MongoDB, ANTS, and the IC

A Technological Love Story

Overview•The State of the Cyber World

•The Intelligence Community (IC), Challenges, and the Mongo solution

•An Idea

•ANTS - A Product

•Moving Forward

Current State of the Cyber World

"...During the past year, there have been 200 attacks on core critical infrastructures in the transportation, energy, and communication industries reported to the Department of Homeland Security..."

- Sen. Susan Collins, R-Maine, and ranking member of the Senate Homeland Security and Governmental Affairs Committee.

Current State Continued...

Over the next few years, hackers will become more sophisticated, said Charles Croom, vice president of cyber security solutions at Lockheed Martin Information Systems & Global Solutions. This doesn’t necessarily mean that the technologies are becoming more advanced — even the most sophisticated threats often use known vulnerabilities and malware, Croom said — but the adversaries have become more effective.

-National Defense Magazine

Current State Continued...

•Cyber threats get personal

✴Mobile Malware

✴Medical Identity Theft

✴Ransom Malware

✴Hacktivism

The IC Mission

Primary Mission: "...to collect and convey the essential information the President and

members of policymaking, law enforcement, and military communities require to execute

their appointed duties." (intelligence.gov)

Mission, Continued...

• Members of the IC:

✴ Collect and Assess intel on

✦ International Terrorists

✦ Narcotics activities

✦ Hostile Activities:

✤ Foreign powers, organizations, persons, and their agents

✤ Foreign intelligence directed against US

Our Challenges•Data is BIG

•Data is unstructured

•Data is constantly evolving and changing

•Technologies are evolving and changing

The Social Network

All generating data!

All communicating data!

The data is sensitive!

Scale of the ICHighly distributed!

All collecting data!

All enhancing data!

All transforming data!

All sharing data!

Evolve to Adapt

•How do we keep up with the Data Explosion and the need to bring something to market tomorrow?

•How can we react quickly by adapting to evolving data and threats?

•Useful data gets the most attention, how can we make it more accessible?

MongoDB is a Perfect Fit!

Why Mongo in the IC?

•Distributed and scalable

•Easy to stand up

•Deals well with unstructured data

•Technology stack friendly

•Cheap and accessible!

We love MONGO

The Birth of an Idea

•Network Traffic Generation:

✴Not a PCAP hose

✴Organic generation

✴Scripted Actions for organized and planned activity

✴ Interactivity

Top Level Design

Retrospective•Needs?

✴Stability

✴Quick time to market

✴Flexible data model

✴Scalable infrastructure

•Options?

SQL RDBMS Solutions MongoDBSchema is rigid, inflexible, high maintenance

Fits very well for volatile data

Learning curve of the relational model and design

Simple to implement and easy to use

Difficult to scale out with high availability

Easy to scale out, automatic sharding, distributing data over multiple nodes, with high availability

High cost of proprietary hardware and software

Low cost, open source software, commodity based hardware

Causes major interruptions to rapid development cycles

Rapid development cycles AND programmer friendly

RDBMS vs MongoDB

Why Mongo for our Product?

•Minimal cost for capability coverage

•Plays nicely with other technologies

•Standalone stable

•Short learning curve

•Quick time to market/rapid prototyping

How ANTS benefits from Mongo

• Currently supported actions:

✴ HTTP GET’s & POST’s

✴ Chat Send & Response

✴ Email Send & Response

• Where does MongoDB fit in?

✴ Enables easy evolution

✴ Addition of new action types

✴ Future friendly

Success•Four (4) successful version updates

in the six (6) months!

•Recently got buy in for our 2.0 expansions and GUI facelift from current client

•Expanding into new spaces with new clients

•Our current client is VERY happy

ANTS 2.0!

•Two major components

✴Action scheduling feature

✴Upgraded GUI

•Opportunity to learn from client feedback and improve on multiple levels

New Features

•Advanced Scheduling Features

•Google Calendar-like feel and scheduling

•Timeline view

•Intuitive workflow

•Seamless integration

Month View

Week View

Day View

Timeline!

Updated User Experience

•Web 2.0 look and feel

•User workflow streamlined

•Additional enhancements based on client feedback

Welcome

Your Dashboard

Your Actors

Your Scripts

For the Author

Future of ANTS• Actors:

✴ Dynamic and automated creation

✴ easily scalable

• Actions

✴ SIP/VOIP

✴ Email attachments and execution

✴ Social Network interaction

• Scripts

✴ Auto-generated scripts based on Actors, Actions, and duration

Match Made in Heaven

•Mongo really has everything we needed:

✴ Quick time to market

✴ How long to develop your initial prototype

✴ Learning curve and developer ease of use

✴ Stack flexible

✴ Data flexible

✴ Stability

Questions?