Symantec DeepSight Early Warning Services Portal

Transcription

1 TECHNICAL BRIEF: SYMANTEC DEEPSIGHT EARLY WARNING SERVICES PORTAL Symantec DeepSight Early Warning Services Portal Who should read this paper This paper is intended for administrators of the Symantec DeepSight Early Warning Services Portal, and describes best practices for customizing and utilizing the intelligence contained within the portal.

2

3 Content How to Customize Symantec DeepSight Early Warning Services Portal Setting Appropriate Threshold Values Setting Up A Technology List Uploading A Technology List DeepSight Analysis Tools Conclusion

4 How to Customize Symantec DeepSight Early Warning Services Portal With personalized notification triggers and customized reports, the Symantec DeepSight Threat Management System provides timely, relevant security information when and where you need it. DeepSight enables customers to develop a profile, set up monitoring, configure reports, and determine how, when, and with what frequency to receive reports. As a result, some upfront customization will help administrators get the most out of this powerful threat reporting and analysis tool. To ensure you get the most out of the DeepSight Early Warning Services Portal, you must first decide how you want to use it. Will it be used primarily to receive and view alerts, or will you use it to perform threat analyses? What types of alerts do you want to receive? How frequently do you want to receive them? How many and what types of devices will be used to receive alerts? The value provided by DeepSight is directly related to the amount of effort you put into configuring it to best meet your needs. Spending more time on the front end to customize it for your environment and level of threat sensitivity will maximize the value of the portal, while minimizing the impact to your organization. One of the most efficient methods for achieving this is to develop carefully configured monitors, to drive the type, frequency, and format of alerts. Listed below is a step-by-step guide for creating and configuring a new monitor: Step 1: Create a new monitor From the left navigation bar, select Configure Alerts. Any existing alerts will be listed in table format. Any of these existing alerts can be modified by selecting its corresponding delivery method or configure hyperlink. To create a new monitor, select the button in the bottom left corner of the page. 1

5 Step 2: Determine the type of monitor to be created Once you select Create a new monitor, you will be presented with a list of the various types of monitors that are available. Select the radio button that corresponds to the type you wish to create, then select Next. Tips and Tricks: Before long, you will likely find that you will want to create and configure every monitor to help proactively protect your network. While nearly every type and size of business will gain tremendous value from most monitors, very large enterprises and those which tend to be specifically targeted by malicious authors may derive additional benefits from specific monitors. For example, the Brand Protection monitor is very important for banks, well-known e-commerce sites, and other brands historically targeted by phishing attacks. This monitor will send you an alert whenever DeepSight sensors detect phishing sites targeting one of your domains. You can even configure this monitor to process the alert to your takedown service and you re done! Similarly, customers with well-known brands will find the Domain Monitor particularly valuable. This monitor protects against targeted attacks by triggering an alert whenever one of your domains is mentioned within malicious code alert or is targeted in an Internet event. Also, remember that there s no offense like a good defense. Much like an early warning alarm system, the Port Monitor was designed to provide early indications of future problems. This monitor uses the Key Predictors Alerting Model to detect when a specific port identified in your monitor configuration is being targeted. By knowing early, you can have the opportunity to thwart an attack before it occurs. 2

6 3 Symantec DeepSight Early Warning Services Portal

7 Step 3: Configure the new monitor On this screen, you will make all of the configuration decisions to customize your new monitor. Your first step will be to name your monitor. Then, you will need to make a variety of decisions, including threshold settings, additional information (such as what areas ports, protocols, or applications to scan), and the delivery method for any alerts. The specific information required will vary by the type monitor, but the exhibit below is meant to serve as an example of the type of information that will be required. Once all information has been completed, select Save in the bottom left corner. 4

8 5 Symantec DeepSight Early Warning Services Portal

9 Setting Appropriate Threshold Values Perhaps one of the most important determinations you will make when configuring your monitor is the threshold. In general, the thresholds you find in DeepSight monitors correspond to the ratings calculated for the associated alert/report type. Regardless of the threshold value you choose, only threats that are equal or higher than the threshold will result in an alert. Hence, a low threshold will likely result in far more alerts than is desirable. However, too high of a threshold can result in too few alerts, which can leave your organization vulnerable. As a best practice, check the urgency, severity, and impact of past threats to see which ones you would have wanted to have triggered an alert, then set the threshold values below what is listed for those. Listed below is a step-by-step guide for setting or modifying the threshold value: Step 1: View Past Alerts The best way to determine the level of sensitivity that s right for you is to view past alerts to see which ones you would have liked to have triggered a notification. To view these past alerts, select View Alerts from the left navigation bar, then select the Advanced Search tab. Choose a date range, alert type, and applicable technology list, then click Submit to run the query. Any existing alerts will be listed in table form at the bottom of the page. 6

10 Step 2 : Determine Your Level of Risk Aversion Use the urgency, severity, and impact ratings of each alert from the ensuing list to assess the risk levels of known threats and to determine your level of risk aversion. Step 3: Determine Your Threshold Values Use the urgency, severity, and impact ratings of each alert from the ensuing list to assess the risk levels. In setting your threshold values, choose your impact rating first, then on the other two. In other words, the impact rating is your main indicator, while the other two ratings can be used to fine-tune your alert threshold. 7

11 Setting Up A Technology List Technology lists are used to tell DeepSight about your specific environment, and are therefore one of the primary ways to get the most out of the system. Having a comprehensive set of technology lists that detail and categorize the products and technologies used throughout your network help the DeepSight system determine which alerts are most pertinent to your organization. Listed below is a step-by-step guide for creating and configuring a new technology list: Step 1: Creating A New Technology List From the left navigation bar, select Configure Alerts. Select Tech Lists from the tabs listed across the top of the page, then Create a new technology list from the bottom left corner of the page. Step 2: Configuring A New Technology List Before configuring your technology list, you will need to assign it a name. Be sure to name it something meaningful and practical, to enable you to easily identify it amongst your other lists at a later time. Remember, you re likely to develop dozens of lists over time, so you ll want to be able to keep them straight. Next, begin developing your list by selecting a category; once you do this, a list of associated vendors will dynamically populate in the box to the right. Similarly, once you have selected the appropriate vendor, a corresponding list of products will appear to the right, followed by the list of versions. You will want to be as explicit as possible, including or excluding each specific version, as applicable to your environment. Tips and Tricks: 8

12 Failing to include every version may be an obvious negative, since it can result in missing important alerts on products and technologies used in your environment. However, exclusions are equally important, so as to limit alerts to only those you care about. For example, if you have upgraded every client on your network to Microsoft Outlook 2007 Service Pack 2, you probably don t want to be bothered with alerts that only pertain to Service Pack 1. It is also advisable to keep each list to a family of technologies (for example, one for Windows and another for Mac OS). Otherwise, it will be much more difficult to immediately ascertain the specifics of each alert. This can be particularly problematic if your organization has technology specialists, since the Windows and Mac OS managers would both receive all alerts, irrespective of which operating system is affected. In addition, creating technology-specific lists enables different monitors with different threshold values to be developed for each of them, to correspond with each technology s specific level of risk. 9

13 Uploading A Technology List As an alternative to creating a new list as discussed above, you may choose to upload an existing technology list. This can save a great deal of time and effort, compared with developing a new technology list, and is therefore the preferred method for many administrators. There are two methods for uploading an existing technology list: Method 1: Updating An Existing Technology List From the left navigation bar, select Configure Alerts, then Tech Lists from the tabs listed across the top of the page. The inventory of all existing technology lists will be catalogued in the space below. Determine which one you wish to update, and select Upload Technology List from its menu of available actions. The name of the list will automatically populate the Technology List Name field of the Update Technology List Bulk Update section in the bottom half of the page. Next, select Browse to navigate to the list you wish to upload, then Upload Technology List. Method 2: Updating An Existing Technology List From the left navigation bar, select Configure Alerts, then Tech Lists from the tabs listed across the top of the page. Scroll to the Update Technology List Bulk Update section in the bottom half of the page and enter the name of your new list in the Technology List Name field. Next, select Browse to navigate to the list you wish to upload, then Create Technology List. 10

14 DeepSight Analysis Tools In addition to monitoring and reporting on threats, DeepSight includes a robust database, which contains more than 15 years of threat data. The data can be easily queried, enabling DeepSight to be utilized as a powerful analysis tool. Some of these analysis tools are discussed below. Honeynet Search Suspect Files Honeynet is a network of virtual systems deliberately exposed to compromise for analysis purposes. Honeynet displays information on the most recent 48 hours of threat activity, and archives all threat information to the DeepSight database. The database can be queried at any time to perform a search on any suspected files. To conduct the search, simply select Honeynet from the left navigation bar, then enter the MD5 hash of the file in question in the Suspect File Search field on the far right of the page. 11

15 Symantec DeepSight Early Warning Services Portal Within seconds, you will presented with the search results. If the MD5 matches any threats contained in the DeepSight database, it will be clearly identified including its name, specific variant, and the most recent date of detection in a new window. 12

16 Advanced Threat Search Investigate Suspect Tools Open source and other freely available tools can help dramatically boost workplace productivity. However, many of these same tools can also pose network threats. If you don t know where the tool came from, the risk may be too great to allow onto the network. Users often inadvertently download these rogue tools and bring them into the workplace, completely unaware of the risks. Through its advanced threat search tool, DeepSight enables you to check the security record for any tool a user wishes to install, allowing you to strike a balance between productivity and security. Using the advanced threat search tool, the DeepSight database can be queried at any time to perform a search on any unknown or suspect tools. To conduct the search, select View Alerts from the left navigation bar, then the Advanced Search tab from across the top of the page. Set the display option to All Alerts, then set the date period, date range, and alert type as desired. Then enter the specific tool information in the fields provided; this information can include detailed information, or it can be as simple as the product name. Once all information has been completed, select Submit in the bottom left corner of the page. In a few moments, you will presented with the search results. All threats, vulnerabilities, and alerts that were caused by, or associated with, the tool will be clearly displayed in a table at the bottom of the page. The table will include the title, date the threat was last updated, the CVE ID (if applicable), and the applicable ratings. 13

17 If additional details are required, simply click on the title of the threat in question, and a detailed report will be generated in a separate window. This detailed report provides a short summary and a technical description of the threat, as well as attack scenarios and mitigating strategies. As a result, you can make a fully informed decision regarding the tool; and in the event that an unauthorized tool gets in, DeepSight can show you how to eliminate the problem in the most efficient manner. 14

18 Conclusion DeepSight Early Warning Services Portal can offer a global perspective on threats and vulnerabilities that could negatively impact your business critical systems. With effective customization, this intelligence can be even more valuable, enabling administrators to identify and address issues in a timely manner, therefore reducing the potential of any emerging incidents. 15

19

20 About Symantec Symantec protects the world s information and is the global leader in security, backup, and availability solutions. Our innovative products and services protect people and information in any environment from the smallest mobile device, to the enterprise data center, to cloud-based systems. Our industry-leading expertise in protecting data, identities, and interactions gives our customers confidence in a connected world. More information is available at or by connecting with Symantec at go.symantec.com/socialmedia. For specific country offices and contact numbers, please visit our website. Symantec World Headquarters 350 Ellis St. Mountain View, CA USA +1 (650) (800) Symantec helps organizations secure and manage their information-driven world with managed services, exchange spam filter, managed security services, and antivirus. Copyright 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. 8/