Network Payload Analysis for Advanced Persistent Threats Charles Smutz, Lockheed Martin CIRT
|
|
|
- Silvester Lambert
- 10 years ago
- Views:
Transcription
1 Network Payload Analysis for Advanced Persistent Threats Charles Smutz, Lockheed Martin CIRT /6/2010 1
2 About Speaker Name Background Current Job Employer Education Charles Smutz Sysadmin, Networking, C&A Lead Software Developer Lockheed Martin CIRT Pursuing PhD at GMU 2
3 Background Understanding of APT Persistent, Organized, Targeted CNE Typical APT Attack Sequence Importance of Threat Focused CND/Security Intelligence You ll have this by end of Summit 3
4 Topics Motivation Why do network payload analysis Suggestions for Capabilities What data to collect Importance of Normalized Payload Analysis Importance of Information Retrieval How to implement Capabilities COTS/FOSS Build Your Own 4
5 Why Network Analysis Important Data Source 4n6 and Detection Intertwined 4n6 identifies and vets indicators Detections feed 4n6 Facilitate Pre-Compromise Detection Strong Compliment to Host Analysis Complete Attack Sequence Analysis 5
6 Network Analysis Pros/Cons Benefits Passive nature limits impact to network Omniscience at network tap points Control over data retention Drawbacks Network forensics requires explicit data retention Encryption 6
7 Net vs. Host Compromise IR Predominately Host Predominately Network Detection Malware C2 Beacon Collection Artifacts Damage Assessment Host Logs, Memory Image, Disk Images Malware, (Deleted) Tools and Staged Data, Anything in Memory/Swap/Hyberfil Commands Passwords Lateral Movement Dropped Tools Exfilled Data Days/Weeks Network Logs, Packet Captures Full Command and Control Decodes Commands Passwords Lateral Movement Dropped Tools Exfilled Data Hours/Days 7
8 Beyond FPC FPC is expensive, unwieldy Strategies for Targeted Data Collection Network Transaction Logs Payload Collection Payload Metadata Information Retrieval For Accessibility 8
9 Network Transaction Logs Situational Awareness--Inbound of HTTP Requests Direct Attacks (SQL injection etc) Attacker Reconnaissance Options: Sift through FPC Collect, normalize, centralize all webserver logs Snarf and reconstruct web activity Lots of tools to do this Bro, Suricata, HTTPry, etc What about other protocols? 9
10 Attacks Moving Up Stack Document and Multimedia Viewers, Browsers 10
11 Attacks Moving Up Stack Users Highly Targeted Social Engineering Exploits 11
12 Attacks Moving Up the Stack From: Received: from open.relay.com ([ ]) by mx.company.com Received: from now.bad.com ([ ]) by mx.relay.com Date: Thu, 17 Jun :03: (PDT) Message-Id: X-Mailer: SillyMailer v3.14 Subject: All your Base are belong to us Please review attached. Edward Spoofed Spoofed Inc InfoKey: Creator InfoValue: Acrobat PDF Printer InfoKey: Author InfoValue: TK421 InfoKey: Producer InfoKey: ModDate InfoValue: D: '00' PdfID1: 8d23f593e67be992ff3470d PdfID0: 798f9d8e3966ac586a61dc0 for(fqchp=0;fqchp<inxnh;fqchp++) {dnysj[fqchp]=dtkrx + hjnoa;} if(ingmh){hsbsd();hsbsd();try {this.media.newplayer(null);} catch(e) {}hsbsd();} <Obfuscated Embedded Malware> 12
13 Attacks Moving up Stack from legitimate relay with Trojan Document Attachment Layer Protocol Badness Embedded Object Application Transport Internet Link PDF SMTP/MIME Spoofed Sender, Social Engineering TCP - IP - Ethernet - Exploit/Social Engineering, Malware 13
14 Indicators Moving Up Stack Users Useful Indicators 14
15 Indicators Moving Up the Stack 12:03: tcp > FIN From: Received: from open.relay.com ([ ]) by mx.company.com Received: from now.bad.com ([ ]) by mx.relay.com Date: Thu, 17 Jun :03: (PDT) Message-Id: X-Mailer: SillyMailer v3.14 Subject: All your Base are belong to us Please review attached. Edward Spoofed Spoofed Inc InfoKey: Creator InfoValue: Acrobat PDF Printer InfoKey: Author InfoValue: TK421 InfoKey: Producer InfoKey: ModDate InfoValue: D: '00' PdfID1: 8d23f593e67be992ff3470d PdfID0: 798f9d8e3966ac586a61dc0 for(fqchp=0;fqchp<inxnh;fqchp++) {dnysj[fqchp]=dtkrx + hjnoa;} if(ingmh){hsbsd();hsbsd();try {this.media.newplayer(null);} catch(e) {}hsbsd();} <Obfuscated Embedded Malware> 15
16 Targeted Collection and Analysis Web USB Targeted attacks warrant targeted data collection 16
17 Data Collection Options Basic Transaction Data Network Flow Data Full Packet Capture Normalized s Reassembled, Decoded, Indexed Extended Metadata Headers: Subject, X-Mailer, Received MIME Metadata: Names, Size, md5 Links Attachments (specific type?) Attachment Metadata: Author, Creator, Dates 17
18 Usability Is Nice 18
19 Tiered Collection Data Retention Length Size / Day Total Size FPC (entire network) 1 week 1 TB 7 TB Network Flow (entire network) 1 year 4 GB 1.5 TB Standard Mail Logs 2 year 50 MB 36 GB Normalized, Indexed s 6 weeks 20 GB 800 GB Extended Metadata 6 months 500 MB 100 GB Attachment Metadata 6 months 100 MB 20 GB 19
20 Accessibility Is Critical Rapid accessibility is critical: Historical Detections Identifying and vetting indicators Time to research an indicator matters 1s, 1 minute, 1 hour, 1 day? The faster you can research activity over large spans of time, the faster you ll build threat intelligence 20
21 From: Received: from open.relay1.com ([ ]) by mx.company.com Received: from now.bad.com ([ ]) by mx.relay.com Date: Mon, 28 Dec :48: Message-Id: X-Mailer: SillyMailer v3.14 <Malware 1.3> From: Received: from mx.openrelay2.com ([ ]) by mx.company.com Received: from now.bad.com ([ ]) by mail.openrelay2.com Date: Mon, 5 Mar :35: (PDT) Message-Id: < @mailer> X-Mailer: SillyMailer v3.14 <Malware 2.0> From: [email protected] Received: from relay.all.com ([ ]) by mx.company.com Received: from now.bad.com ([ ]) by mx.relay.com Date: Thu, 17 Jun :03: (PDT) Message-Id: < @mailer> X-Mailer: SillyMailer v3.14 <Malware 2.01> 21
22 Ultra Light Weight Indexing Rapidly Search Key Indicator Types IP addresses, Domains, etc Low Resolution Log Type: proxy, , etc Time: ~Day Per Device: proxy1, proxy2, proxy3 Huge Scope Time: indefinite retention Data Sources: All Performance Fast, << 1s response times 22
23 Ultra Light Weight Indexing Example search for : Data Type Source Date Indicator -metadata mx inbound-http sensor metadata mx
24 Implementing Payload Analysis Tools Passive Collection: Adapt an FPC Tail collection, filter normalize, extract Adapt an IDS Filter, normalize, extract, archive Inline Collection Milter, ICAP, etc Differences probably nuances, End goal is the same 24
25 Payload Analysis Issues Issues to be addressed: Latency Computational Expense Implementing Payload Specific Capabilities 25
26 Payload Analysis: Latency IDS/IPS bound by real time FPC provides on-demand data/processing (arbitrarily long) High Latency Analysis to be preformed (lookups) Payload analysis for 4n6 usually should be somewhere in between Usually no benefit to be quicker than minute For some applications slower than hour can slow down response Often daily processing makes sense 26
27 Payload Analysis: Complexity Expensive Tasks Decoding, decompression, etc Parsing, tokenizing, metadata extraction Normalized archival (buffer copies) Payload Identification Any inherently computationally expensive things Statistical analysis Compression Etc 27
28 Latency and Complexity Heavy Buffering 1 Gpbs * 60s = 7.5 GB RAM (dirt cheap) True Parallelism Load balancing needs to move up stack also Example later 28
29 Implementing Payload Specific Capabilities Use existing network capabilities Protocol Parsers Mime::Parser, etc Use payload capabilities Payload Analyzers pdftk, pdf-parser, Officecat, etc Use your in-house tools on extracted payloads Build network tools that work on objects (Abstraction) 29
30 Near Real Time IDS Platforms vortex (Lockheed Martin) Abstracts capture and TCP stream reassembly, simple method for multithreading snort-nrt (Sourcefire VRT) Commitment to payload analysis Ruminate (George Mason University) Focus on efficiency, scalability, completeness of parsing 30
31 Vortex Overview Captured Network Traffic Vortex Stream Management, Flow Control Libnids TCP Stream Reassembly Libpcap Stream Metadata (STDOUT) Analyzer Program Reads Metadata, Loads Stream Data, Analyzes, optionally Purges Stream Data Packet Capture/Filtering Stream Data File System 31
32 Vortex Multithreaded Captured Network Traffic Vortex Stream Metadata (STDOUT) Xpipes Load Balancing Analyzer Program Analyzer Program Analyzer Program Analyzer Program Stream Data File System 32
33 Conclusions Network Data is important source for 4n6 Strategies for Network Data Collection Conventional (netflow, logs, FPC) Targeted (playloads, payload metadata) Importance of data accessibility Normalization Search and Retrieval Ideas on Implementation 33
34 Questions? Personal Blog: 34
35 35
36 APT Attack Sequence Pre-Compromise Reconnaissance Weaponization Delivery Exploit Installation Reconnaissance Initial Intrusion Post-Compromise Command & Control Actions on Intent Establish Backdoor Obtain User Credentials Install Various Utilities Priv. Escalation, Lateral Move., Data Exfil. Maintain Persistance 36
Network Security Monitoring
Network Security Coleman Kane [email protected] September 24, 2014 Cyber Defense Overview Network Security 1 / 23 Passive Passive 2 Alert Alert Passive monitoring analyzes traffic with the intention
CHANGING THE SECURITY MONITORING STATUS QUO Solving SIEM problems with RSA Security Analytics
CHANGING THE SECURITY MONITORING STATUS QUO Solving SIEM problems with RSA Security Analytics TRADITIONAL SIEMS ARE SHOWING THEIR AGE Security Information and Event Management (SIEM) tools have been a
Firewalls, IDS and IPS
Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not
Comprehensive Advanced Threat Defense
1 Comprehensive Advanced Threat Defense June 2014 PAGE 1 PAGE 1 1 INTRODUCTION The hot topic in the information security industry these days is Advanced Threat Defense (ATD). There are many definitions,
RSA Security Analytics
RSA Security Analytics This is what SIEM was Meant to Be 1 The Original Intent of SIEM Single compliance & security interface Compliance yes, but security? Analyze & prioritize alerts across various sources
ThreatSpike Dome: A New Approach To Security Monitoring
ThreatSpike Dome: A New Approach To Security Monitoring 2015 ThreatSpike Labs Limited The problem with SIEM Hacking, insider and advanced persistent threats can be difficult to detect with existing product
You Don t Know What You Can t See: Network Security Monitoring in ICS Rob Caldwell
You Don t Know What You Can t See: Network Security Monitoring in ICS Rob Caldwell Mandiant, a FireEye company [2014 SANS European ICS Summit] About me Currently: Principal Consultant on Mandiant s Industrial
P Principles of Network Forensics P Terms & Log-based Tracing P Application Layer Log Analysis P Lower Layer Log Analysis
Agenda Richard Baskerville P Principles of P Terms & -based Tracing P Application Layer Analysis P Lower Layer Analysis Georgia State University 1 2 Principles Kim, et al (2004) A fuzzy expert system for
Barracuda Intrusion Detection and Prevention System
Providing complete and comprehensive real-time network protection Today s networks are constantly under attack by an ever growing number of emerging exploits and attackers using advanced evasion techniques
Web Traffic Capture. 5401 Butler Street, Suite 200 Pittsburgh, PA 15201 +1 (412) 408 3167 www.metronomelabs.com
Web Traffic Capture Capture your web traffic, filtered and transformed, ready for your applications without web logs or page tags and keep all your data inside your firewall. 5401 Butler Street, Suite
Presented by: Mike Morris and Jim Rumph
Presented by: Mike Morris and Jim Rumph Introduction MICHAEL MORRIS, CISA Systems Partner JIM RUMPH, CISA Systems Manager Objectives To understand how layered security assists in securing your network
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? A Typical Attack Scenario
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? Drive-by Downloads are a common technique used by attackers to silently install malware on a victim s computer. Once a target website has been weaponized with
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
Network Intrusion Analysis (Hands-on)
Network Intrusion Analysis (Hands-on) TCP/IP protocol suite is the core of the Internet and it is vital to understand how it works together, its strengths and weaknesses and how it can be used to detect
How to Build a Massively Scalable Next-Generation Firewall
How to Build a Massively Scalable Next-Generation Firewall Seven measures of scalability, and how to use them to evaluate NGFWs Scalable is not just big or fast. When it comes to advanced technologies
RSA Security Anatomy of an Attack Lessons learned
RSA Security Anatomy of an Attack Lessons learned Malcolm Dundas Account Executive John Hurley Senior Technology Consultant 1 Agenda Advanced Enterprise/ Threats The RSA Breach A chronology of the attack
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT
BREAKING THE KILL CHAIN AN EARLY WARNING SYSTEM FOR ADVANCED THREAT Rashmi Knowles RSA, The Security Division of EMC Session ID: Session Classification: SPO-W07 Intermediate APT1 maintained access to
Network Security Monitoring
Network Security Monitoring Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
IBM Protocol Analysis Module
IBM Protocol Analysis Module The protection engine inside the IBM Security Intrusion Prevention System technologies. Highlights Stops threats before they impact your network and the assets on your network
Practical Steps To Securing Process Control Networks
Practical Steps To Securing Process Control Networks Villanova University Seminar Rich Mahler Director, Commercial Cyber Solutions Lockheed Martin Lockheed Martin Corporation 2014. All Rights Reserved.
Targeted attacks: Tools and techniques
Targeted attacks: Tools and techniques Performing «red-team» penetration tests Lessons learned Presented on 17/03/2014 For JSSI OSSIR 2014 By Renaud Feil Agenda Objective: Present tools techniques that
Effective IDS/IPS Network Security in a Dynamic World with Next-Generation Intrusion Detection & Prevention
Effective IDS/IPS Network Security in a Dynamic World with Next-Generation Intrusion Detection & Prevention Your Security Challenges Defending the Dynamic Network! Dynamic threats 䕬 䕬 䕬 䕬 Many threats
Network/Internet Forensic and Intrusion Log Analysis
Course Introduction Enterprises all over the globe are compromised remotely by malicious hackers each day. Credit card numbers, proprietary information, account usernames and passwords, and a wealth of
Network Intrusion Detection Systems. Beyond packet filtering
Network Intrusion Detection Systems Beyond packet filtering Goal of NIDS Detect attacks as they happen: Real-time monitoring of networks Provide information about attacks that have succeeded: Forensic
The Power of SNORT SNORT Update
The Power of SNORT SNORT Update Jean-Paul Kerouanton 11 th May 2010 2 Leveraging the Snort Brand The Power SNORT = The Power of Open Source The SNORT- Universe AMAZON - +100 items GOOGLE +3.700.000 hits
Detect & Investigate Threats. OVERVIEW
Detect & Investigate Threats. OVERVIEW HIGHLIGHTS Introducing RSA Security Analytics, Providing: Security monitoring Incident investigation Compliance reporting Providing Big Data Security Analytics Enterprise-wide
Intro to Firewalls. Summary
Topic 3: Lesson 2 Intro to Firewalls Summary Basic questions What is a firewall? What can a firewall do? What is packet filtering? What is proxying? What is stateful packet filtering? Compare network layer
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology
Network Forensics: Log Analysis
Network Forensics: Analysis Richard Baskerville Agenda P Terms & -based Tracing P Application Layer Analysis P Lower Layer Analysis Georgia State University 1 2 Two Important Terms PPromiscuous Mode
Comparison of Firewall, Intrusion Prevention and Antivirus Technologies
White Paper Comparison of Firewall, Intrusion Prevention and Antivirus Technologies How each protects the network Juan Pablo Pereira Technical Marketing Manager Juniper Networks, Inc. 1194 North Mathilda
Advanced Threats: The New World Order
Advanced Threats: The New World Order Gary Lau Technology Consulting Manager Greater China [email protected] 1 Agenda Change of Threat Landscape and Business Impact Case Sharing Korean Incidents EMC CIRC
Bricata Next Generation Intrusion Prevention System A New, Evolved Breed of Threat Mitigation
Bricata Next Generation Intrusion Prevention System A New, Evolved Breed of Threat Mitigation Iain Davison Chief Technology Officer Bricata, LLC WWW.BRICATA.COM The Need for Multi-Threaded, Multi-Core
Solution of Exercise Sheet 5
Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????
PROFESSIONAL SECURITY SYSTEMS
PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security
Passive Logging. Intrusion Detection System (IDS): Software that automates this process
Passive Logging Intrusion Detection: Monitor events, analyze for signs of incidents Look for violations or imminent violations of security policies accepted use policies standard security practices Intrusion
Chapter 15. Firewalls, IDS and IPS
Chapter 15 Firewalls, IDS and IPS Basic Firewall Operation The firewall is a border firewall. It sits at the boundary between the corporate site and the external Internet. A firewall examines each packet
Security Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis?
Security Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis? This paper presents a scenario in which an attacker attempts to hack into the internal network
Networks & Security Course. Web of Trust and Network Forensics
Networks & Security Course Web of Trust and Network Forensics Virtual Machine Virtual Machine Internet connection You need to connect the VM to the Internet for some of the Web of Trust exercises. Make
Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
CS 640 Introduction to Computer Networks. Network security (continued) Key Distribution a first step. Lecture24
Introduction to Computer Networks Lecture24 Network security (continued) Key distribution Secure Shell Overview Authentication Practical issues Firewalls Denial of Service Attacks Definition Examples Key
Firewall Design Principles Firewall Characteristics Types of Firewalls
Firewall Design Principles Firewall Characteristics Types of Firewalls Special Thanks to our friends at The Blekinge Institute of Technology, Sweden for providing the basis for these slides. Fall 2008
Network Monitoring using MMT:
Network Monitoring using MMT: An application based on the User-Agent field in HTTP headers Vinh Hoa LA Ɨ Raul FUENTES Ɨ PhD Student Prof. Ana CAVALLI Ɨ Ƭ Supervisor Ɨ Telecom SudParis, IMT Ƭ Montimage
Managing Latency in IPS Networks
Application Note Revision B McAfee Network Security Platform Managing Latency in IPS Networks Managing Latency in IPS Networks McAfee Network Security Platform provides you with a set of pre-defined recommended
A Research Study on Packet Sniffing Tool TCPDUMP
A Research Study on Packet Sniffing Tool TCPDUMP ANSHUL GUPTA SURESH GYAN VIHAR UNIVERSITY, INDIA ABSTRACT Packet sniffer is a technique of monitoring every packet that crosses the network. By using this
What is Firewall? A system designed to prevent unauthorized access to or from a private network.
What is Firewall? A system designed to prevent unauthorized access to or from a private network. What is Firewall? (cont d) Firewall is a set of related programs, located at a network gateway server. Firewalls
Intrusion Detection in AlienVault
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
Firewalls. Firewalls. Idea: separate local network from the Internet 2/24/15. Intranet DMZ. Trusted hosts and networks. Firewall.
Firewalls 1 Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Intranet Router DMZ Demilitarized Zone: publicly accessible servers and networks 2 1 Castle and
High-Performance Network Data Capture: Easier Said than Done
Introduction Network data capture is an essential tool for all IT disciplines. It has proven to be the best way to find and fix the most difficult performance issues and network outages, because it is
Cybercrime: evoluzione del malware e degli attacchi. Cesare Radaelli Regional Sales Manager, Italy [email protected]
Cybercrime: evoluzione del malware e degli attacchi Cesare Radaelli Regional Sales Manager, Italy [email protected] About Palo Alto Networks We are the network security company World-class
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 40 Firewalls and Intrusion
CSCI 4250/6250 Fall 2015 Computer and Networks Security
CSCI 4250/6250 Fall 2015 Computer and Networks Security Network Security Goodrich, Chapter 5-6 Tunnels } The contents of TCP packets are not normally encrypted, so if someone is eavesdropping on a TCP
Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP
Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2
Effective Methods to Detect Current Security Threats
terreactive AG. Swiss Cyber Storm 2015. Effective Methods to Detect Current Security Threats Taking your IT security to the next level, you have to consider a paradigm shift. In the past companies mostly
The Advantages of a Firewall Over an Interafer
FIREWALLS VIEWPOINT 02/2006 31 MARCH 2006 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor organisation to the Centre for the Protection
Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected]
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected] A number of devices are running Linux due to its flexibility and open source nature. This has made Linux platform
Missing the Obvious: Network Security Monitoring for ICS
Missing the Obvious: Network Security Monitoring for ICS If ICS are so vulnerable, why haven t we seen more attacks? We aren t looking! Two Key Reasons Intent Visibility Intent Why are targeted attacks
Cyber Security. BDS PhantomWorks. Boeing Energy. Copyright 2011 Boeing. All rights reserved.
Cyber Security Automation of energy systems provides attack surfaces that previously did not exist Cyber attacks have matured from teenage hackers to organized crime to nation states Centralized control
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
Effective Methods to Detect Current Security Threats
terreactive AG. Swiss Cyber Storm 2015. Effective Methods to Detect Current Security Threats Enrico Petrov Director Managed Security Services terreactive October 21 st, 2015 terreactive Background. About
Log Analysis: Overall Issues p. 1 Introduction p. 2 IT Budgets and Results: Leveraging OSS Solutions at Little Cost p. 2 Reporting Security
Foreword p. xvii Log Analysis: Overall Issues p. 1 Introduction p. 2 IT Budgets and Results: Leveraging OSS Solutions at Little Cost p. 2 Reporting Security Information to Management p. 5 Example of an
Indexing Full Packet Capture Data With Flow
Indexing Full Packet Capture Data With Flow FloCon January 2011 Randy Heins Intelligence Systems Division Overview Full packet capture systems can offer a valuable service provided that they are: Retaining
Defending Against Cyber Attacks with SessionLevel Network Security
Defending Against Cyber Attacks with SessionLevel Network Security May 2010 PAGE 1 PAGE 1 Executive Summary Threat actors are determinedly focused on the theft / exfiltration of protected or sensitive
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
IBM Managed Security Services (Cloud Computing) hosted e-mail and Web security - express managed Web security
IBM Managed Security Services (Cloud Computing) hosted e-mail and Web security - express managed Web security INTC-8608-01 CE 12-2010 Page 1 of 8 Table of Contents 1. Scope of Services...3 2. Definitions...3
Unknown threats in Sweden. Study publication August 27, 2014
Unknown threats in Sweden Study publication August 27, 2014 Executive summary To many international organisations today, cyber attacks are no longer a matter of if but when. Recent cyber breaches at large
CrashPlan Security SECURITY CONTEXT TECHNOLOGY
TECHNICAL SPECIFICATIONS CrashPlan Security CrashPlan is a continuous, multi-destination solution engineered to back up mission-critical data whenever and wherever it is created. Because mobile laptops
Top Five Data Security Trends Impacting Franchise Operators. Payment System Risk September 29, 2009
Top Five Data Security Trends Impacting Franchise Operators Payment System Risk September 29, 2009 Top Five Data Security Trends Agenda Data Security Environment Compromise Overview and Attack Methods
Fighting Off an Advanced Persistent Threat & Defending Infrastructure and Data. Dave Shackleford February, 2012
Fighting Off an Advanced Persistent Threat & Defending Infrastructure and Data Dave Shackleford February, 2012 Agenda Attacks We ve Seen Advanced Threats what s that mean? A Simple Example What can we
Next-Generation Firewalls: Critical to SMB Network Security
Next-Generation Firewalls: Critical to SMB Network Security Next-Generation Firewalls provide dramatic improvements in protection versus traditional firewalls, particularly in dealing with today s more
Flow Analysis Versus Packet Analysis. What Should You Choose?
Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation
Security Analytics for Smart Grid
Security Analytics for Smart Grid Dr. Robert W. Griffin Chief Security Architect RSA, the Security Division of EMC [email protected] blogs.rsa.com/author/griffin @RobtWesGriffin 1 No Shortage of Hard
INTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY
INTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY A PATH FOR HORIZING YOUR INNOVATIVE WORK PACKET SNIFFING MS. SONALI A. KARALE 1, MS. PUNAM P. HARKUT 2 HVPM COET Amravati.
Observer Analysis Advantages
In-Depth Analysis for Gigabit and 10 Gb Networks For enterprise management, gigabit and 10 Gb Ethernet networks mean high-speed communication, on-demand systems, and improved business functions. For enterprise
Cisco IPS Manager Express
Cisco IPS Manager Express Product Overview Intrusion prevention systems (IPSs) are critical to protecting your network and assets against worms, Trojans, and other malicious attacks. Cisco IPS Manager
DYNAMIC DNS: DATA EXFILTRATION
DYNAMIC DNS: DATA EXFILTRATION RSA Visibility Reconnaissance Weaponization Delivery Exploitation Installation C2 Action WHAT IS DATA EXFILTRATION? One of the most common goals of malicious actors is to
Enterprise Incident Response: Network Intrusion Case Studies and Countermeasures
Enterprise Incident Response: Network Intrusion Case Studies and Countermeasures Eric J. Eifert Vice President, Cyber Defense Division ManTech s Mission, Cyber, & Technology Solutions Presentation Overview
Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
UNCLASSIFIED. http://www.govcertuk.gov.uk. General Enquiries. Incidents [email protected] Incidents [email protected].
Version 1.2 19-June-2013 GUIDELINES Incident Response Guidelines Executive Summary Government Departments have a responsibility to report computer incidents under the terms laid out in the SPF, issued
Active Response: Automated Risk Reduction or Manual Action?
SESSION ID: CRWD-01 Active Response: Automated Risk Reduction or Manual Action? sec ops dream Monzy Merza Chief Security Evangelist Splunk @monzymerza Agenda Active Response Drivers Facets of Active Response
April 11, 2011. (Revision 2)
Passive Vulnerability Scanning Overview April 11, 2011 (Revision 2) Copyright 2011. Tenable Network Security, Inc. All rights reserved. Tenable Network Security and Nessus are registered trademarks of
Six Days in the Network Security Trenches at SC14. A Cray Graph Analytics Case Study
Six Days in the Network Security Trenches at SC14 A Cray Graph Analytics Case Study WP-NetworkSecurity-0315 www.cray.com Table of Contents Introduction... 3 Analytics Mission and Source Data... 3 Analytics
SSL DOES NOT MEAN SOL What if you don t have the server keys?
SSL DOES NOT MEAN SOL What if you don t have the server keys? J. Scott Haugdahl Architect, Blue Cross Blue Shield MN Robert Bullen Systems Engineer, Blue Cross Blue Shield MN Setting Expectations This
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
Intrusion Detection System
Intrusion Detection System Time Machine Dynamic Application Detection 1 NIDS: two generic problems Attack identified But what happened in the past??? Application identification Only by port number! Yet
Fighting Advanced Persistent Threats (APT) with Open Source Tools
Fighting Advanced Persistent Threats (APT) with Open Source Tools What is APT? The US Air Force invented the term in 2006 APT refers to advanced techniques used to gain access to an intelligence objective
Observer Probe Family
Observer Probe Family Distributed analysis for local and remote networks Monitor and troubleshoot vital network links in real time from any location Network Instruments offers a complete line of software
APPLICATION PROGRAMMING INTERFACE
DATA SHEET Advanced Threat Protection INTRODUCTION Customers can use Seculert s Application Programming Interface (API) to integrate their existing security devices and applications with Seculert. With
FIREEYE THREAT INTELLIGENCE HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group JULY 2015 SECURITY REIMAGINED
S P E C I A L R E P O R T FIREEYE THREAT INTELLIGENCE HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group JULY 205 SECURITY REIMAGINED CONTENTS HAMMERTOSS 3 APT29 5 Introducing HAMMERTOSS