Download - Actionable Big Data
Actionable Big Data AusCERT 2014
Tyson Garrett
2
About Me
About Arbor
InternalNetwork"
Enterprise Assets"
Enterprise Perimeter"
" GlobalNetwork"
Threats"
Identify"
Understand"
Act"
4
So what is Big Data?
5
What is Big Data?
Well it’s not hadoop-jar
6
What is Big Data
Big data is the term for a collection of data sets so large and complex that it becomes difficult to process using on-hand database management tools or traditional data processing applications. The challenges include capture, curation, storage, search, sharing, transfer, analysis and visualization. - Wikipedia
7
What is Big Data
Another way of putting it could be:
Information that we can’t put into our traditional database and/or is difficult to access.
8
What is Actionable Big Data
From a security perspective: Providing a security analyst with relevant information as quickly and easily as possible
9
But what about Security Information and Event Management (SIEM’s)?
10
Rows and Columns of Threats
11
Are more reports helping us perform effective Incident Response?
Do We Need More Events, Or Better Events? • At Boston Medical Center they were experiencing 12,000
alarms a day, on average. That kind of cacophony was producing a growing problem known as "alarm fatigue.” – "Alarm fatigue is when there are
so many noises on the unit that it actually desensitizes the staff”
• "If you have multiple, multiple alarms going off with varying frequencies, you just don't hear them" – This can lead to a dangerous situation where patients can die
when an important alarm is missed, or an electrode on a patient's chest comes unstuck, or a monitor's battery goes dead.
13
What about my Next Gen, Cloud, Anti APT, Threat Protection Firewall System?
14
TRADITIONAL DEFENSES ARE NOT DESIGNED FOR ADVANCED THREATS
Firewalls and Intrusion Prevention Systems (IPS) operate in real time, and have only one chance in a timeframe of 5-8 microseconds to prevent an attack.
Attack Traffic Good Traffic
ISP
Firewall IPS
Target Applications &
Services
Firewalls and Intrusion Prevention
15
So what do we need to see?
16
We need to see Attack Timelines
17
Zoom from months and years to seconds
18
IP Address and Port Details aren’t enough
19
We need to know what's exactly going on
20
We need to understand who is involved
21
We need to be able to replay attacks
22
We need to be able to replay attacks
23
How do we do this?
24
Packet Capture or it didn’t happen….. • Full Packet Capture is the richest
source of data but it isn’t BIG DATA • Contains ALL of the network data, and can be taken
from ANYWHERE in the network via TAP or SPAN • Can be processed whenever you like – years later or
as a real time stream • Security analytics content derived from each capture
is cumulative, building a long running history of searchable and comparable attack data…this is BIG DATA
• Like CCTV for your network – Play, Pause and Rewind your data
• Enables base lining of metrics between data sets and trend comparison of different periods
25
Big Data Security Analytics 101 • Ability to store huge amounts of PCAPs • Ability to read historical files or process real time
streams • Need to be able to perform many hundreds of
operations on the data in parallel
26
Big Data Security Analytics 101 • Need to be able to store the outcome of these
operations in such a way that they can be quickly searched or updated
• Need to quickly extract the attack data from the rest of the packets
• Search must be latency free, independent of PCAP size.
27
We are 100% secure….are you sure? • How can you look back in time to
confirm what you didn’t know then?
• Assume has happened previously, how can you prove it?
• How do you confirm exact intent and impact?
• How do you learn from the past to improve your future security posture?
28
Learning from the past “Those who do not remember the past are
condemned to repeat it.” George Santayana
• Find out if an attacker used a zero day attack previously • Find out what systems were compromised • Find out what happened next?
– What other systems were compromised laterally – What data was accessed – What data was exfiltrated
• Find out if the attacker is still active, still in your network • Understand the effectiveness of existing controls • Understand what new controls are required
29
And we need to see context
30
We need to see context
31
Were you affected by Heartbleed? • So you have patched all your OpenSSL based systems. Is that it?
• Heartbleed could have been used against you before you applied the necessary updates, or even before the vulnerability became known to the public
• There are no application layer logs that would allow you to check if you were attacked or what data was stolen
• Any sensitive data stored in server memory could be disclosed to attacker
– Private SSL keys – Unencrypted passwords – Business critical documents
32
Looping for Zero Day A0acks such as Heartbleed
Week 1 Traffic Week 2 Traffic Week 3 Traffic
Total Analytics data after 1 week
Total Analytics data after 2 weeks
Total Analytics data after 3 weeks
Heartbleed attack here
Detection capability update but without signature for the Heartbleed attack
Detection capability update INCLUDING signature for the Heartbleed attack
Detection capability updates occur at different times. ALL traffic stored is replayed through latest detection capability automatically
All Traffic Looped – Heartbleed not found
All Traffic Looped – Heartbleed FOUND Now that Heartbleed attack has been identified, the attack timeline can be established
33
Heartbleed Demo
This is a reminder for me to Cmd-Tab to Chrome
34
But I’m a nerd/geek and wanted to see references to Anscombe’s Quartet
- Google/Bing/AskJeeves/W3Catalog ‘finding
needles in haystacks the size of countries’ Or
- https://bitly.com/bundles/packetloop/1
Thank you!
For comments and sugges<ons please contact: [email protected]
36