RSA SOLUTION OVERVIEW

Size: px

Start display at page:

Download "RSA SOLUTION OVERVIEW"

Reynard Webster
6 years ago
Views:

1 RSA Advanced Threat Detectin and Respnse with RSA NetWitness Lgs and Packets SPOTTING ADVANCED THREATS WITH BEHAVIOR ANALYTICS AND DATA SCIENCE MODELING Using Behavir Analytics and Data Science t Identify Cvert Channels and C2 Threats The use f detective analytics is nw a central piece f security architectures, as security prfessinals are increasingly encuntering a needle-in-the-haystack prblem. Security tls especially rule based nes as well as systems, applicatins, and infrastructure, create s much data that it's tugh t uncver the signal f a real attack. Behavir analytics tls help make sense f the vast amunt f data that these systems generate. While many vendrs claim t use behaviral techniques, they fail t integrate them with ther data science mdels t deal with tday s natin state r hacktivist-type attacker. There are sme real use cases where using behaviral techniques fr data analysis can identify sme f the mst real and pressing detectin issues security teams face, and that cnventinal analytic tls alne fail t spt. One amng many f these use cases is trying t spt cmprmised hsts, bth internal and external. Real threats dn t penly advertise themselves. They hide their activity amng all the ther things that are happening in tday s typically cmplex IT envirnments. These threats rely n the assumptin that tday s security teams have neither the tls nr the time t investigate deeply enugh t distinguish between their activity and thse f emplyees, custmers r partners. Tday s sphisticated attackers use ways t get infrmatin in and ut f the rganizatin that evade detectin, leveraging what are knwn as cvert channels that enable cmmand and cntrl (C2) f resurces. Many successful recent public attacks have cvert channels cmmunicating with C2 servers that can fully cmprmise systems. Fr example: Phishing scams typically use cvert channels t deliver malware t victims, making it difficult t spt that initial click n the ffending link. After cmprmise, tday s threats ften use cvert channels t effect cmmand and cntrl f victim endpints, hiding cmmunicatin traffic amngst nrmal web traffic. In additin t behavir analytics t detect C2 activity, using data science techniques t spt the use f cvert channels means that security teams can spt these sphisticated threats quicker, and reduce the likelihd that an attack harms the rganizatin.

2 Beacning Hsts Cmmunicating with Cmmand and Cntrl Sites When an internal hst gets cmprmised, attackers typically pen a backdr t allw cmmunicatin between a cmmand and cntrl (C2) site and the cmprmised system. Since mst rganizatins have a restrictive plicy arund the inbund cnnectins they will accept, the attackers get arund this by equipping the cmprmised hst t regularly phne hme t pick up instructins fr launching the next stage f the attack. Internal hsts beacning t a C2 hst at a high level lks very much like any ther http traffic, say fr example regularly plling news site, but there are ften clues t distinguish it frm cmmunicatins activity with nrmal hsts if ne lks mre carefully. Amng thers, these indicatrs include: Frequency f cmmunicatins. Typical beacning happens at a regular but relatively infrequent cadence, fr shrt perids f time this is in cntrast t standard web traffic, which is usually either ne-time r mre frequent. Bytes upladed vs dwnladed. Typical web sessins initiated by humans dwnlad far mre than they uplad web servers serve up pictures and ther cntent as a result f a URL request. Hwever, malicius sessins ften uplad far mre than just a shrt request fr a URL. Use f ckies. Typical web sessins place multiple ckies within the user s brwser t track user activity acrss that website and thers. Malicius sessins seldm use ckies. Use f referrer strings. The vast majrity f web sessins cme frm the user clicking n a hyperlink, resulting in a referrer string in the URL request. Malicius sessins generated frm lcal malware generally dn t. URL lengths. Because peple are suppsed t remember high-level URLs (such ggle.cm, cnn.cm etc.), they are usually shrt in length. Hwever malicius services ften embed themselves deep dwn in web servers, resulting in unusually lng destinatin URL generated frm within the rganizatin. Hard and fast alert threshlds fr any f these individual metrics is highly errr prne, s applying data science analytics are essential t identify utliers frm nrmal traffic, taking int cnsideratin many f these factrs at the same time.

3 Why Sptting the Use f Cvert Channels is a Challenge Sptting cvert channel activity falls int tw areas lking at bth inbund and utbund cnnectins, detecting internal hsts with anmalus utbund cmmunicatin patterns, and sptting thse external hsts that are mst likely t be cmprmised. Tw cmmn symptms f cvert channel activity are: Beacning where an internal hst peridically phnes hme t a cmmand and cntrl (C2) hst cntrlled by the attacker, but this phning hme is designed t lk like nrmal web brwsing traffic. Suspicius dmains where an attacker bfuscates the surce f attacks by hiding itself amng the millins f dmains and users in the rganizatin talk t. Prblem is, neither f these symptms are easy t spt using signatures r any hard and fast detective rules. Hwever, mst cvert channel activity leave behind clues that, if detected, can help t distinguish malicius frm nrmal traffic. Making a determinatin as t whether an internal r external hst is suspicius invlves cllecting and examining multiple pieces f data ver extended time perids, detecting deviatins fr regular behavirs and creating a prbability weighted risk scre based upn the results. Suspicius Internet Dmains Hide Amng Nrmal Traffic Perpetratrs f scams ften cmprmise existing hsts n the Internet, and redirect victims tward these sites t either cllect private infrmatin, r deliver malware. Many cnventinal security defenses maintain watch lists f knwn IP addresses and dmain names that hst these attacker services. Hwever, t thwart these static defenses, attackers ften use fast flux techniques, cmprmising many hsts, registering many dmains and redirecting different victims t different dmain thrugh different servers, making effective static watch lists almst impssible t cmpile and maintain. Suspicius dmains can be tricky t spt, and identificatin generally relies upn inspecting raw traffic ging t and frm thse dmains. Fr example: Number f IP addresses assciated with a dmain. Mst cnventinal dmains nly have a few IP addresses assciated with them. Malicius dmains ften have dzens f IP addresses assciated with them t evade static IP watch lists. Number f dmain name wners assciated with a DNS address. Mst cnventinal IP addresses are nly assciated with a few dmain wners. Malicius servers and dmains ften a have cmplex many-t-many system f IP addresses, t dmain hsts, and t dmain wners, s a high number f dmain wners assciated with a system is suspicius. Number f users hitting thse dmains relative t its cmplexity. A ppular dmain like Ggle r Yah, r a ppular hsting service (Amazn EC) will have lts f dmain names and IP addresses assciated with it. But then again, since it is ppular, many users will likely be accessing it. On the ther hand, a dmain that few peple are accessing, but with dzens f IP addresses and wners is mre likely t be malicius. Traffic cntent types. Mst cnventinal servers have ne r tw rles; they are either web servers, mail servers, DNS servers, etc. Suspicius dmains ften hst many services n the same server. GETS vs PUT/POSTs. Mst web servers serve up far mre cntent than peple uplad t it. Dmains where the rati f POSTs t GETs is high are mre likely malicius.

4 Similar t the beacning hst example abve relating static and fixed ratis fr these values can be highly errr prne, requiring mre advanced data science techniques t essentially identify thse utliers frm nrmal, taking int cnsideratin many indicative factrs at nce. RSA Integrates Behavir Analytics t Rapidly Identify Cmmand and Cntrl Activity Internal hsts beacning t a C2 hst at a high level lks very much like any ther http traffic, fr example, regularly plling a news site, but there are ften clues t distinguish it frm cmmunicatins activity with nrmal hsts if ne lks mre carefully. Amng thers, these indicatrs include: frequency f cmmunicatins, hw lng ag the dmain was registered, strange user agents, lack f referrer r dmains nt cnnected t very ften. By gathering and analyzing this data ver lng time hrizns and in real time defenders can identify a beacning hst s tell. RSA NetWitness Lgs and Packets Behavir Analytics C2 mdule evaluates web traffic and alerts analysts if a dmain exhibits behavirs cnsistent with a malware cmmand and cntrl server. The alerts cntain visibility int the indicatrs and cntextual data useful when respnding t an alert. RSA NetWitness Lgs and Packets Cutting Edge Techniques Keep Security Teams Ahead f Advanced Threats Nne f the analysis described abve can alne identify with certainty a cvert channel in an rganizatin. What makes this analysis tugh is the statistical analysis required acrss ALL sessins and acrss all f these measures t identify these suspicius sessins. Few systems have the underlying data, speed, r smarts t d this. Past appraches have been highly errr prne and inefficient as systems have depended n: Rules and threshld-based alerts that may wrk in ne envirnment but nt anther, r need cnstant mdificatin as web behavir evlves Highly manual appraches that rely n creating reprts f search-based results and manually sptting patterns within the results OR Vanilla Big Data systems and cuntless hurs f custmizatin getting them t cllect the right data and spt the types f behavirs described abve RSA NetWitness Lgs and Packets emplys advanced statistical methds t spt these types f attacks, plus prvides an infrastructure upn which t build ther detectin and reprting use cases. RSA NetWitness Lgs and Packets aims t: Prvide cmplete visibility t identify and investigate attacks Eliminate blind spts with visibility acrss lgs, netwrks, and endpints Inspect every netwrk, packet sessin and lg event fr threat indicatrs at time f cllectin with capture time data enrichment Augment visibility with additinal cmpliance and business cntext Detect and analyze even the mst advanced f attacks befre they can impact the business Discver attacks missed by traditinal SIEM and signature-based tls by crrelating netwrk packets, NetFlw, endpints and lgs Identify endpint malware missed by cnventinal AV in real-time

5 Start finding incidents immediately with ut f-the-bx reprting, intelligence, and rules Identify high risk indicatrs f cmprmise by harnessing the pwer f big data and data science techniques Take targeted actin n the mst imprtant incidents Instantly pivt frm incidents int deep endpint and netwrk packet detail t perfrm netwrk frensics and understand the true nature and scpe f the issue Priritize investigatins and streamline multiple analyst wrkflws in ne tl Maximize yur team s ptential by implementing RSA s best practicebased security peratins management tls and training Cnclusins T detect advanced attacks, multiple data types such as netwrk packet, lg, endpint, and clud data need t be cmbined. These data surces prvide the ability fr RSA NetWitness Lgs and Packets t discver attacks missed by lg-centric SIEM and signature-based tls with the nly slutin that can crrelate all f the needed data surces and apply advanced behaviral techniques and data science mdels. Using these advanced techniques in cmbinatin can prvide security teams with speedier detectin and all the visibility required t respnd t advanced, but cmmn attack tls that emply cvert channels with C2 threats.

Operational Security. Speaking Frankly The Internet is not a very safe place. A sense of false security... Firewalls*

Operational Security. Speaking Frankly The Internet is not a very safe place. A sense of false security... Firewalls* Operatinal Security Firewalls and Intrusin Detectin CS242 Cmputer Netwrks Speaking Frankly The Internet is nt a very safe place Frm ur netwrk administratr s pint f view, the wrld divides int tw camps: