Monitoring and Threat Detection

Transcription

1 Monitoring and Threat Detection with Netflow Michael Belan Consulting Systems Engineer Cisco GSSO January 2017

2 AGENDA What is SW? Where does it fit in overall Cisco Security framework? What is SW? What does it do? And How does it work? Components: Netflow and Product Architecture Visibility: Host and Network Use Cases: Forensic and Insider Threat Review Demo

3 The Cyber Threat Defense 2.0 Model

4 NETWORK as a SENSOR NETFLOW NETFLOW! Anomalies Policy violations Inside the network StealthWatch High Visibility for Very Low Touch

5 Site C CE Internet TIC PE PE Site B CE PE MPLS CLOUD PE PE Site A CE CE Data Center

6 South Traffic North Internet Trusted internet connection Wide Area Network (MPLS/VPLS) Enterprise LAN User/Host User/Host User/Host Datacenter East Traffic West

7 Visibility Through NetFlow Switches Routers NetFlow is Metadata, key fields describing conversations Unidirectional, two records per conversation Established, versions include v5, v9, and IPFIX Supported by open source and commercial tools NOT full packet capture Benefits include Visibility across entire network Independent of agents, sensors, signatures Lightweight vs. packet capture for storage/forensics Unhindered by encryption Flow Information Packets SOURCE ADDRESS DESTINATION ADDRESS SOURCE PORT DESTINATION PORT 443 INTERFACE IP TOS Gi0/0/0 0x00 IP PROTOCOL 6 NEXT HOP TCP FLAGS 0x1A SOURCE SGT 100 APPLICATION NAME : : NBAR SECURE- HTTP Internet

8 Open Source Flow Tools Ntop Flowscan Flow-tools/cflowd EHNT SiLK among others

9 Scaling Visibility: Flow Stitching Unidirectional Flow Records port 1024 eth0/1 eth0/ port 80 Start Time Interface Src IP Src Port Dest IP Dest Port Proto Pkts Sent Bytes Sent 10:20: eth0/ TCP :20: eth0/ TCP Bidirectional Flow Record Conversation flow record Allows easy visualization and analysis Start Time Client IP Client Port Server IP Server Port Proto Client Bytes Client Pkts Server Bytes Server Pkts 10:20: TCP eth0/1 eth0/2 Interfaces

10 Scaling Visibility: NetFlow Deduplication Router A: :1024 -> :80 Router B: :1024 -> :80 Router C: :80 -> :1024 Duplicates port 80 Without deduplication Traffic volume can be misreported False positives would occur Allows for efficient storage of flow data Necessary for accurate host-level reporting Does not discard data Router C port 1024 Router B Router A

11 Massively Scalable Architecture Stealthwatch Management Console Presentation Integration 25 Collectors per Manager 6 million flows-per-second Flow Collector Flow Collection Profiling 240,000 flows-per-second Stitching, Deduplication Unsampled flow Flow Sensor Flow Export Payload sample Certificate data URLs

12 Stealthwatch Architecture StealthWatch Management Console Cloud License FlowCollector Packet Analyzer Cisco ISE ISE PIC Cisco AnyConnect FlowSensor NetFlow enabled infrastructure FlowSensor Virtual User And Device Information Feeds of emerging threat information

13 Host Centric Visibility: Host Snapshot

14 Host Centric Visibility: continued User information

15 Regional Visibility: Relational Flow Maps

16 The Attack Lifecycle

17 Attack Lifecycle: Detecting Command & Control

18 Attack Lifecycle: Detecting C&C Channels with SLIC

19 Attack Lifecycle: Country-based Detection

20 Attack Lifecycle: Detecting Internal Reconnaissance

21 Attack Lifecycle: Detect Internal Recon with Concern Index

22 Attack Lifecycle: Detecting Internal Propagation

23 Attack Lifecycle: Detect Propagation with Host Locking Users Resources/Datacenter A A ALARM B B

24 Attack Lifecycle: Detect Propagation with Worm Tracker

25 Attack Lifecycle: Detecting Data Exfiltration

26 Attack Lifecycle: Detect Data Hoarding 2GB per day Resource Group A User ALARM

27 Attack Lifecycle: Detecting Data Exfiltration Internet Internal Network ALARM Resource Group A User

28 Use Cases

29 ALERT: Incident Response Scenario: You have been notified of an unauthorized data transfer and need to pull back historical conversations. The notification could be from: Internal auditor External authority Security response team Below is an example notification received List of infringing content Taylor Swift Fearless INFRINGEMENT DETAIL Infringing Work : Fearless Filename : Taylor Swift - Fearless First found (UTC): 3:59:00 PM Last found (UTC): 4:24:59 PM File size : bytes IP Address: IP Port: Network: BitTorrent Protocol: BitTorrent Pull back all historical conversations around a host, port, application, or traffic type

30

31

32 ALERT: Insider Threat 1.Internal user connects to Terminal Server Scenario: An internal user is stealing data! The user could be a: Disgruntled employee Person about to leave the company Person with privileged credentials Person stealing and selling trade secrets Security events have triggered indicating a user is connecting to a terminal server, collecting data from a sensitive database, and tunneling the traffic out of the network using P2P through UDP port 53 (DNS port). 1.Terminal server used to collect sensitive data from within the same subnet inside the datacenter Terminal server used to encrypt data and tunnel through DNS port to an upload server

33

34

35

36

37

38

39

40

41 NETWORK as a SENSOR NETFLOW NETFLOW! Anomalies Policy violations Inside the network StealthWatch

42 NETWORK as ENFORCER! Policy violation detected! PxGrid isolate host NETFLOW ISE StealthWatch

43 Review: It s about Visibility Flow based independent of agents, sensors, signatures Metadata Light weight, efficient, unhindered by encryption Profile Hosts based on behavior, traffic sent and received Enforce Policy Identify the known bad Detect Anomalies Find and alert on outliers High Visibility for Very Low Touch

44