Realization of Security Events Management System via OPENSTF

Transcription

1 Realization of Security Events Management System via OPENSTF Lance Yoo

2 Requirements Analysis of Security Event Management

3 Background of Security Event Management Requirement We could not qualify the impact of so many heterogeneous security products It is useless to view a mass of security events with a mount of trustless information included The policy constitute could not acquire the whole view on security state There are no valid correlations with security decision and security application. An Open Loop System, which is consisted of Early Warning, Defending, Responding sub-systems, has no strong ability to desist the strikes. 第 3 页

4 Heterogeneous security solution leads to risks Authentication Scanner IDS/IPS Security App Firewall Endpoint Security Anti Virus Audit VPN Database NTLOG WMI SYSLOG OPSEC IDMEF SNMP 第 4 页

5 Impossible to handle the mass of security event 第 5 页

6 Sensibility And Reliability are conflict IDS False Positive/False Negative IDS acquirement and analysis of information is limited according to its network level and performance(context-free) IDS SNR enhancement lies on Efficiency of event management 第 6 页

7 Security Policy lack of whole view Current solution is elementary and partial No effective way to show whole security tendency Total Risks have to obey Bucket Principle Lack of practical data when leader or manager making security policy Is your security system an closed loop system? 第 7 页

8 Risk and Asset How to dynamic evaluate real asset value in security solution How to manage risk assessment in security application For users, Business Application is the goal, not Security Find hidden threat in time 第 8 页

9 The Definition of the Security Events Management It is so creative to analyze the security events real time collected from Computer, Network, Storage and Security devices. The SEM helps us to find the true security risk via the correlations on security events with different places, different layers and different types. In fact, we could not only assess the current security state and risk, but also make emergency responding with pre-defined policies automatically. Dynamic security system Model is the major body of intelligent system 第 9 页

10 SEM in security system Security Event Management SEM Core of risk management 第 10 页

11 The goal of SEM Correlation and Aggregation of security events The risk quantization and visualization Closed Loop System, Response in time 第 11 页

12 Technologies in security event management

13 SEM 4lization Normalization Aggregation Correlation Visualization 第 13 页

14 Normalization Collect Adaptor IDMEF Syslog NT Event Database SNMP v1-3 Specific Interface 第 14 页

15 Aggregation filtrate eliminate the redundant data classify Bind context 第 15 页

16 Asset Assessment stimulate event contextualization Picture above you can see security attributes of asset which will be an important part in real time risk calculation. 第 16 页

17 Rule-based Correlation Correlate event by predefined policy to make accurate security alarm. Strong real-time analysis ability based on small time windows as you should define correlation rule first. 第 17 页

18 Statistics-based Correlation Consolidate a certain time event, refer to a threshold, and make a security tendency estimation finally. Based on large time windows, less real-time analysis ability, not necessary predefined rule, reflect system the whole system security attributes. Make major categories first, classify the events then. Evaluate the attack according to the event security level and quantity. 第 18 页

19 Data Mining - three-dimensional risk visualization Devices on the Network Most attacks are on corporate HQ 第 19 页

20 The Problems solved by SEM To mitigate the burden of processing security alarms involving human To reduce the false positives of security events To avoid the potential risk under the mass volume of events To quicken the response of incidents To Manage events from IDS, Firewall, OS, Antivirus, Web server, Database 第 20 页

21 Implementing of SEM with OpenSTF

22 The Characteristic of Implementing SEM/SIM Not only the technical problems, but also the people and operation A extendable basic system plus different modules and solutions for different application environment Usually need 2nd development to form the final management system From the view of design & development method, it s similar to ERP system for enterprise management 第 22 页

23 Build Software System vs. Build SIM/SEM Fred Brooks -Father of IBM 360 System The Mythical Man-Month, he brought us 4 root causes of the difficulty in software system development: complexity conformity changability invisibility No Silver Bullet!? Same in SIM/SEM development! 第 23 页

24 The evolution of software development vs. info-sec system development Software Engineering(RUP XP CMM ) OO(MDA UML Design Pattern ) Platform(software platform, business application platform) Middleware Info-sec engineering (ISSE/SSE-CMM) Standard of Security Managment (ISO17799/BSI7799) IATF PKI/PMI Security Middleware Info Sec Application Oriented Platform 第 24 页

25 Global Goal Security Application Oriented Platform Business application oriented, to solve the problems of integration, interaction, extension, management of different security sub system, to reduce the total cost of own finally! 第 25 页

26 Security Application Oriented Platform 第 26 页

27 Attack-Defender Security Model Time Evolvement Domain Extension/Stratefication CORE Attacker plan Existed and New software Engineer technology Threat & Risk Risk Assessment input A s input s e t extend Lead to N e w V u l ref VUL Security Goal/Policy Attacker know enhance Common Vunerable VUL Exist knowledge enhance unknown Defender Know ref discovery Defender plan PPDRR technology management people Suite Hide and other postprocess Exploit and other attack Information acquistion Scan and validate Game Theory Attack (such as DOS) Track and trace affect SIM IDS HIDS NIDS recovery Response Prevention correlation Honeypot reattack issue Attacker event Information system Direct to Monitored host Monitored link Get event from issue Response event NetWork addr Interface Host configure Product Link Normal User Static part of issue Network Traffic 第 27 页

28 Information System/ Asset Attacker Defender Attack-Defender Security Model Security Goal/ Policy & Vulnerability 第 28 页

29 Distributed Programming in SOA Service Oriented Design Model is a revolution after OOD, which born in context of distributed computing Service Oriented Programming(SOP)is based on OOP Service is a predefined contract implemented by component and used by other components. The providing and using of the service are connected by contract which is interface in computer programming knowledge scope. 第 29 页

30 Concepts in Service Oriented Architecture Service Gateway Single Sign on Service Lookup SOA Domain& Context Transaction ACID Container Protocol Independent Framework 第 30 页

31 OpenSTF Core s Service Component Service Domain Service (Context) Policy Service Message and Transaction Service Internal Security Service (Authentication & Authorization) Universal UI Framework(GUIStarter) 第 31 页

32 The Definition of Middleware in General Middleware is a kind of reusable software Middleware s goal is resource sharing in distributed system Middleware not only implements connection but also inter-operation Middleware s application must be based on platform 第 32 页

33 The Concept of Security Middleware in OpenSTF Middleware is the collection of components which implement a certain type security function through collaboration The collaboration between them and other middleware assured and supported by services of OpenSTF core Middleware is the format of distribution, which has many properties: uuid, vendor, version, features, list of compontes The management of middleware and inside components is reached by OpenSTF core s Component Service 第 33 页

34 Data Exchange in SEM To solve the problem of multi-protocol in event collection with PIF provided by OpenSTF Core SNMP SYSLOG NTLOG OPSEC Database XML Protocol Independent Framework-PIF 第 34 页

35 Components in Event Processing Flow 第 35 页

36 The concept of Components in SEM Dynamic loading event collecting component according to event source s protocol Dynamic deploying online event processing component according to the event routing and processing policy Dynamic distributing visualization or UI component according the type of console 第 36 页

37 Realtime Risk Evaluation with Attack-Defender Security Model Value of Asset, which is static, imported from asset evaluation by service & consulting Vulnerability found by scanner or penetration tester Thread presented by security events Protection refer to the level of countermeasures 第 37 页

38 Incident Response Collaboration between SEM and 3 rd -party System or Device through Message Service provided by OpenSTF core Collaboration among peoples with role based workflow which begins with Transaction Service provided by OpenSTF Core 第 38 页

39 第 39 页