INF526: Secure Systems Administration
Total Page：16
File Type：pdf, Size：1020Kb
INF526: Secure Systems Administration SIEM and Intrusion Detection Prof. Clifford Neuman Lecture 12 5 April 2017 OHE100C Class Presentation Schedule 4/5 Mohammed Alsubaie – SIEM and Intrusion Detection 4/12 Vishnu Vadlamani - Network Monitoring/Attack Forensics 4/19 Andrew Gronski - Accreditation and acceptance testing 1 Detecting Intrusions • Visibility of artifacts from intrusions – Passive attacks • Difficult to detect because technically no changes made. – But in some cases – evidence of connecting to a network might be present. – Honeytokens – Intrusions are really all Active attacks • Identifying Subversions • Identifying traffic that is indicative of an intrusion – Best point of observation is outside affected system 2 Where Detection Occurs • Events visible in the network – New network peer entities is evidence – Significant change in frequency or bandwidth is evidence • Events on the Compromised System – Changes to system binaries are evidence of subversion – Changes to accounts and privileges are evidence – Changes to the running processes and CPU share are evidence – Creation of new files are evidence • The above are anomalies and an administrators role is to sort though them. 3 Events Visible in the Network • Network Monitoring uses a system to monitor a computer network for abnormalities and notifies an administrator or other system components when an issue is identified. – Enterprise health monitoring • Network Monitoring tools allow us to see the devices connected to our network and traffic between them. • Packet analyzers can capture network traffic for viewing through an event management system. • Such data is useful for intrusion detection. 4 Network Monitoring and Secure SA • Secure administration of a network and systems requires visibility of current activities and status of devices, and the ability to examine past activities. In particular: – Ensures Availability is maintained • Ability to correct system issues, and to identify potential DoS attacks – Ensures Non-Repudiation • Gives administrator a history of who did what, and when • While not directly involved in enforcement, it also assists in ensuring other principles (Integrity, Confidentiality, Authentication, Authorization) have not been breached. – Can identify suspicious activity that may indicate a security compromise. Slide by Josh McCamey INF526 Summer 2016 5 How Does it Work • Enterprise Network Monitoring systems usually check the health of systems on the network by using a “ping” signal to test whether ports respond as expected. – Period between pings can be anywhere from minutes to hours – Checks response times and up-time – May also check for things like consistency and configuration of specific equipment or software on the network • Can check just about any network protocol (e.g. HTTP/S, SNMP, FTP, SMTP,POP3, IMAP, DNS, SSH, TELNET, SSL, TCP, etc…) – In the case of a protocol like SMTP/POP3, system may send a test message periodically through one protocol while receiving through another to check the health of servers the message passes through. Slide by Josh McCamey INF526 Summer 2016 6 How Does it Work • A failure occurs when a test operation or “ping” times out – When a failure is recorded the Network Monitor produces an “action” – System can use any available means to notify an administrator (e.g. e-mail, text, phone call, pop-up notification on local machine, even an audible alarm) • Advanced networks may have automatic fail-safes that off-load a server’s duty to the rest of the network to make the failure transparent to the user – This is critical for big companies/sites that can’t afford down-time. Slide by Josh McCamey INF526 Summer 2016 7 How Does it Work • Packet analyzers, on the other hand, capture packets going across an interface – Sometimes these are also called “packet sniffers” – Close relationship to forensics and intrusion detection – Can be used to determine the nature of connections and identify malicious activity • Wide variety of visualization, recording and analysis capabilities depending on thetool used • Packet analyzers and health monitors not necessarily mutually exclusive – Many different tools, some can “do-it-all”, depending on your definition of “all” Slide by Josh McCamey INF526 Summer 2016 8 Common Tools (not a compressive list) • ntop • NetworkMiner • Microsoft Message Analyzer • Pandora FMS • MRTG • Zenoss Core • PRTG • The Dude • Nagios • Splunk • OpenNMS • Angry IP Scanner • SolarWinds • Icinga • Spiceworks IT Management • Total Network Monitor • Advanced IP Scanner • NetXMS • Capsa • Xymon • Fiddler • And… WIRESHARK Slide by Josh McCamey INF526 Summer 2016 9 Microsoft Message Analyzer • Successor to Microsoft Network Monitor – Free, 32-bit and 64-bit: Windows 7, Windows 8, Windows 8.1, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows 10 clients • Capture, display, and analyze protocol messaging traffic • Trace and assess system events and other messages from Windows components • Main Features: – Integrated “live” event and message capture at various system levels and endpoints – Parsing and validation of protocol messages and sequences – Automatic parsing of event messages described by ETW manifests – Summarized grid display – top level is “operations”, (requests matched with responses) – User controlled “on the fly” grouping by message attributes – Ability to browse for logs of different types (.cap, .etl, .txt) and import them together – Automatic re-assembly and ability to render payloads – Ability to import text logs, parsing them into key element/value pairs – Support for “Trace Scenarios” (one or more message providers, filters, and views) Slide by Josh McCamey INF526 Summer 2016 10 Microsoft Message Analyzer Slide by Josh McCamey INF526 Summer 2016 11 Nagios Network Analyzer • Popular paid IT admin tool to monitor for configuration issues, high load, etc. • Focused on high-level goals rather than low level packet inspection – Netflow Analysis, Monitoring, and Bandwidth Utilization – Security and reliability monitoring and user notifications – Advanced visualization capabilities – Custom application monitoring – Bandwidth monitoring and threshold settings with alert capability – Advanced user management to allow for multi-tenancy • Linux focused • Specialized versions for machines running in virtual environments like VMWare Slide by Josh McCamey INF526 Summer 2016 12 Nagios Network Analyzer Slide by Josh McCamey INF526 Summer 2016 13 Open NMS • Free & open-source enterprise grade network monitoring & management tool • Runs on Linux/Win/Mac • “Network Management Application Platform” – Made to be customized and have network monitoring solutions/applications built on top of it • Core feature set – Java-based framework – API-extendable notification mechanism including SMTP, Slack & Mattermost, Jabber and XMPP, Microblogs (i.e. Twitter) – Ticketing integration framework including Request Tracker, BMC Remedy, IBM Tivoli Service Request Manager, – Atlassian JIRA, extensible ticketing API – Alarm forwarding to external applications for handling or analysis (ElasticSearch), “Northbound” API and JMS, – AQMP integration – “Southbound integration” enables gathering of performance measurements and logging messages – from network applications and devices (test connections, check resource configurations, etc.) Slide by Josh McCamey INF526 Summer 2016 14 Open NMS Slide by Josh McCamey INF526 Summer 2016 15 NTopNG • Network traffic probe that shows network usage similar to Linux “top” command – Full-featured network analysis tool, free & paid versions, Portable, made to run on any Unix platform (&Win x64) – Uses a web server to provide a web browser interface – Sort network traffic according to many criteria including IP address, port, Layer 7 protocol (app layer), throughput, and more – Show network traffic and IPv4/v6 active hosts. – Produce long-term reports about various network metrics such as throughput, application protocols – Top X talkers/listeners, top ASs, top Layer 7 applications – For each communication flow report network/application latency/round trip time (RTT), TCP stats (retransmissions, packets OOO, packet lost), bytes/packets – Store on disk persistent traffic statistics in RRD format. – Geolocate hosts and display reports according to host location. – Discover application protocols by leveraging on nDPI, ntop’s DPI framework. – Characterise HTTP traffic by leveraging on characterisation services provided by Google and HTTP Blacklist. – Show IP traffic distribution among the various protocols. – Analyse IP traffic and sort it according to the source/destination. – Display IP Traffic Subnet matrix (who’s talking to who?) – Report IP protocol usage sorted by protocol type. – Produce HTML5/AJAX network traffic statistics. Slide by Josh McCamey INF526 Summer 2016 16 NTOP NG Slide by Josh McCamey INF526 Summer 2016 17 Wireshark • World's foremost network protocol analyzer (self-claimed) – - Deep inspection of hundreds of protocols, with more being added all the time – - Live capture and offline analysis – - Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others – - Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility – - Rich VoIP analysis – - Read/write many different capture file formats (too many to show here) – - Capture files compressed with gzip can be decompressed on the fly – - Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI,