IT Sicherheit im Web 2.0 Zeitalter

Transcription

1 IT Sicherheit im Web 2.0 Zeitalter Dirk Beste Consulting System Engineer 1

2 IT Sicherheit im Web 2.0 Zeitalter Cisco SIO und Global Threat Correlation Nach dem Webinar sollte der Zuhörer in der Lage sein: Die Motivation für die Cisco Security Operations zu verstehen Den Mehrwert der Global-Correlation für die Analyse und Abwehr von Sicherheitsbedrohungen erkennen Die Implementierung & Arbeitsweise von Global- Correlation-Funktionen in den Web-, -, Firewall- und IPS-Produkten von Cisco verstehen 2

3 Agenda Cisco Security Intelligence Operation Einführung und Grundlagen Mehrwert für die Praxis Elemente für den Betrieb Implementierung & Arbeitsweise WEB- und -Security Firewall- und IPS-Appliances Zusammenfassung 3

4 The Challenge Today Countervailing Forces Globalization Threats Mobility Acceptable Use Collaboration Enterprise SaaS Data Loss 4

5 A Seismic Shift : IT Security Products Look Deeper 2009: Cisco Security Products Look Around and Respond Faster 5

6 Cisco Security Intelligence Operations Powerful Protection through Network Scanning Elements Cisco SensorBase Threat Operations Center Dynamic Updates Security Infrastructure that Dynamically Provides Intelligence to Network Scanning Elements 6

7 Cisco Global Correlation Unmatched Breadth LARGEST FOOTPRINT GREATEST BREADTH FULL CONTEXT ANALYSIS Security IPS Web Security Firewall Identifying a global botnet requires complete visibility across all threat vectors 7

8 Cisco SIO Cisco SensorBase Largest Network, Highest Data Quality, Unmatched Breadth 8

9 Cisco SensorBase Network Unmatched Visibility Into Global Threats Most Devices 1M security devices, 10M clients shipped per year Core Internet routers Cloud-based services Largest Footprint 30% of the world s traffic 200+ parameters 368GB per day sensor feeds Diverse Sources Eight of the top ten ISPs Fortune 500, Global 2000, universities, SMBs 152 third-party feeds First to Combine Network and Application Layer Data 9

10 Cisco SensorBase Network Unmatched Breadth SensorBase Network Firewall / IPS Spam with Malicious Attachment Directed Attack Spam with Malicious Attachment Web Directed Attack Malware Distributing Site 10

11 Cisco SIO Cisco Threat Operations Center (TOC) Advanced Research and Development, Security Modeling, Experienced Analysts 11

12 Cisco Threat Operation Center Advanced Research and Development Millions in R&D investment Threat experts and statisticians Equipment and infrastructure Thought leadership, prevention and best practices expertise 76 patents Innovative services IPS Global Correlation ASA Botnet Traffic Filters Virus Outbreak Filters Reputation Filters (IPS, , web, etc.) 12

13 Cisco Threat Operations Center Sophisticated Security Modeling and Remediation Advanced algorithms Dynamic real-time scoring Fast threat identification Automated rule and/or signature creation Human-aided rule creation White Hat engineers Penetration testing Botnet infiltration Malware reverse engineering Global Correlation Supervised Learning Unsupervised Learning Reputation Scoring Real-Time Anomaly Detection Product & Customer Feedback 13

14 Cisco Threat Operations Center Ensuring Accuracy and Responsiveness Experienced Analysts 500 analysts European and Asian languages 1 Cisco Fellow 80+ Ph.D.s, CCIEs, CISSPs, MSCEs 24x7x365 Operations 5 threat operations center locations around the globe San Jose, San Bruno, Austin, North Carolina, Shanghai Powerful Tools Dynamic updates Correlation and data mining Advanced rule approval, creation and publishing applications 14

15 Cisco SIO Broadest Enforcement Capabilities Fast Device Scanning Engines and Granular Policy 15

16 Advanced Protection Putting It All Together Cisco Products and Services: High-performance, flexible enforcement points www Adaptive Security Appliances Intrusion Prevention Solution Web Security Appliances Security Appliances Hosted Services Security Filters: Industry s most effective security features Virus Outbreak Filters Anti-Spam Reputation Filters Web Reputation Filters IPS Reputation and Signature Filters Firewall Botnet Traffic Filters Cisco SIO: Cloud-based intelligence to power Cisco security services Live New and Authored Reputation Dynamic Auto-Updates Updated Rule Scores Sets Rule Sets Every Signatures 5 minutes 16

17 Cisco SIO In Action 17

18 Cisco SIO In Action Obama Botnet 1. Baseline threat data installed in Cisco security devices 2. Spoofed for Obama speech triggers alert to Cisco SIO 3. Rule update to: ASA firewall Web security appliances IPS 4. Botnet servers blocked rules rules rules SIO rules rules www 18

19 New President, New Malware Users receive an inviting them to watch President-elect Barack Obama's victory speech Links users to a government themed botsite Subject Line Examples: - Election Results Winner - The New President s Cabinet? L.htm?LOGIN=BfQd3Zno5H&VERIFY=0AHBgl9ixN7rvXm certificateupdate/osl.htm?login=zeuroewtlo&verify=c5rcwjj7qjsuveb L.htm?LOGIN=Tch0JQdfFS&VERIFY=KkiwFDDIWZhvVNJ *Still Active* Malicious URLs 19

20 Government Themed Botsite BOTSITE REAL SITE Users prompted to install an Adobe Flash Player update, which is actually data-stealing malware Steals screen shots, passwords and sends to a web server located in Kiev, Ukraine 20

21 Blocked by Web Reputation Filters All Malicious URLs were automatically blocked by Web Reputation Filters 3 URLs still active and serving malware 21

22 Web Reputation New Threat Alert THREAT: Fake Virus Scan & Software VECTOR: Web; Top 20 Google Search Results SITE: 22

23 Google Search On Hurricane Jimena Top 20 Google search results 23

24 The Malicious Redirection Begins The user is notified that they need to run an immediate virus scan; possible virus infection! Step 1 of 5 24

25 The user is notified their computer is infected Step 2 of 5 25

26 Next, the user is shown a list of Trojans found on their computer Step 3 of 5 26

27 Then the user is prompted to download the Total Security software for protection Step 4 of 5 27

28 Malicious software gets installed Step 5 of 5 28

29 Infected! Look at the CPU consumption 29

30 New Domain, Same Malware! Same Google search, clicking on the same link, the user is redirect to a different domain ( 30

31 The Actual Web Site 31

32 All Blocked by Web Reputation SITE: ; default block SITE: ; default block 32

33 Principles & Configuration Cisco and Web-Security Appliances 33

34 How SensorBase Data Makes the Difference for Mail Works 150 Parameters Complaint Reports Threat Prevention in Realtime Spam Traps Message Composition Data Global Volume Data URL Lists Compromised Host Lists SensorBase Data Data Analysis/ Security Modeling SenderBase Reputation Scores -10 to +10 Web Crawlers IP Blacklists & Whitelists Additional Data 34

35 Preventive Anti-Spam Defense: Reputation Filters Known good is delivered Incoming Mail Good, Bad, and Grey or Unknown Reputation Filtering Anti-Spam Engine Suspicious is rate limited & spam filtered Known bad is deleted/tagged Stop 80% Hostile Mail at the Door. 35

36 Cisco IronPort Web Reputation Filters Data Makes the Difference Parameters URL Blacklists URL Whitelists URL Categorization Data HTML Content Data URL Behavior Global Volume Data Domain Registrar Information Dynamic IP Addresses Compromised Host Lists Web Crawler Data Network Owners Known Threats URLs Offline data (F500, G2000 ) Website History SensorBase Data THREAT PREVENTION IN REALTIME Data Analysis/ Security Modeling Web Reputation Scores (WBRS) -10 to +10 Addresses Known and Unknown Sites 36

37 Intelligent Scanning Known good sites aren t scanned Requested URLs IRONPORT WEB REPUTATION FILTERS Unknown sites are scanned by one or more engines ANTI-MALWARE SYSTEM DECRYPTION ENGINE Known bad sites are blocked IronPort Web Reputation technology determines need for scanning by - IronPort Anti-Malware System - Decryption Engine 37

38 Principles & Configuration Cisco Firewall-Appliances 38

39 Botnet Filtering Process Cisco Security Intelligence Operations (SIO) 2 Internet 1 Cisco ASA Botnet Filter 3 Step 1: Infected clients try to communicate with a command and control host on the Internet Step 2: Cisco SIO updates the Cisco ASA botnet filter list; the destination is a known attack site Step 3: Alerts go out to the security teams for prevention, mitigation, and remediation 39

40 Botnet Traffic Filters in ASA v8.2 Reliable Detection of Infected Clients Infected Clients Cisco ASA 5500 Series Malware Command and Control Scans all traffic, ports and protocols for rogue phone home traffic Provides visibility to infected clients within corporate network 40

41 Botnet Traffic Filter Enable Directly from Cisco ASDM Configuration Menus Cisco SIO data Custom lists Interface or global 41

42 Botnet Traffic Filter Reports Top Botnet Sites and Ports 42

43 Botnet Traffic Filter Reports Top Infected Hosts 43

44 Principles & Configuration Cisco Intrusion-Prevention-Appliances 44

45 Cisco IPS with Global Correlation Correlation of SensorBase Data Reputation Filters 1 st Automatically correlates SensorBase threat data Packets with negative Reputation are dropped Fast response to emergent threats Enhances detection capabilities Signature Inspection Anomaly Detection 1 st Global Correlation Decision Engine Reduces the window of exposure Pinpoint Accuracy Analyzes the attacker as well as the attack Leverages reputation filters to stop known attackers (40% of attackers are repeat offenders) Empowered Presentation_ID Branch 2009 Cisco Systems, Inc. All rights reserved. Cisco Cisco Confidential Public 45

46 Dynamic Protection Accurate Local Analysis Risk Rating Cisco Patent What is the Attack? Who is the Attacker? What is the Target? Risk Rating Engine 46

47 Defeating SQL Injection The Challenge of Traditional Signature-Based IPS What SIGNATURES Find Verdict: UNKNOWN What? SQL Command Fragments in Web Traffic This could be your billing system talking to your customer database. Or.. 47

48 IPS Reputation Enables Protection Powered By Global Correlation What CISCO IPS Finds Verdict: BLOCK What? How? SQL Command Fragments in Web Traffic First HTTP connection Who? Where? Dynamic IP Address Dynamic DNS History of Web Attacks Within Heavily Compromised.Asia Network History of Botnet Activity Clean Sources Only 48

49 Defeating SQL Injection Collaborate with Confidence Traditional Signature only IPS view without Reputation Global Correlation Enabled IPS allows Confident Deny Action 49

50 Cisco IPS 7.0 with Global Correlation Changing Network IPS to Global IPS Coverage Twice the effectiveness of signature-only IPS Accuracy Reputation analysis decreases false positives Timeliness 100x faster than traditional signature-only methods Results Averaged Over Two Week Period in Pre-release Deployments Harnessing the Power of Cisco Security Intelligence Operations 50

51 Vision 51

52 Cisco Security Intelligence Operations Vision More Cisco devices will be linked into the Cisco Shared Defense Network This will provide global analysis, and be more informative about how your Cisco network is defending itself 52

53 53