Data Obfuscation and Field Protection in Splunk

Transcription

1 Data Obfuscation and Field Protection in Splunk Angelo Brancato Security Specialist Dirk Nitschke Senior Sales Engineer 28 September 2017 Washington, DC

2 2017 SPLUNK INC. Agenda Protect Your Machine Data The Drivers The Solution The Demo

3 2017 SPLUNK INC. Agenda Protect Your Machine Data The Drivers The Solution The Demo

4 Who we are Dirk Nitschke Senior Sales Engineer Angelo Brancato Security Specialist

5 Forward-Looking Statements During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners Splunk Inc. All rights reserved.

6 Why? Minimize Risk, Enable Business

7

8

9 Problem Validation Confidential data in events can not be shared / collected - Cross border organization - SIEM as a Service - Cloud Regulation (like GDPR, PCI, HIPAA) have strict imposts on protecting personal data

10 How? Transport Presentation & Data Layer Protection

11 Transport, Data, and Presentation Layer Protection on-site cloud Containers Online Services On-Premises Private Cloud Servers Storage Security Desktops Web Services Networks GPS Location RFID Packaged Applications Messaging Custom Applications Always-On Transport Layer Protection (TLS) Public Cloud Online Shopping Cart Smartphones and Devices Telecoms Web Clickstreams Firewall Intrusion Prevention Call Detail Records Databases Energy Meters Forwarder Indexer Search Head Splunk User Event Data Presentation Layer Protection Option 1 Event Data Data Layer Protection (In-Motion & At-Rest ) Option 2

12 Option 1: Presentation Layer Protection on-site cloud Result Masking Containers Online Services On-Premises Private Cloud Servers Storage Security Desktops Web Services Networks GPS Location RFID Packaged Applications Messaging Custom Applications Always-On Transport Layer Protection (TLS) Public Cloud Online Shopping Cart Smartphones and Devices Telecoms Web Clickstreams Firewall Intrusion Prevention Call Detail Records Databases Energy Meters Forwarder Indexer Search Head Splunk User Data as is Presentation Layer Protection Anonymization (e.g. SHA256 hash) ccn=fb415937c6f b300720cb3f2e82340a09b42b074fd13a09bc341fd a ccn= Pseudonymization (e.g. AES256 encryption) Format Preserving Pseudonymization (e.g. Format-Preserving-Encryption / Tokenization) ccn=u2fsdgvkx1+pn/g/s3axzklq+dmegbki0p4h6ge86zjupeyjlvayebfnl3xm6tyz ccn=

13 Option 2: Data Layer Protection on-site cloud Regex Replace Scheduled Search Containers Online Services On-Premises Private Cloud Servers Storage Security Desktops Web Services Networks GPS Location RFID Packaged Applications Messaging Custom Applications Always-On Transport Layer Protection (TLS) Public Cloud Online Shopping Cart Smartphones and Devices Telecoms Web Clickstreams Firewall Intrusion Prevention Call Detail Records Databases Energy Meters Forwarder Indexer Search Head Splunk User Data as is Data Layer Protection (In-Motion & At-Rest ) Anonymization (e.g. SHA256 hash) ccn=fb415937c6f b300720cb3f2e82340a09b42b074fd13a09bc341fd a ccn= Pseudonymization (e.g. AES256 encryption) Format Preserving Pseudonymization (e.g. Format-Preserving-Encryption / Tokenization) ccn=u2fsdgvkx1+pn/g/s3axzklq+dmegbki0p4h6ge86zjupeyjlvayebfnl3xm6tyz ccn=

14 Option 2: Data Layer Protection on-site cloud Modular / Batch Processing Containers Online Services On-Premises Private Cloud Servers Storage Security Desktops Web Services Networks GPS Location RFID Packaged Applications Messaging Custom Applications Optional: + Original Event Always-On Transport Layer Protection (TLS) Public Cloud Online Shopping Cart Smartphones and Devices Telecoms Web Clickstreams Firewall Intrusion Prevention Call Detail Records Databases Energy Meters Forwarder Indexer Search Head Splunk User Data as is Data Layer Protection (In-Motion & At-Rest ) Anonymization (e.g. SHA256 hash) ccn=fb415937c6f b300720cb3f2e82340a09b42b074fd13a09bc341fd a ccn= Pseudonymization (e.g. AES256 encryption) Format Preserving Pseudonymization (e.g. Format-Preserving-Encryption / Tokenization) ccn=u2fsdgvkx1+pn/g/s3axzklq+dmegbki0p4h6ge86zjupeyjlvayebfnl3xm6tyz ccn=

15 Option 2: Data Layer Protection EP (External Processor) External Processor on-site cloud Containers Online Services On-Premises Private Cloud Servers Storage Security Desktops Web Services Networks GPS Location RFID Packaged Applications Messaging Custom Applications Optional: + Original Event Always-On Transport Layer Protection (TLS) Public Cloud Online Shopping Cart Smartphones and Devices Telecoms Web Clickstreams Firewall Intrusion Prevention Call Detail Records Databases Energy Meters Forwarder Indexer Search Head Splunk User Data as is Data Layer Protection (In-Motion & At-Rest ) Anonymization (e.g. SHA256 hash) ccn=fb415937c6f b300720cb3f2e82340a09b42b074fd13a09bc341fd a ccn= Pseudonymization (e.g. AES256 encryption) Format Preserving Pseudonymization (e.g. Format-Preserving-Encryption / Tokenization) ccn=u2fsdgvkx1+pn/g/s3axzklq+dmegbki0p4h6ge86zjupeyjlvayebfnl3xm6tyz ccn=

16 What is Format Preserving Encryption? An Analogy Original Standard Encryption Format Preserving

17

18 What? Various Options to Protect Event Fields

19 Protect Field Values

20 Data Flow Application Input Pipeline Index Search User Any data source Monitor FIFO UDP/TCP HEC Scripted Modular Parsing Merging Typing Indexing RBAC Data Integrity Control OS / Device RBAC Simple XML SPL Policies Processes

21 Data Source Layer Application Application Input Pipeline Index Search User Protect data at earliest stage in the process Data source owner is responsible Application support May need a means to decode data again

22 Input Layer Modular / Batch Processing Application Input Pipeline Index Search User Pre-process data Create your own data input capabilities using a modular input Very flexible Requires scripting, programming

23 External Processor Application Input Pipeline Index Search User Ext. Proc. Forward raw data plus meta data to external processing engine Output of external processor is an input for Splunk again Very flexible but also complex

24 Built-In at Indexing Time Regex Replace Application Input Pipeline Index Search User Typing pipeline / regex replacement processor Uses SEDCMD or TRANSFORMS to modify data at indexing time Easy to implement Limited flexibility, mainly anonymization

25 Copy Events Scheduled Search Application Input Pipeline Index Search User Scheduled search selects and transforms the data SPL and custom search commands if needed Send modified events to a different index Think about collect, cefout, or a custom search command Modified events are delayed because of scheduling Preservation of event metadata

26 Presentation Layer Result Masking Application Input Pipeline Index Search User Hide data at presentation layer <your_search> eval user=sha256(user) or your own custom search command Optionally: user lockdown Pre-defined app with dashboard access only No search app, no raw search, no raw event drill down May be good enough

27 Option Layer Latency Security Complexity Usability Application Data Source Low Very High Modular / Batch External Processor Data Data Medium (API calls) Medium (API calls) Regex Replace Data Medium Scheduled Search Data Very High (schedule) Result Masking Presentation Medium Overview All Options No scientific research Medium (decoding) Medium (decoding) High High High High High High High (anonymization) Low Low (need-to-know) Low Medium Low Low (anonymization) Medium (due to latency) High

28 2017 SPLUNK INC. 1. Many possible ways each has pros and cons Summing Up 2. Qualify what are the requirements and boundary conditions 3. Data obfuscation requires a proper concept and careful planning 4. Choose and mix and keep it simple

29 How? Demo Just a Demo Your Mileage Will Vary

30 Demo Setup bar.log Pipeline secret DPO role unclassified Default role firstname, lastname, , cc, src_ip Scheduled Search, Custom Search Command

31 Demo Setup foo.log Pipeline secret DPO role Ext. Proc. unclassified Default role firstname, lastname, , cc, src_ip Clone sourcetype, transforms, output as raw Modify Events, send to HEC SEDCMD

32 Original Events 2017 SPLUNK INC.

33 2017 SPLUNK INC. Processed Events Masked critical data

34 2017 SPLUNK INC. Workflow Action Decode field values from the UI

35 Decoding Dashboard 2017 SPLUNK INC.

36 2017 SPLUNK INC. Custom Search Command Encoding and decoding

37 2017 SPLUNK INC. Decryption Command Usage Track usage of critical commands

38 2017 SPLUNK INC. Common Dashboard Privileged view

39 2017 SPLUNK INC. Common Dashboard Normal view

40 2017 SPLUNK INC. Enterprise Security Normal view

41 2017 SPLUNK INC. Enterprise Security Normal view

42 2017 SPLUNK INC. Enterprise Security Normal view

43 2017 SPLUNK INC. Enterprise Security Normal view

44 2017 SPLUNK INC. Enterprise Security Normal view

45 Q&A Angelo Brancato Security Specialist Dirk Nitschke Senior Sales Engineer

46 2017 SPLUNK INC. Thank You Don't forget to rate this session in the.conf2017 mobile app