Increase Threat Detection & Incident Response

Transcription

1 Martin Rudd Carrier Scale Network Security: Increase Threat Detection & Incident Response copyright 2017 by Telesoft Technologies. All rights reserved.

2 Agenda Brief bio Threat presence in network Stakeholder teams Carrier cyber questions to Use cases Cryptojacking Multi-vector attack BGP-FS mitigation Round up

3 Bio Product leader: Carrier scale cyber security Government and national security Telecoms (IP core) & fixed line Hardware-accelerated platforms (FPGA) Software and NFV products (COTS hardware) Highly scalable mesh/grid computing Petabyte data, ML algo design, analytics Background: equities & derivatives trading, 3d physics Telesoft - R&D company established in 1989

4 Threat presence SITE C SITE D SITE B SITE A SERVICES / APPLICATIONS SITE E LOGICAL NETWORK USER EQUIPMENT PHYSICAL NETWORK NAT INTERNET NAT adds complexity

5 Stakeholder teams NetOps Incident management Forensics Incident management SecOps Network health Forensic investigations Incident response Storage & analytics Incident intel/detection SOC Flow metadata (often sampled) SIEM IPFIX Collector Flow metadata (often sampled) Alerts & logs Alerts & logs ROUTING LAYER NETWORK SERVICE LAYER IPS/IDS/FW

6 Carrier cyber High line rates Scalability in large blocks (200Gbps) Ground up NOT top down Don t compromise (i.e. sample) Carrier owns the playing field Visibility at N x 100Gbps and N x Tbps Availability and latency of tools Multiple concurrent multi-vector attacks are the norm Sub second alerts & responses required for effective SecOps Carrier vs small enterprise tools Automated triage/severity Differentiate the targets but group the attacks Know and classify attacker Layered threat classification approach

7 Carrier cyber Network Multiple site mesh topologies What to protect? Logical, physical and virtual network assets Network zones/segregations Customers & peers Multiple UE access points Often limited pinch points to defend Network can be a mesh defence (BGP-FS) Beware of cyber CAPEX and OPEX Carrier owns the playing field You know what you want to protect! Classify/tag and analyse assets and customers by IP, CIDR, domain, VLAN, protocol, aka Entity sets Discover network topologies Carrier as provider of: Traffic IP classification is diverse Huge volumes of threats Infrastructure Subject to protocol misuse (OSI L4 & L7, DNS) Platform must always be up to date with latest intel, rules, reputations Bespoke threats e.g. DNS One-off large flow DNS tunnelling Continual large flows DNS misuse

8 Entity sets VNO SERVICES / APPLICATIONS VoIP Mirai LOGICAL NETWORK Hajime ZeuS PHYSICAL NETWORK LAN Reaper IMEI Subscribers & users Network and services Internet, CNI & Operational Technology Discover/categorise threat networks, determine capability, defend at a high level

9 Carrier cyber Endpoints Group to simplify picture (physical link, customer, manufacturer, ) Schrödinger's UE subscriber value Millions - user equipment and internal endpoints Blocking threats is both political and technical NATting (IoT esims) Protect own assets Security as a service (customers & peers) Brand value protection Network threat density Accuracy and severity is key Need to know who did what IoT misuse costs money (hardware misuse) Cross-NAT and subscriber activity correlation Botnets and zombies as entity sets Both compromised UE and internet threat networks Map attack capability (aggressive defence) Bandwidth = money

10 Use case: Cryptojacking Coinhive Router ARP poisoning NETWORK JavaScript / HTTP miner injection flows Hash result flows Flow reputation Network zone transgression Anomalous activity

11 Use case: Multi-vector attack The actual threat: Data exfiltration via DNS tunnel Threats identified Threats classified Related physical & logical network components Single click pivot DDoS SYN Flood DDoS UDP Flood Botnet C2 flows DDoS is decoy

12 Use case: BGP Flow Spec TAPPED TRAFFIC Detection engine BGP-FS rule Routing infrastructure 5 3 TARGET 1. Early DDoS attack flows 2. Anomaly detected to target (< 1s) 3. Remotely Triggered BlackHole (RTBH) route instruction sent using BGP-FS 4. Main attack goes to RTBH Target service maintained

13 Round up Tune tools for SecOps, NetOps and forensics but don t compromise (e.g. sampling, reduced threat visibility) Group (provision and auto-discover) Logical and physical assets Customers and peers Botnets & zombies, high density threat networks Multi-vector attacks (differentiate targets) Automate triaging of threat & attack severity It s your playing field: Use your own network as a mesh defence Sub second alerting and querying

14 Products NetOps Forensics Incident management SecOps Network health GUI/REST API Forensic investigations GUI/REST API Incident response SOC TDAC Alerts Kafka/syslog/JSON SIEM Flow metadata (un-sampled) Alerts JSON FlowProbe CERNE Alerts Kafka/syslog/JSON BGP-FS NAT NETWORK ShuntProbe*

15 Products TDAC FlowProbe 2 x 100GbE in 1U Un-sampled & enriched flow records 150M concurrent flows De-tunnelling (GTP, GRE, MPLS, IPinIP) L7 visibility Variants include 10 x 10GbE Options for cross-nat and subscriber correlation Analytics & storage Millions of events/s, petabyte scale Sub-second alert & query latency Government standard application security Mirror network & stakeholders CERNE 4 x 10GbE IDS + packet recorder (Suricata/Snort) Generates alerts and PCAPs 2.4s back in time buffer

16 DEMOS AND EVALS AVAILABLE EUROPE Worldwide Headquarters Telesoft Technologies Ltd Observatory House, Stour Park Blandford Dorset DT11 9LQ UK t. +44 (0) f. +44 (0) e. NORTH AMERICA Sales and Support Telesoft Technologies Inc. 430 National Business Parkway Suite 480 Annapolis Junction, MD USA e. ASIA Sales and Support Telesoft Technologies Ltd Tapasya Corp Heights Ground Floor, Sector 126 Noida, Uttar Pradesh INDIA t f e.