video are that of the author alone.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Through my internship at KPMG, I helped the organisation improve their cyber secure posture by strengthening their SIEM capabilities.<\/p>\n","protected":false},"author":1,"featured_media":353,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[1],"tags":[31,32,35,34,33,30],"class_list":["post-338","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-cti","tag-cyber-security","tag-indicators-of-compromise","tag-iocs","tag-kpmg","tag-siem"],"_links":{"self":[{"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/posts\/338"}],"collection":[{"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/comments?post=338"}],"version-history":[{"count":8,"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/posts\/338\/revisions"}],"predecessor-version":[{"id":520,"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/posts\/338\/revisions\/520"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/media\/353"}],"wp:attachment":[{"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/media?parent=338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/categories?post=338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/andyhowes.local\/wp-json\/wp\/v2\/tags?post=338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}