Enterprise-Wide Audit-Data Management

Transcription

1 Enterprise-Wide Audit-Data Management Enterprise Security Management Special Program Office (NSA/I5E) Lloyd E Lutz Jr Booz Allen Hamilton 27 October

2 Enterprise Security Management Overview Enterprise Management Mission Management Defend the GIG Logistics NetCentricity NetCentricity Servers Coordination Managers Command & Control Deployment Apps Lift ISR Fires Interdiction Enterprise Services Users Maneuver Communicatio ns Coalition Synchronizatio n NetOps NetOps Enterprise Security Management? Manage Identities Manage Attributes Authentication Manage Credentials Manage Digital Policies Manage Privileges Manage Cryptographic Keys Manage IA Metadata Manage Security Manage IA Audit Logs Configurations 2 27 October 2009

3 Scope of Audit-Data Management Audit-Data Management is one of 10 Enterprise Security Management Functions Four Key Audit Functions Capture Store Disseminate Control Audit Processes Direction to Devices Policy Direction for Storage of Control Audit Processes Direction Users Needs for Capture Store Pushed User Query Pushed or Pulled Disseminate Users of Audit Data Direction of Dissemination of Overall Management of Processes to Satisfy Users Needs for 3 27 October 2009

4 Hierarchy of Enterprise-Wide Management of Individual Devices Part of LAN or Platform Have Audit Capabilities Detect Device Events Capture Hold Report 4 27 October 2009

5 Hierarchy of Enterprise-Wide Management of Individual Devices Part of LAN or Platform Have Audit Capabilities Detect Device Events Capture Hold Report 5 27 October 2009

6 Hierarchy of Enterprise-Wide Management of Local Audit Node Each Device Is Controlled by One Local Audit Node Individual Devices Part of LAN or Platform Have Audit Capabilities Detect Device Events Capture Hold Report 6 27 October 2009

7 Hierarchy of Enterprise-Wide Management of Local Audit Nodes (Tier-3) Direct Auditing Devices Coordinate with Peers Verify Audit Configuration Receive from Devices Normalize Reduce Store Detect Local Events Report Local Events Individual Devices Part of LAN or Platform Detect Device Events Capture Hold Report Directed by One Local Audit Node 7 27 October 2009

8 Hierarchy of Enterprise-Wide Management of Region- Organization Audit (Tier-2) Plan & Direct Regional Audit Actions Direct Sets of Local Audit Nodes Coordinate with Peers (NetOps) Verify Direction Compliance Receive Event Reports Retrieve Store Detect Regional Events Report Regional Events Local Audit Nodes (Tier-3) Direct Auditing Devices Coordinate with Peers Verify Audit Configuration Receive from Devices Normalize Reduce Store Detect Local Events Report Local Events Individual Devices Part of LAN or Platform Detect Device Events Capture Hold Report Directed by One Local Audit Node 8 27 October 2009

9 Hierarchy of Enterprise-Wide Management of CC-Service- Agency Audit (Tier-1) Plan & Direct Auditing Coordinate with Peers (NetOps) Assess Audit Effectiveness Audit Capability Development Receive Event Reports Store Event Data Detect CC/S/A & Enterprise Events Report Events Region- Organization Audit (Tier-2) Plan & Direct Regional Audit Actions Direct Sets of Local Audit Nodes Coordinate with Peers (NetOps) Verify Direction Compliance Receive Event Reports Retrieve Store Detect Regional Events Report Regional Events Local Audit Nodes (Tier-3) Direct Auditing Devices Coordinate with Peers Verify Audit Configuration Receive from Devices Normalize Reduce Store Detect Local Events Report Local Events Individual Devices Part of LAN or Platform Detect Device Events Capture Hold Report Directed by One Local Audit Node 9 27 October 2009

10 Hierarchy of Enterprise-Wide Management of Enterprise CC-Service- Agency Audit (Tier-1) Plan & Direct Auditing Operations Enterprise Audit Policy Assess Audit Effectiveness Plan & Direct Auditing Coordinate with Peers (NetOps) Assess Audit Effectiveness Audit Capability Development Audit Capability Requirements Receive Reports Federate with Other Enterprises Receive Event Reports Store Event Data Detect CC/S/A & Enterprise Events Report Broad-Scope Events Region- Organization Audit (Tier-2) Plan & Direct Regional Audit Actions Direct Sets of Local Audit Nodes Coordinate with Peers (NetOps) Verify Direction Compliance Receive Event Reports Retrieve Store Detect Regional Events Report Regional Events Local Audit Nodes (Tier-3) Direct Auditing Devices Coordinate with Peers Verify Audit Configuration Receive from Devices Normalize Reduce Store Detect Local Events Report Local Events Individual Devices Part of LAN or Platform Detect Device Events Capture Hold Report Directed by One Local Audit Node October 2009

11 Compilation of High-Level Requirements Seeking Current Requirements Documents Initial Allocation to Level Within Enterprise Initial Identification of Policy Change Needs Binning by Capability Area Ongoing Efforts: Collection of Requirements Identification of Conflicts Identification of Needed Policy Community Review & Feedback October 2009

12 High-Level Architecture Developing Operational and later Systems Architectures Building upon Functional Decomposition Audit Management from ESM Working Group Initial Top Level Operational Activity Model Drafted Ongoing Steps: Increased Detail for Operational Activity Model Obtain Community Feedback Refine Operational Architecture Later: System Architectures for Selected Design Alternatives A3: Capture Audit & Environment Data Draft Operational Activity Model Device Configuration Commands Update Configuration On Devices A3.1 Observation Instructions Occurrences & Environment Data Observe Situations to Begin Collecting Data A3.2 Collection Action Collect Audit A3.3Data Audit Parameter Collection Instructions Raw Data Audit Log Format Instructions Write Audit Data to Audit Logs A3.4 Audit Log Legend Purpose: Display decomposition of Capture Audit & Environment Data function. Scope: Portions of enterprise that collect audit data. Viewpoint: From an enterprise level Send Audit Data For Transfer Preparation A3.5 Dissemination Instructions Alert/Event Data Audit Log Data October 2009

13 Top-Level Model of Enterprise-Wide Audit Audit Needs Situational Awareness from Others Policy Direct Security Audit Management A1 Management Draft Operational Activity Model Response to Audit Needs Situational Awareness for Others Instructions for Audit Legend Purpose: Display high-level functions of Audit Log Management Scope: All facets of Audit Log Management from a high level management perspective Viewpoint: From an enterprise level Current Configuration Configuration Change Acknowledgement Generate Configuration For Devices A2 Audit Log Management Configuration Change Request Queries Configuration Status Occurrences & Environment Data Capture Audit & Environment Data A3 Alert/Event Data Audit Log Data Transfer Data to Subscribers A4 Manage Storage A5 Alerts/Events (Transfer to Subscribers) Pattern Match Information Discovery Metadata (to Discovery Service) Query Response October 2009

14 High-Level Design of Enterprise Audit Components Based on Requirements, Identifying Trade Space for Enterprise Audit Components Cost to Implement, Cost to Operate, Training, Bandwidth Store at Local Level vs Store at Enterprise Level Identifying Set of Alternative Designs for Audit Components Management & Direction Storage Upcoming Actions: Flesh out design alternatives Solicit community feedback on trade-space & alternative designs October 2009

15 Concept of Operations (CONOPS) Explanations of How to Use Addresses Non-Materiel Aspects Procedures Anticipating a Family of CONOPS Separate CONOPS for distinct Roles Separate CONOPS same role at different Levels Upcoming Actions: As Audit Components are Designed, Prepare CONOPS for Applicable Roles & Levels Examples of Likely CONOPS Enterprise Audit Manager Service/Agency Audit Manager Repository Manager Tier-3 Repository Manager Tier-2 System Manager Management LAN Administrator Management October 2009

16 Schemas for Management Schema for Common Event Expression (CEE) Addresses: Audit Events Audit Records Audit Logs May be applicable to results of analysis of audit data. Capture Store Pushed Pushed or Pulled Schema for Directing Devices that Capture Common Command Language Other Schema Control Audit Processes Capture Direction October 2009

17 Enterprise-Wide Management Four Key Functions Capture Store Disseminate Control Audit Processes Policy Control Audit Processes Direction Users Needs for Capture Store Pushed User Query Pushed or Pulled Disseminate Users of Audit Data Ongoing Efforts are Addressing: Requirements & Policy Architectures & Design Alternatives Variety of Trade Spaces Allocation of Functions to Tiers of the Enterprise Family of Concept of Operations CONOPS by Role and Organizational Level Schema for Standard Data Flows October 2009

18 Enterprise-Wide Audit-Data Management Enterprise Security Management Special Program Office (NSA/I5E) 18