Implementing Cisco Cyber Security Operations

2019 CLUS Implementing Cisco Cyber Security Operations

Paul Ostrowski / Patrick Lao / James Risler Cisco Security Content Development Engineers

LTRCRT-2222

2019 CLUS Cisco Webex Teams

Questions? Use Cisco Webex Teams to chat with the speaker after the session How 1 Find this session in the Cisco Live Mobile App 2 Click “Join the Discussion” 3 Install Webex Teams or go directly to the team space 4 Enter messages/questions in the team space

Webex Teams will be moderated cs.co/ciscolivebot#LTRCRT-2222 by the speaker until June 16, 2019.

• Goals and Objectives

• Prerequisite Knowledge & Skills (PKS)

• Introduction to Security Onion

• SECOPS Labs and Topologies

• Access SECFND / SECOPS eLearning Lab Training Environment

• Lab Evaluation

• Cisco Cybersecurity Certification and Education Offerings

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 4 Goals and Objectives: • Today's organizations are challenged with rapidly detecting cybersecurity breaches in order to effectively respond to security incidents. Cybersecurity provides the critical foundation organizations require to protect themselves, enable trust, move faster, add greater value and grow. • Teams of cybersecurity analysts within Security Operations Centers (SOC) keep a vigilant eye on network security monitoring systems designed to protect their organizations by detecting and responding to cybersecurity threats.

• The goal of Cisco’s CCNA Cyber OPS (SECFND / SECOPS) courses is to teach the fundamental skills required to begin a career working as an associate/entry-level cybersecurity analyst within a threat centric security operations center.

• This session will provide the student with an understanding of Security Onion as an open source network security monitoring tool (NSM). The student will also explore common attack vectors, malicious activities, and patterns of suspicious behaviors typically encountered within a threat- centric Security Operation Center (SOC).

• We will provide you 30 days of continued access to the SECFND and SECOPS Training Portal.

• This training is NOT focused on Cisco’s family of security products and solutions.

• This topic lists the skill, knowledge, and attitudes that students must possess to benefit fully from the labs. It includes recommended Cisco learning offerings that the learner may complete to benefit fully from the labs.

• Recommended Prerequisite Skills

• The knowledge, skills, and attitudes that a student is expected to have before attending this course are as follows:

• Understanding Cisco Cybersecurity Fundamentals (SECFND)

• Learning Resources for Prerequisite Skills

• Cisco learning offerings that contribute to recommended knowledge, skills, and attitudes:

• CCNA Cyber Ops SECFND #210-250 Official Cert Guide, by Omar Santos, Joseph Muniz, Stefano De Crescenzo

• CCNA Cyber Ops SECOPS #210-255 Official Cert Guide, by Omar Santos, Joseph Muniz

Cisco 2018 Annual Cybersecurity Report Highlights The Cisco 2018 Annual Cybersecurity Report, highlights findings and insights derived from threat intelligence and cybersecurity trends observed over the past 12-18 months from threat researches and six technology partners: Anomali, Lumeta, Qualys, Radware, SAINT, and TrapX.

Also, included in the report are results of the annual Security Capabilities Benchmark Study (SCBS), which this year surveyed 3,600 chief security officers (CSOs) and security operations (SecOps) managers from 26 countries about the state of cybersecurity in their organizations.

The financial cost of attacks is no longer a hypothetical number:

• According to study respondents, more than half of all attacks resulted in financial damages of more than US $500,000, including, but not limited to, lost revenue, customers, opportunities, and out- of-pocket costs.

Source: https://newsroom.cisco.com/press-release-content?type=webcontent&articleId=1911494

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 10 Cisco 2018 Annual Cybersecurity Report Highlights Supply chain attacks are increasing in velocity, complexity These attacks can impact computers on a massive scale and can persist for months or even years. Defenders should be aware of the potential risk of using software or hardware from organizations that do not appear to have a responsible security posture.

• Two such supply chain attacks in 2017, Nyetya and Ccleaner, infected users by attacking trusted software.

o Nyetya (also known as NotPetya) arrived in June 2017 This wiper malware also masqueraded as ransomware and it used the remote code execution vulnerability nicknamed “EternalBlue,” as well as the remote code execution vulnerability “EternalRomance” (also leaked by Shadow Brokers), and other vectors involving credential harvesting

o Ccleaner arrived in September 2017, involved the download servers used by a software vendor to distribute a legitimate software package known as CCleaner.7 CCleaner’s binaries, which contained a Trojan backdoor, were signed using a valid certificate, giving users false confidence that the software they were using was secure.

Source: https://newsroom.cisco.com/press-release content?type=webcontent&articleId=1911494

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 Cisco 2018 Annual Cybersecurity Report Highlights Security is getting more complex, scope of breaches is expanding Defenders are implementing a complex mix of products from a cross-section of vendors to protect against breaches. This complexity and growth in breaches have many downstream effects on an organization's ability to defend against attacks, such as increased risk of losses.

• In 2017, 25 percent of security professionals said they used products from 11 to 20 vendors, compared with 18 percent of security professionals in 2016.

• Security professionals said 32 percent of breaches affected more than half of their systems, compared with 15 percent in 2016.

Trends in malware volume have an impact on defenders' time to detection (TTD)

• The Cisco median TTD of about 4.6 hours for the period from November 2016 to October 2017 — well below the 39-hour median TTD reported in November 2015, and the 14-hour median reported in the Cisco 2017 o Annual Cybersecurity Report for the period from November 2015 to October 2016. • The use of cloud-based security technology has been a key factor in helping Cisco to drive and keep its median TTD to a low level. Faster TTD helps defenders move sooner to resolving breaches.

Source: https://www.cisco.com/c/dam/m/digital/elq- cmcglobal/witb/acr2018/acr2018final.pdf?dtid=odicdc000016&ccid=cc000160&oid=anrsc005 679&ecid=8196&elqTrackId=686210143d34494fa27ff73da9690a5b&elqaid=9452&elqat=2

• A Network Security Monitoring (NSM) tool is software that collects, maintains, processes, and presents network security monitoring data (security related events).

• The Security Operations Center (SOC) analyst will examine data produced by the network security monitoring tool. Without NSM data, SOC analysts could not perform their job effectively. Without NSM tools, SOC analysts would not have network data to analyze.

• An NSM can enhance network visibility by using context-rich telemetry and threat-based intelligence collected from within the network infrastructure.

• Security Onion is an open source Linux distribution that focuses on NSM. Security Onion is used for log management, intrusion detection and network security event monitoring. The distribution is managed by Security Onion Solutions. Many of the tools that comprise the Security Onion NSM have broad community support.

• Security Onion Solutions provides a straightforward package to install the network security monitoring space. Security Onion Solutions also offers training and support services for the distribution.

• Security Onion can be deployed as a simple standalone system where one network interface card (NIC) is used for management and one or more additional NICs are used for monitoring security events on the network.

• Security Onion can also scale using a distributed deployment where one system acts as the master server and the monitoring duties are spread across multiple sensor systems.

• Full packet captures: • Netsniff-ng

• Network-based (NIDS) and Host-based (HIDS) Intrusion Detection Systems: • NIDS: • Rules-driven NIDS Alerts from Snort or Suricata in passive mode (not NIPS inline mode) • Analysis-driven NIDS from Zeek (Bro) Network Security Monitor (traffic is captured via SPAN, TAP port or packet broker)

- Zeek v2.6.2 (Bro) is a protocol parsing engine that provides three key network security capabilities: Traffic Logging (generates comprehensive, protocol specific network traffic logs for 35+ protocols: DNS, HTTP, files), Automated Analysis (traffic analysis using Bro scripts), and File Extraction (extracts & re-assembles any file type off the wire) • HIDS: Wazuh (wah-zoo) replaced OSSEC and is used to monitor/defend Security Onion. Add Wazuh agents to endpoint hosts

• Syslog data received by Zeek (Bro) or syslog-ng

• Powerful Data Analysis Tools:

• Sguil Analyst Console / Squert PHP Web Interface / Kibana (Squert & Kibana can pivot to CapMe to retrieve full packet captures) • Wireshark • NetworkMiner • ELSA / Elastic Stack® (ELK)

• CyberChef Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/IntroductionToSecurityOnion

The Security Onion architecture is more robust than is conveyed in the figure above. The figure serves to introduce the complexity of and interactions between the NSM tools in Security Onion. The tools in the bottom row are largely dedicated to the collection and production of raw NSM data. The tools/components in the middle row are associated with the optimization and maintenance of the data. For example, Zeek (Bro), Wazuh (OSSEC), and syslog-ng all produce flat files with one log entry per line. The ELSA system takes this raw data and organizes it into a relational MySQL database, using high-performance Sphinx indexing. The tools listed in the top row are responsible for the presentation of the data to the SOC analyst.

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 Security Onion with Elastic Stack® Security Onion Migrated from ELSA to the Elastic Stack® (“Hybrid Hunter”) The new Elastic Stack® components are comprised from Docker container images based on CentOS 7: Elastic Stack® Core Components: Elastic Stack® Auxiliary Components: Beats® - lightweight data shipper server agent Curator - Manage indices through scheduled maintenance. that sends specific types of operational data to Logstash and Elasticsearch ElastAlert - Query Elasticsearch and alert on user-defined anomalous behavior or other interesting bits of information. Logstash® - Data ingestion engine, parsing and format logs. FreqServer -Detect DGAs and find random file names, script names, process names, service names, workstation names, Elasticsearch® - Ingest and index logs, large TLS certificate subjects and issuer subjects, etc. scalable search engine based on Apache Lucene. DomainStats - Get additional info about a domain by providing Kibana® - offers web based visualizations of additional context, such as creation time, age, reputation, etc. ingested log data and data exploration. ELSA reached End Of Life status on October 9, 2018. Security Onion will not provide any updates or support for ELSA. Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Elastic-Architecture

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 17 Security Onion with Elastic Stack® A Very Brief Introduction to Linux (Docker) Containers Linux containers are standalone, lighter virtualization alternatives to virtual machines that include code, system tool libraries, and settings in a ‘portable’ capsule or bottle. • Containers are isolated from each other and bundle their own application, tools, libraries, and configuration files. • Containers can communicate with each other through overlay network subsystems. • All containers are run by a single host operating-system kernel and are thus, more lightweight than virtual machine images. Containers rely on the host kernel's functionality and use resource isolation for CPU and memory resources and separate namespaces to isolate the application's view of the operating system. • Unlike a virtual machine image, which requires a hypervisor (VMware, Virtual Box), containers do not utilize a hypervisor. Containers are created from images that can either be stateful (using persistent storage) or stateless. • Why the change from Ubuntu DEB packages (used in Security Onion) to Docker images? o Docker images are easier to build & maintain and will allow support for other distros, like CentOS. Fun Fact: there is no formal definition of a Linux “container.” Most people identify a Linux container with keywords like: LXC, libvirt, Docker, Kubernetes, namespaces, cgroups, CoreOS rkt, BDS jails, Zones

Source: https://en.wikipedia.org/wiki/Docker_(software)

• argus - http://www.qosient.com/argus/ "Argus is a data network transaction auditing tool that categorizes network packets that match the libpcap filter expression into a protocol-specific network flow transaction model. Argus reports on the transactions that it discovers, as periodic network flow data, that is suitable for historical and near realtime processing for forensics, trending and alarm/alerting."

• barnyard2 - http://www.securixlive.com/barnyard2/ "Barnyard2 is an open source interpreter for Snort unified2 binary output files. Its primary use is allowing Snort to write to disk in an efficient manner and leaving the task of parsing binary data into various formats to a separate process that will not cause Snort to miss network traffic."

• Bro (Zeek) - http://zeek.org/ ”Zeek (Bro) provides a comprehensive HIDS/NIDS platform for network traffic analysis." https://github.com/Security-Onion-Solutions/security-onion/wiki/Bro

• CapME - http://chaosreader.sourceforge.net/ CapMe will download a pcap file and view a pcap transcript rendered with tcpflow and Zeek (Bro) (especially helpful for dealing with gzip encoding)

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 Security Onion / Open Source Tools • chaosreader - http://chaosreader.sourceforge.net/ "Chaosreader is a freeware tool to fetch application data from snoop or tcpdump logs. Supported protocols include TCP, UDP, IPv4, IPv6, ICMP, telnet, FTP, HTTP, SMTP, IRC, X11, and VNC.”

• CyberChef - https://github.com/gchq/CyberChef / https://gchq.github.io/CyberChef Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis -

• Daemonlogger - http://www.snort.org/snort-downloads/additional-downloads#daemonlogger "Daemonlogger™ is a packet logger and soft tap developed by Martin Roesch."

• driftnet - http://www.ex-parrot.com/~chris/driftnet/ "Driftnet is a program which listens to network traffic and picks out images from TCP streams it observes.”

• dsniff - http://www.monkey.org/~dugsong/dsniff/ "dsniff is a collection of tools for network auditing and penetration testing. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active monkey-in-the-middle attacks against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI."

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 Security Onion / Open Source Tools • Elastic Stack® (ELK) - https://www.elastic.co/ The Elastic Stack® consists of Beats®, Elasticsearch®, Logstash®, and Kibana® and replaces ELSA within Security Onion. Also included is Curator, DomainStats, ElastAlert and FreqServer.

• ELSA - https://github.com/mcholste/elsa / https://github.com/Security-Onion-Solutions/security-onion/wiki/ELSA "ELSA is a centralized syslog framework built on Syslog-NG, MySQL, and Sphinx full-text search. It provides a fully asynchronous web-based query interface that normalizes logs and makes searching billions of them for arbitrary strings as easy as searching the web. ELSA reached End Of Life status on October 9, 2018. Security Onion will not provide any updates or support for ELSA.

• hping - http://www.hping.org/ "hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features."

• hunt - https://packetstormsecurity.com/sniffers/hunt/ "Advanced packet sniffer and connection intrusion. Hunt is a program for intruding into a connection, watching it and resetting it. Note that hunt is operating on Ethernet and is best used for connections which can be watched through it. However, it is possible to do something even for hosts on another segments or hosts that are on switched ports."

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 22 Security Onion / Open Source Tools • labrea - http://labrea.sourceforge.net/labrea-info.html "LaBrea takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet.

• mergecap - http://www.wireshark.org/docs/man-pages/mergecap.html "Mergecap is a program that combines multiple saved capture files into a single output file specified by the -w argument. Mergecap knows how to read libpcap capture files, including those of tcpdump, Wireshark, and other tools that write captures in that format."

• Netsed - http://silicone.homelinux.org/projects/netsed "The network packet altering stream editor NetSED is small and handful utility designed to alter the contents of packets forwarded thru your network in real time. It is really useful for network hackers in following applications: black-box protocol auditing - whenever there are two or more proprietary boxes communicating over undocumented protocol (by enforcing changes in ongoing transmissions, you will be able to test if tested application is secure), fuzz-alike experiments, integrity tests - whenever you want to test stability of the application and see how it ensures data integrity, other common applications - fooling other people, content filtering, etc etc - choose whatever you want to. It perfectly fits ngrep, netcat and tcpdump tools suite."

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

• netsniff-ng - http://netsniff-ng.org/ "netsniff-ng is a free, performant Linux networking toolkit.” / https://github.com/Security-Onion- Solutions/security-onion/wiki/netsniff-ng

• NetworkMiner - http://www.netresec.com/?page=NetworkMiner "NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows. NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files."

• ngrep - http://ngrep.sourceforge.net/ "ngrep strives to provide most of GNU grep's common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets. It currently recognizes IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop."

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

• OSSEC (Wazuh) - http://www.ossec.net/ / https://github.com/Security-Onion-Solutions/security-onion/wiki/Wazuh "OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.”

• p0f - http://lcamtuf.coredump.cx/p0f3/ "P0f is a tool that utilizes an array of sophisticated, purely passive traffic fingerprinting mechanisms to identify the players behind any incidental TCP/IP communications (often as little as a single normal SYN) without interfering in any way. Version 3 is a complete rewrite of the original codebase, incorporating a significant number of improvements to network- level fingerprinting, and introducing the ability to reason about application-level payloads (e.g., HTTP)."

• Reassembler - http://isc.sans.edu/diary.html?storyid=13282 "If you provide reassembler.py with a pcap that contains fragments, it will reassemble the packets using each of the 5 reassembly engines and show you the result."

• scapy - http://www.secdev.org/projects/scapy/ "Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f, etc.). It also performs very well at a lot of other specific tasks that most other tools can't handle, like sending invalid frames, injecting your own 802.11 frames, combining technics (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, ...), etc."

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

• sguil - http://sguil.sourceforge.net/ / https://github.com/Security-Onion-Solutions/security-onion/wiki/Sguil "Sguil (pronounced sgweel) is built by network security analysts for network security analysts. Sguil's main component is an intuitive GUI that provides access to realtime events, session data, and raw packet captures. Sguil facilitates the practice of Network Security Monitoring and event driven analysis. The Sguil client is written in tcl/tk and can be run on any operating system that supports tcl/tk (including Linux, BSD, Solaris, MacOS, and Win32).”

• Sniffit - http://sniffit.sourceforge.net/ "SniffIt is a Distribted Sniffer System, which allows users to capture network traffic from an unique machine using a graphical client application. This feature is very useful in switched networks, where traditional sniffers only allow users to sniff their own network traffic."

• Snort - http://www.snort.org/ / https://github.com/Security-Onion-Solutions/security-onion/wiki/Snort "Snort® is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and nearly 400,000 registered users, Snort has become the de facto standard for IPS."

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

• Squert - http://www.squertproject.org/ / https://github.com/Security-Onion-Solutions/security-onion/wiki/Squert "Squert is a web application that is used to query and view event data stored in a Sguil database (typically IDS alert data). Squert is a visual tool that attempts to provide additional context to events through the use of metadata, time series representations and weighted and logically grouped result sets. The hope is that these views will prompt questions that otherwise may not have been asked."

• ssldump - http://www.rtfm.com/ssldump/ "ssldump is an SSLv3/TLS network protocol analyzer. It identifies TCP connections on the chosen network interface and attempts to interpret them as SSLv3/TLS traffic. When it identifies SSLv3/TLS traffic, it decodes the records and displays them in a textual form to stdout. If provided with the appropriate keying material, it will also decrypt the connections and display the application data traffic."

• sslsniff - http://www.thoughtcrime.org/software/sslsniff/ "sslsniff is designed to create man-in-the-middle (MITM) attacks for SSL/TLS connections, and dynamically generates certs for the domains that are being accessed on the fly. The new certificates are constructed in a certificate chain that is signed by any certificate that is provided. sslsniff also supports other attacks like null-prefix or OCSP attacks to achieve silent interceptions of connections when possible."

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 27 Security Onion / Open Source Tools Suricata - http://www.openinfosecfoundation.org/index.php/download-suricata https://github.com/Security-Onion-Solutions/security-onion/wiki/Suricata "The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field."

• tcpdump - http://www.tcpdump.org/ "Tcpdump prints out a description of the contents of packets on a network interface that match the boolean expression. It can also be run with the -w flag, which causes it to save the packet data to a file for later analysis, and/or with the -r flag, which causes it to read from a saved packet file rather than to read packets from a network interface. In all cases, only packets that match expression will be processed by tcpdump."

• tcpick - http://tcpick.sourceforge.net/ "tcpick is a textmode sniffer libpcap-based that can track, reassemble and reorder tcp streams. Tcpick is able to save the captured flows in different files or displays them in the terminal, and so it is useful to sniff files that are transmitted via ftp or http. It can display all the stream on the terminal, when the connection is closed in different display modes like hexdump, hexdump + ascii, only printable charachters, raw mode and so on. Available a color mode too, helpful to read and understand better the output of the program. Actually it can handle several interfaces, including ethernet cards and ppp. It is useful to keep track of what users of a network are doing, and is usable with textmode tools like grep, sed, awk."

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 28 Security Onion / Open Source Tools • tcpreplay - http://tcpreplay.synfin.net/ "Tcpreplay is a suite of GPLv3 licensed tools written by Aaron Turner for UNIX (and Win32 under Cygwin) operating systems which gives you the ability to use previously captured traffic in libpcap format to test a variety of network devices. It allows you to classify traffic as client or server, rewrite Layer 2, 3 and 4 headers and finally replay the traffic back onto the network and through other devices such as switches, routers, firewalls, NIDS and IPS's. Tcpreplay supports both single and dual NIC modes for testing both sniffing and inline devices."

• tcpslice - http://sourceforge.net/projects/tcpslice/ "tcpslice is a tool for extracting portions of packet trace files generated using tcpdump's -w flag. It can combine multiple trace files, and/or extract portions of one or more traces based on time.”

• tcpstat - http://www.frenchfries.net/paul/tcpstat/ "tcpstat reports certain network interface statistics much like vmstat does for system statistics. tcpstat gets its information by either monitoring a specific interface, or by reading previously saved tcpdump data from a file."

• tcpxtract - http://tcpxtract.sourceforge.net/ "tcpxtract is a tool for extracting files from network traffic based on file signatures."

Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 29 Security Onion / Open Source Tools • tshark - http://www.wireshark.org/docs/man-pages/tshark.html "TShark is a network protocol analyzer. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. TShark's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools."

• u2boat - http://www.snort.org/ Part of Snort, u2boat converts unified2 files to pcaps.

• u2spewfoo - http://www.snort.org/ Part of Snort, u2spewfoo converts unified2 files to text.

• Wireshark - http://www.wireshark.org/ "Wireshark is a GUI based network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. Wireshark's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools."

• Xplico - http://www.xplico.org/ / https://github.com/Security-Onion-Solutions/security-onion/wiki/Xplico "The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer. Xplico is an open source Network Forensic Analysis Tool (NFAT)." Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/Tools

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 30 SECOPS Labs and Topologies Available SECOPS Labs: Discovery Lab 1: Topic 2.11 – Explore Network Security Monitoring Tools Discovery Lab 2: Topic 3.14 – Investigate Hacker Methodology Discovery Lab 3: Topic 4.11– Hunt Malicious Traffic Discovery Lab 4: Topic 5.7 – Correlate Event Logs, PCAPs, and Alerts Discovery Lab 5: Topic 6.11– Investigate Browser-Based Attacks Discovery Lab 6: Topic 7.7 – Analyze Suspicious DNS activity Discovery Lab 7: Topic 8.6 – Investigate Suspicious Activity Using Security Onion Discovery Lab 8: Topic 9.4– Investigate APT Discovery Lab 9: Topic 10.6– Explore SOC Playbooks

Lab Introduction: SOC analysts have many security monitoring tools at their disposal. Each SOC will have their own suite of tools and each analyst will assemble their own suite of supplementary tools. In this lab, the extensive set of tools from the Security Onion Linux distribution will be utilized. Security Onion is a Linux distro for intrusion detection, network security monitoring, and log management. It’s based on Ubuntu and contains Snort, Suricata, Zeek (Bro), OSSEC, Sguil, Squert, ELSA, CapMe, CyberChef, NetworkMiner, and many other security tools.

Tasks to Accomplish: • Execute a replay of a previously captured PCAP traffic sample to simulate a security event • Utilize Sguil to analyze alerts from PCAP traffic file • Pivot from Sguil to Wireshark in order to extract a transferred file • Conduct malware analysis and submit sample to Malwr.com and VirusTotal

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 34 SECOPS Discovery Lab 2: Topic 3.14 – Investigate Hacker Methodology Lab Introduction: A SOC analyst will examine data from a myriad of network and client devices throughout a typical day. Attackers remain persistent in their efforts, which can increase the volume of traffic that needs to be analyzed. Analysts will have access to wide variety of tools used to investigate alerts and incidents. These tools will originate from various sources, including commercial, open-source, and internally developed “custom” scripting tools. Tasks to Accomplish: • Explore the capabilities of tools bundled within the Security Onion Linux distribution • Tools Utilized: Sguil, ELSA, Wireshark, Zeek (Bro), and NetworkMiner to investigate various stages of the kill chain model pivoting between Sguil, ELSA and Wireshark.

• Transition between the Attacker and SOC Analyst roles throughout the lab • Conduct network scans to identify open ports and vulnerable services • Utilize a browser exploit against a target host and examine the corresponding triggered alerts • Conduct host based analysis and identify data exfiltration

Lab Introduction: Every organization should manually initiate routine inspection and monitoring of their network. Zero-day exploits and new/undisclosed vulnerabilities require proactive network security monitoring to identify threats which do not have defined IPS signatures. Intrusion detection systems alone will not identify and alert on all malicious activity. SOC Analysts have to develop defense in-depth strategies to identify zero-day exploits. SOC analysts also need to be able to perform behavior based analytics to assist with searching for evidence indicating unauthorized activities from insider threats.

Tasks to Accomplish: • Utilize behavior based search analytics to identify potential insider threat activities • Generate simulated traffic to populate data repositories within Security Onion’s tools • Utilize ELSA to actively search for malicious traffic • Perform analysis on suspected exfiltrated data and confirm existence of a Backdoor threat.

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 38 SECOPS Discovery Lab 4: Topic 5.7– Correlate Event Logs, PCAPS, and Alerts Lab Introduction: “The more threat vectors that go unnoticed and the longer attackers are permitted time to exploit network systems and critical infrastructure, the greater their chance for conducting a successful attack campaign”. Security information and event management (SIEM) technology is used in many enterprise organizations to provide real time reporting and long term analysis of security events. A SIEM provides a comprehensive view of the enterprise network using the following functions: • Log collection of event records from sources throughout the organization provides important forensic tools and helps to address compliance reporting requirements. • Normalization maps log messages from different systems into a common data model, enabling the security organization to connect and analyze related events, even if they are initially logged in different source formats. • Correlation links logs and events from disparate systems or applications, speeding detection of and reaction to security threats. NOTE: Event normalization and correlation are important activities that can streamline the workflow of a SOC analyst. Tasks to Accomplish: • Utilize Security Onion Sguil and ELSA applications as a security information and event monitoring (SIEM) platform to identify potential malicious activity. • Examine OSSEC alerts in Sguil indicating Windows event & audit logs were cleared • Examine two innocuous alerts and correlate the corresponding data to indicators of malicious activities. • Examine ELSA log queries

Quoted Source: John N. Stewart, SVP and Chief Security and Trust Officer, Cisco 2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 39 SECOPS Discovery Lab 4: Correlate Event Logs, PCAPS, and Alerts

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 40 SECOPS Discovery Lab 5: Topic 6.11 – Investigate Browser-Based Attacks Lab Introduction: Attack vectors enable a threat actor to exploit either known or unknown system vulnerabilities. The types of attack vectors that are employed can depend on several factors, including, skill-level, motivation of the threat actor, and the type of technology deployed at their chosen target. To effectively recognize these attack vectors, an analyst needs to be familiar with fundamental elements comprising the attacks and how they are conducted.

The common vectors for the web based attacks include: • MySQL injections • Local file inclusions or directory traversal • Arbitrary code execution • Obfuscated web scripting • Cross-Site Scripting (XSS) • Cross-site request forgery (CSRF)

Tasks to Accomplish: • Exploit a vulnerable web application (NOWASP Mutillidae) using SQL injection to steal credit card information • Employ Cross-Site Scripting (XSS) injection technique to pilfer session information • Utilize tools within Security Onion: Sguil, ELSA and Zeek (Bro) and NetworkMiner applications to identify and investigate malicious activity.

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 42 SECOPS Discovery Lab 6: Topic 7.7 – Analyze Suspicious DNS Activity Lab Introduction: Identifying malicious activity within a network is a critical function of a SOC analyst. The analyst must be able to determine whether an alert or indicator of compromise (IOC) is a legitimate threat or a false positive. In order to be successful, the analyst must possess an intimate knowledge of the inner workings of the network(s) they are monitoring. An effective analyst should also develop an understanding of the possible motivations behind these malicious activities and be able to correlate threat information from multiple reporting sources, including NetFlow and DNS. The analyst must develop techniques for quickly and efficiently searching through large amount of information that is generated by various network traffic sources.

Tasks to Accomplish: • Investigate various methods threats actors illicitly use the DNS protocol in their attack campaigns

• Examine DNS entries created by the fast fluxing technique commonly used to obscure malware delivery sites

• Identify information tunneled within DNS traffic (DNS tunneling); • Technique widely employed by threat actors to covertly exfiltrate information during a data breach

Lab Introduction: The tactical analysis of suspicious traffic patterns is an essential responsibility of a SOC analyst. In order to quickly respond to and investigate malicious threats, the analyst has to be able to identify the presence of anomalous network traffic patterns. In an enterprise environment, a SOC analyst may have access to sophisticated behavioral based analytic tools, such as Cisco’s Stealthwatch, that automatically collects data in search of anomalous patterns of behavior. However, by manually engaging in this search activity, the SOC analyst can gain valuable experience in developing a technique to conduct their own anomaly detection.

Tasks to Accomplish: • Investigate suspicious activity using tools within Security Onion. • ELSA can provide useful statistics based on observed network protocols • Examine suspicious web browser user agent strings • Upload and analyze extracted files from captured PCAP files using Malwr.com

Lab Introduction: The Advanced Persistent Threats (APT) have quickly risen as a top-level concern for organizations of all types and sizes. The term ‘APT’ refers to highly targeted, sophisticated attacks, typically associated with nation-state efforts to conduct cyber espionage. However, the APT is now targeting organizations across industries, large or small, in the United States, and abroad. APTs are usually difficult to detect and threat actors will use obfuscation techniques to evade conventional security defenses. A SOC analyst has to effectively recognize and respond to this “persistent” threat that can easily infiltrate the established network security defenses. Tasks to Accomplish: • Using Sguil, identify network traffic that was created by an advanced persistent threat (APT). • APT has established a persistent data path to exfiltrate data

• Investigate abnormal Snort IPS alerts and correlate data to create a new indicator of compromise (IoC) using a custom Snort rule

• Investigate suspicious APT related activity from a packet capture

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 48 SECOPS Discovery Lab 9: Topic 10.6– Explore SOC Playbooks Lab Introduction: A playbook is a prescriptive collection of repeatable plays (reports and methods) to detect and respond to security incidents. A “play” is a specification of a reproducible activity carried out within a SOC that has been demonstrated to produce high-fidelity results. • Individual plays may be manual, semi-automated, or fully automated and the plays that are incorporated into the playbook will vary between Security Operation Centers. • Each organization can be exposed to a different set of threats, risks, priorities, and SOC resources, which influence the plays that are included in the playbook. • Plays are specific to the threat and determine the workflow processes and tools the SOC analyst will follow in a prescribed manner. • The playbook is a living document. Individual plays are created, modified, and retired over a period of time.

Tasks to Accomplish: • The student will be presented with several manual executed and semi-automated plays. • The student will be guided through the execution of each play and the analysis of the results.

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 50 Access SECFND / SECOPS eLearning Lab Training Environment Access SECFND / SECOPS eLearning Lab Training Environment • Using a web browser, access the following site: • https://ciscolivecyberops.certsite.net/

• From the Cisco Digital Learning Library homepage:

• Select the Login button. • Use the account credentials provided by your instructor to log into the training portal.

Once you have logged into the web portal, you now have access to the course material within the Cisco Digital Learning Library: • Select the button to access either the SECOPS or SECFND training course and labs. • We will provide you 30 days of continued access to the SECFND and SECOPS Training Portal. PLEASE NOTE: You can only launch one course at a time. Launching a second training course will automatically log you out of your previous session.

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 53 Lab Evaluation Complete your online session • Please complete your session survey after each session. Your feedback evaluation is very important.

• Complete a minimum of 4 session surveys and the Overall Conference survey (starting on Thursday) to receive your Cisco Live water bottle.

• All surveys can be taken in the Cisco Live Mobile App or by logging in to the Session Catalog on ciscolive.cisco.com/us.

Cisco Live sessions will be available for viewing on demand after the event at ciscolive.cisco.com.

Demos in the Walk-in labs Cisco campus

Meet the engineer Related sessions 1:1 meetings

https://learningnetwork.cisco.com/community/it_careers/cybersecurity-training-and-certifications

2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 58 Cisco’s DoD Accreditation Puts You on the Forefront of Cybersecurity As of July 2018, Cisco CCNA Cyber Ops Certification has been approved for inclusion in the United States Department of Defense (DoD) 8570.01-M for the CCSP Analyst and CSSP Incident Responder categories.

The forefront of cybersecurity: “With three DoD-approved certifications, (Cisco CCNA Security, Cisco CCNP Security, and Cisco Cybersecurity Specialist (SCYBER) - Cisco puts you on the forefront of cybersecurity.”

Course Description Cisco Certification Understanding Cisco Cybersecurity The SECFND course provides understanding of CCNA® Cyber Ops Fundamentals (SECFND) cybersecurity’s basic principles, foundational knowledge, Exam: 210-250 and core skills needed to build a foundation for understanding more advanced cybersecurity material & skills. Implementing Cisco Cybersecurity The SECOPS course prepares candidates to begin a CCNA® Cyber Ops Operations (SECOPS) career within a Security Operations Center (SOC), working Exam: 210-255 with Cybersecurity Analysts at the associate level. Cisco Security Product Training Official deep-dive, hands-on product training on Cisco’s Courses latest security products, including NGFW, ASA, NGIPS, AMP, Identity Services Engine, Email and Web Security Appliances, and much more.

For more details, please visit: www.cisco.com/go/securitytraining or http://learningnetwork.cisco.com Any questions? Visit the Learning@Cisco Booth

Course Description Cisco Certification CCIE Security 5.0 CCIE® Security

Implementing Cisco Edge Network Configure Cisco perimeter edge security solutions utilizing Cisco CCNP® Security Security Solutions (SENSS) Switches, Cisco Routers, and Cisco Adaptive Security Appliance (ASA) Firewalls Implementing Cisco Threat Control Solutions (SITCS) v1.5 Implement Cisco’s Next Generation Firewall (NGFW), FirePOWER NGIPS (Next Generation IPS), Cisco AMP (Advanced Malware Protection), as well as Web Security, Email Security and Cloud Implementing Cisco Secure Access Web Security Solutions (SISAS) Deploy Cisco’s Identity Services Engine and 802.1X secure Implementing Cisco Secure Mobility network access Solutions (SIMOS) Protect data traversing a public or shared infrastructure such as the Internet by implementing and maintaining Cisco VPN solutions Implementing Cisco Network Security Focuses on the design, implementation, and monitoring of a CCNA® Security (IINS 3.0) comprehensive security policy, using Cisco IOS security features For more details, please visit: www.cisco.com/go/securitytraining or http://learningnetwork.cisco.com Any questions? Visit the Learning@Cisco Booth

Course Description ANDMB – Data Management, Architecture This training course provides hands on training with a technical mix of and Applications application, compute, storage and networking topics concerning the deployment of Big Data clusters. The goal of this training is to provide candidates with a better understanding of Big Data infrastructure requirements, considerations and architecture and application behavior, to be better equipped for Big Data infrastructure discussions and design exercises in their data center environment. ANDMA – Advanced Data Management, This training course covers some of the major architecture design to cater Architecture and Applications to different needs of the application, data center or deployment requirements. It provides architectural designs and advanced hands-on training on topics covering Scaling of cluster to thousands of nodes and management, Lambda architecture for streaming analytics, Data Life Cycle management with HDFS tiered storage, and different approaches for Multi- tenant Hadoop cluster deployments with Openstack, UCSD Express, or with MapR volumes and Work-load Automation topics concerning the deployment of Big Data clusters.

Data and Analytics training page: http://www.cisco.com/c/en/us/training-events/resources/learning- services/technology/data-analytics.html For more details, please visit: http://learningnetwork.cisco.com Any questions? Visit the Learning@Cisco Booth

Protect your critical data and business operations through an integrated security architecture that provides continuous protection before, during, and after an attack. In our live Security Experts Webinars, you'll learn how Cisco can help you put in place the right solution for you. https://www.cisco.com/c/en/us/products/security/webinars- and-demos.html

2019 CLUS 2019 CLUS