37
Using NetFlow for Cyber Threat Defense COMPANY CONFIDENTIAL Michael Belan Senior Systems Engineer Lancope Federal

Using NetFlow for Cyber Threat Defense

Embed Size (px)

Citation preview

Page 1: Using NetFlow for Cyber Threat Defense

Using NetFlow for

Cyber Threat Defense

COMPANY CONFIDENTIAL

Michael BelanSenior Systems EngineerLancope Federal

Page 2: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Agenda

● Cyber Threat Defense 2.0 Security Model

● Netflow – Visibility to CTD 2.0

● Lancope StealthWatch in CTD 2.0

Use case: Forensic IssueUse case: Insider Threat

● Review

Page 3: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

The Cyber Threat Defense 2.0 Model

Page 4: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

NetFlow provides Enterprise-wide visibility to CTD 2.0

Destination

Destination

Page 5: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Massively Scalable StealthWatch Architecture

© 2013 Lancope, Inc. All rights reserved. 5

Page 6: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

StealthWatch Architecture: Putting It All Together

StealthWatchManagement

Console

FlowCollector

NetFlow,syslog, SNMP NetFlow enabled

infrastructure

FlowSensor

User and DeviceInformation

StealthWatchIDentity

Cisco ISE

Feeds of emerging threatinformation

VMware ESX withFlowSensor VE

UDP Director

Page 7: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Stitching, Deduplication, and Unsampled Flow

Stitching● Netflow is unidirectional● Two records per conversation● Stealthwatch creates biflows

Deduplication • Aggregates data from all exporters• Stores one record• Faster query response

Page 8: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Host-Centric Visibility: Host Snapshot

Page 9: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Regional Visibility: Relational Flow Maps

Page 10: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

The Attack Lifecycle

Page 11: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Detecting Command & Control

Page 12: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Detecting C&C Channels with SLIC

Page 13: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Country-based Detection

Page 14: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Detecting Internal Reconnaissance

Page 15: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Detect Internal Recon with Concern Index

Page 16: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Detecting Internal Propagation

Page 17: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Detect Propagation with Host Locking

A A

UsersResources/Datacenter

B B

ALARM

Page 18: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Detect Propagation with Worm Tracker

Page 19: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Detecting Data Exfiltration

Page 20: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Resource Group A

Attack Lifecycle: Detect Data Hoarding

2GB per day

User

2GB per day

25GB today !!!ALARM

Page 21: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Attack Lifecycle: Detecting Data Exfiltration

Internet

Internal Network

Resource Group A

User

ALARM

Page 22: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Use Cases

Page 23: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Scenario: You have been notified of anunauthorized data transfer and need to pullback historical conversations.

The notification could be from:• Internal auditor• External authority • Security response team

Pull back all historical conversations around ahost, port, application, or traffic type.

ALERT: Incident ResponseALERT: Incident Response Below is an example notification received

List of infringing content------------------------------Taylor Swift Fearless------------------------------INFRINGEMENT DETAIL------------------------------Infringing Work : FearlessFilename : Taylor Swift - FearlessFirst found (UTC): 3:59:00 PMLast found (UTC): 4:24:59 PM Filesize : 79176908 bytes IP Address: 209.182.184.7IP Port: 14001Network: BitTorrentProtocol: BitTorrent

10.201.3.51..

50.23.115.72

Page 24: Using NetFlow for Cyber Threat Defense
Page 25: Using NetFlow for Cyber Threat Defense
Page 26: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Scenario: An internal user is stealing data!

The user could be a:• Disgruntled employee• Person about to leave the company• Person with privileged credentials• Person stealing and selling trade secrets

Security events have triggered indicating a useris connecting to a terminal server, collectingdata from a sensitive database, and tunnelingthe traffic out of the network using P2P throughUDP port 53 (DNS port).

ALERT: Insider ThreatALERT: Insider Threat 1. Internal user connects to Terminal Server

2. Terminal server used to collect sensitive datafrom within the same subnet inside thedatacenter.

3. Terminal server used to encrypt data andtunnel through DNS port to an upload server

10.201.3.18 10.201.0.23..

10.201.0.23..

10.201.0.55

10.201.0.23..

74.213.99.97

Page 27: Using NetFlow for Cyber Threat Defense
Page 28: Using NetFlow for Cyber Threat Defense
Page 29: Using NetFlow for Cyber Threat Defense
Page 30: Using NetFlow for Cyber Threat Defense
Page 31: Using NetFlow for Cyber Threat Defense
Page 32: Using NetFlow for Cyber Threat Defense
Page 33: Using NetFlow for Cyber Threat Defense
Page 34: Using NetFlow for Cyber Threat Defense
Page 35: Using NetFlow for Cyber Threat Defense
Page 36: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Review: Stealthwatch Highlights

• Flows based – One record to rule them all!

• Profile Hosts –based on behavior, traffic sent and received

• Enforce Policy – Identify the known bad

• Detect Anomalies – Find and alert on outliers

• Metadata – Light weight, efficient, not hindered byencryption

Page 37: Using NetFlow for Cyber Threat Defense

© 2014 Lancope, Inc. All rights reserved.

Thank you


Enabling Efficient Cyber Threat Hunting with Cyber Threat

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Documents
Cyber, Physical or Insider Threat? - ASIS Europe 2018 · Cyber, Physical or Insider Threat? ... navigating a complex risk landscape? physical threat cyber threat insider threat

Cyber, Physical or Insider Threat? - ASIS Europe 2018 · Cyber, Physical or Insider Threat? ... navigating a complex risk landscape? physical threat cyber threat insider threat

Documents
CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

Documents
Cyber Threat Characterization

Cyber Threat Characterization

Documents
National Cyber Security Centre Unclassified Cyber Threat ... · National Cyber Security Centre Unclassified Cyber Threat ... It also produces threat prevention and ... can however

National Cyber Security Centre Unclassified Cyber Threat ... · National Cyber Security Centre Unclassified Cyber Threat ... It also produces threat prevention and ... can however

Documents
The New Cyber Threat

The New Cyber Threat

Documents
Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Documents
Cyber Threat Landscape

Cyber Threat Landscape

Documents
THREAT REPORT - Cyber€¦ · The Australian Cyber Security Centre Threat Report 2015 Foreword The cyber threat to Australian organisations is undeniable, unrelenting and continues

THREAT REPORT - Cyber€¦ · The Australian Cyber Security Centre Threat Report 2015 Foreword The cyber threat to Australian organisations is undeniable, unrelenting and continues

Documents
Operational Cyber Threat Intelligence:

Operational Cyber Threat Intelligence:

Documents
Cyber threat alerts 2012

Cyber threat alerts 2012

Technology
Cyber Threat Framework (Version 4) Translating Cyber into ...€¦ · Cyber Threat Framework (CTF) Overview The Cyber Threat Framework was developed by the US Government to enable

Cyber Threat Framework (Version 4) Translating Cyber into ...€¦ · Cyber Threat Framework (CTF) Overview The Cyber Threat Framework was developed by the US Government to enable

Documents
Advanced Threat Defence using NetFlow - alcatron.net Live 2014 Melbourne/Cisco Live Content... · Advanced Threat Defence using NetFlow BRKSEC-2073 Matthew Robertson Security Technical

Advanced Threat Defence using NetFlow - alcatron.net Live 2014 Melbourne/Cisco Live Content... · Advanced Threat Defence using NetFlow BRKSEC-2073 Matthew Robertson Security Technical

Documents
HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

Documents
NATIONAL CYBER SECURITY CENTRE CYBER THREAT REPORT …

NATIONAL CYBER SECURITY CENTRE CYBER THREAT REPORT …

Documents
NetFlow Monitoring for Cyber Threat Defense

NetFlow Monitoring for Cyber Threat Defense

Technology
Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Documents
Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Documents
Cisco Cyber Threat Defense for the Data Center Solution: First … · Using this approach, the Cisco Cyber Threat Defense for the Data Center Solution captures NetFlow data across

Cisco Cyber Threat Defense for the Data Center Solution: First … · Using this approach, the Cisco Cyber Threat Defense for the Data Center Solution captures NetFlow data across

Documents
Cyber Security Conference - Rethinking cyber-threat

Cyber Security Conference - Rethinking cyber-threat

Technology
What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

Documents
Cyber Threat Intelligence

Cyber Threat Intelligence

Technology
Introducing Cyber Threat Monitoring - StarHub€¦ · Introducing Cyber Threat Monitoring A unique, telco-centric cyber defence solution for enterprise Cyber Threat Monitoring (CTM)

Introducing Cyber Threat Monitoring - StarHub€¦ · Introducing Cyber Threat Monitoring A unique, telco-centric cyber defence solution for enterprise Cyber Threat Monitoring (CTM)

Documents
Cyber Threat Monitor Report

Cyber Threat Monitor Report

Documents
Global Cyber Threat Intelligence

Global Cyber Threat Intelligence

Technology
Cyber Security Threat Landscape

Cyber Security Threat Landscape

Documents
Cisco Cyber Threat Defense

Cisco Cyber Threat Defense

Technology
CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

Documents
IBM Cyber Threat Analysis

IBM Cyber Threat Analysis

Government & Nonprofit
LookingGlass Cyber | Cybersecurity & Threat Intelligence€¦ · CYBER SOLUTIONS LookingGlass Cyber Solutions delivers unified threat protection against sophisticated cyber attacks

LookingGlass Cyber | Cybersecurity & Threat Intelligence€¦ · CYBER SOLUTIONS LookingGlass Cyber Solutions delivers unified threat protection against sophisticated cyber attacks

Documents