Three%Phases%of%Security% - CompTIA

Three Phases of Security

Security Analyst: Tools of the Trade Patrick Lane, M.Ed., Security+, Network+, CISSP, MCSE Senior Manager, Product Development Product Manager for: CompTIA Security+ CompTIA Cybersecurity Analyst (CSA+) CompTIA Advanced Security PracCConer (CASP) CompTIA Server+

Agenda

1.  Why have security analyst skills become so important? 2.  What tools do security analysts use? 3.  How does a SIEM work – unified security management? 4.  How is threat intelligence integrated? 5.  Real-‐world examples

Splunk: Database hack discovered LogRhythm: Financial server hack discovered AlienVault: Bruteforce aYack discovered

Why have security analyst skills become so important?

1

•  Wake up call for the IT security world

•  Brought widespread aYenCon to the “Advanced Persistent Threat”

•  Demonstrated that tradiConal security tools, such as firewalls and anC-‐virus, do not alone protect networks

•  Recent high profile aYacks at Yahoo! and DemocraCc NaConal CommiYee (DNC)

Seminal Event: Target Hack of 2014

Planning Malware

Introduc>on

Command &

Control

Lateral Movement

Target Iden>fica>on

Exfiltra>on (AGack Event)

Retreat

The Advanced Persistent Threat (APT) CharacterisCcs:

§  Never stop §  Oaen highly coordinated / state sponsored §  Bad actors lurk on systems and networks §  Hard to detect

We must apply behavioral analy>cs to the IT security market to improve the overall state of IT security.

•  We must focus on network behavior in an organizaCon’s interior network

•  We must idenCfy network anomalies that indicate bad behavior

We must train IT security professionals security analyst skills, which include:

ü Threat management ü Vulnerability management ü Cyber incident response ü Security and architecture tool sets

Lessons Learned

39,920 48,947

58,456

109,819

10,000

30,000

50,000

70,000

90,000

110,000

130,000

2012 2013 2014 2015

Informa>on Security Analysts

TOTAL NUMBER OF JOB POSTINGS: Security Analyst Job Role

Source: Burning Glass Technologies Labor Insights, January 2016

175% increase from 2012 to 2015. Data for U.S. only, but

reflects an interna>onal need.

AddiConal Indicators

The U.S. Bureau of Labor StaCsCcs predicts that informaCon security analysts will be the fastest growing job category, with 37% overall growth between 2012 and 2022.*

* CompTIA, Trends in InformaCon Security 2015

In an analysis of recent U.S. Bureau of Labor StaCsCcs data, informaCon security analysts saw an 8% bump in growth over the first three months of 2016. That’s a new BLS record.**

** U.S. Bureau of Labor StaCsCcs data

8 in 10 managers indicate that IT

security cerCficaCons are very valuable (38%) or valuable (42%) in terms of validaCng security-‐related knowledge/

skills or evaluaCng job candidates.***

*** InternaConal Trends in Cybersecurity, CompTIA, 2016

CompTIA Cybersecurity Analyst (CSA+) Cer>fica>on Developed to address the need for IT Security Analysts.

As aYackers have learned to evade tradiConal signature-‐based soluCons, an analyCcs-‐based approach has become extremely important. CSA+ applies behavioral

analyCcs to the IT security market to improve the overall state of security.

(Quick AdverCsement)

Exam available February 15, 2017

What tools do security analysts use? 2

Tools of the Trade – Open Source

Open source so^ware Descrip>on URL

Wireshark Network protocol analyzer / packet capture tool

hGps://www.wireshark.org

Bro and/or Snort Network intrusion detecCon systems (NIDS)

hGps://www.bro.org hGps://www.snort.org

AlienVault Open Source SIEM (OSSIM) with Open Threat Exchange (OTX)

Security InformaCon and Event Management (SIEM) soaware

hGps://www.alienvault.com/products/ossim

Security InformaCon and Event Management (SIEM) soaware

•  All about logs –  To constantly aggregate and analyze internal and external network logs –  To quickly prevent breaches or perform incident response using these logs

•  What does it address? –  Threat management –  Incident response –  Compliance

•  80% of SIEMs are funded to close a compliance gap •  Security OperaCons Center (SOC)

–  Security Analyst, SOC Analyst, Vulnerability Analyst, Cybersecurity Specialist –  Threat Intelligence Analyst, Security Engineer

Tools of the Trade – Vendor Specific Vendor-‐specific so^ware Descrip>on URL

Intel Security / MacAfee Enterprise Security Manager

SIEM, threat detecCon

hGp://www.mcafee.com/us/products/enterprise-‐security-‐manager.aspx

Dell/EMC RSA Security AnalyCcs and RSA NetWitness Suite


hGp://www.emc.com/securityanaly>cs/sa.htm hGps://www.rsa.com/en-‐us/products-‐services/threat-‐detec>on-‐and-‐response

Splunk Enterprise Security SIEM, threat detecCon

hGps://www.splunk.com/en_us/products/premium-‐solu>ons/splunk-‐enterprise-‐security.html

AlienVault Unified Security Management (USM)


hGps://www.alienvault.com/products

Tools of the Trade – Vendor Specific

Vendor-‐specific so^ware Descrip>on URL

HPE Security ArcSight ESM SIEM, threat detecCon

hGp://www8.hp.com/us/en/so^ware-‐solu>ons/siem-‐security-‐informa>on-‐event-‐management/

IBM Security QRadar SIEM SIEM, threat detecCon

hGp://www-‐03.ibm.com/so^ware/products/en/qradar-‐siem/

LogRhythm Unified Security Intelligence Plarorm


hGps://logrhythm.com/products/security-‐intelligence-‐pladorm/

SIEM Example

How does a SIEM work – unified security management?

3

OSSIM •  AlienVault Open Source SIEM (OSSIM) – free, but no support •  AlienVault USM is commercial version ($32K). What it does:

–  External Data Sources: applicaCons and devices that generate events –  Sensors: collect and normalize events –  Server: conducts risk assessment, correlaCon direcCves and storage of

events in an SQL database (SIEM) –  Storage: events are digitally signed and Cme stamped in a massive

storage system, usually NAS or SAN, called Logger, that includes an addiConal database for forensics.

–  Web Interface -‐ provides a reporCng system, metrics, reports, dashboards, CckeCng system, vulnerability management system, real-‐Cme network informaCon

Source: LogRhythm’s Unified Security Intelligence PlaAorm

OSSIM InstallaCon •  OSSIM .ISO image includes Linux Debian, OSSIM, and OSSIM

agent soaware –  AlienVault_OSSIM_64bits_5.3.2.iso (630 MB) –  hYps://www.alienvault.com/products/ossim

•  Implement on virtual machine •  Needs power – AWS or Azure recommended

OSSIM Agents and Plug Ins •  SIEMs work best in a large organizaCon with mulCple network devices,

such as firewalls, IDS/IPS, anC-‐virus, web servers, etc. •  To collect logs from hosts

–  Install agents, such as OSSEC (Linux) and Snare (Windows) •  To connect data-‐sources to OSSIM server

–  Install plug-‐ins (XML-‐based configuraCon file) at data source –  Plug-‐ins integrated into many security tools:

•  CheckPoint, Cisco, Citrix, Exchange, IIS, Syslog, Wmi, Nessus, AnC-‐virus (Sophos, Symantec, McAfee, Avast), OSSEC, Snare

•  Apache, Snort, Ntop, Nmap, OpenVAS, P0f, Pads, Arpwatch, OSSEC, Osiris, Nagios, OCS, Kismet

CorrelaCon •  Separates SIEM from IDS/IPS using intelligence •  Reduces false posiCves •  Calculates mulCple input events and alarms into a more

manageable number of events to address •  Cross CorrelaCon

–  Works only with events that have defined desCnaCon IP addresses –  Checks IP address in database to determine any vulnerabiliCes –  Changes the reliability value of the event, which is used to calculate

risk –  Removes a lot of alarms

CorrelaCon (cont’d)

•  CorrelaCon DirecCve –  Generates an alarm by following rules –  Rules wriYen in XML (there can be thousands – most preconfigured) –  Analyze mulCple events and decide whether to raise an alarm or not

•  E.g., mulCple login aYempts into a web server using SSH –  Capable of idenCfying zero-‐day aYacks, since it uses rules based on

behavior

Risk CalculaCon •  OSSIM data management:

–  Raw logs –  Events –  Alarms –  Tickets

•  Raw logs are sent to OSSIM server and normalized •  The logs become events •  Alarms are raised when the risk value of event is ≥1 on a scale to 10.

[ASSET VALUE(0-‐5)*PRIORITY(0-‐5)*RELIABILITY(0-‐10)] /25 = RISK OF THE EVENT(0-‐10)

•  Tickets are manually or automaCcally created in OSSIM aaer reviewing alarms. Assigned to appropriate personnel.

ReporCng

•  Highly scalable •  Easy to use •  Schedule reports

and e-‐mail

How is threat intelligence integrated?

4

Threat Intelligence

Source: hBps://www.alienvault.com/products



Real world examples 5

LogRhythm: Financial Server Hack Discovered

Source: hBps://logrhythm.com/products/security-‐intelligence-‐plaAorm/

Source: hBps://logrhythm.com/products/security-‐intelligence-‐plaAorm/

Splunk: Database Hack Discovered

Source: hBps://www.splunk.com/en_us/products/premium-‐soluJons/splunk-‐enterprise-‐security.html

Source: hBps://www.splunk.com/en_us/products/premium-‐soluJons/splunk-‐enterprise-‐security.html

AlienVault: Bruteforce aYack discovered



Thank You QuesCons?

Documents

Three%Phases%of%Security% - CompTIA