stackarmor microsummit - niksun network monitoring - dpi

KNOW THE UNKNOWN®

NIKSUNInc.,CONFIDENTIAL-INTERNALUSEONLYThisdocumentcontainsconfiden0alinforma0onthatshallbedistributed,routedormadeavailableonlywithinNIKSUN.

ComprehensiveNetworkMonitoring/DPI

NIKSUNInc.

  Whydoescybercrimes0llpersist,despitesignificantinvestment?

  Whatdoesitmeantohavetrulycomprehensivemonitoring?  Surveillance,Detec0on,andForensics

  Howcanthishelpyouintherealworld?  ContextualAwareness(IncidentResponse)  FirewallMonitoring&DDoS  Malware/Ransomware  Compliance  Informa0onHiding  DNSServerHacked(Forensics)

Agenda

NIKSUN,Inc.CONFIDENTIAL--Seeconfiden0alityrestric0onson0tlepage. Slide2

NIKSUN,Inc.CONFIDENTIAL--Seeconfiden0alityrestric0onson0tlepage.

WhyDoesCyberCrimePersist?

Slide3Copyright NIKSUN 2014

Known

Unknown

Cyber Security Products Cover this Area

Sophisticated Hackers work here!

Known

Known

Unknown Unknown

Imagine if the CDC only looked to prevent virus’ that have already wiped out millions… they would have no recourse in mitigating incidents like Ebola! •  Now imagine if they had

full visibility into every single person in the United States… they could monitor every person’s body and watch for the development of both old and new virus’

Preven0on

  Howcanonepreventthatwhichonecan’tsee?  Whatnewservicesandapplica0onshaveenteredyournetworkthatyouareunawareof?

  Whoisbehindthem?Isitalegi0matebusinessapplica0onoratrojanormalware?

  Howdoweknowthatourdefensesareeffec0ve?


WhatKnowledgeIsNecessary?

  Weneedmoreadvancedsignals(“data”)thanthosewhichwehaveprogrammedapriori

  Goodcyberaâckersevadeaprioriindicatorsandexploitdifferentaâckvectors

  Anovelapproachisnecessarytogatherinforma0onfrombothknownandunknownaâckvectors


ComprehensiveMonitoring


Whatisneeded?•  Videocamera(surveillance)•  Sensordetec0on(laserbeams)•  Imagerecogni0on(easysearchforforensics,incidentresponse)

Whyareflowslimited?•  Generallyonlyprovideinforma0onatlayer3•  Lackgoodsupportforcorrelatedflows(FTP,Mobility,evenwebpages,etc.)•  LackofbroaderThreatIntelligencesupport(files,domains,cer0ficates,

etc.)

Whyarelogslimited?•  Developerschoosewhatlogstorecord.Can’tknowabouta^acksthat

havenotevenoccurredyet

WhatisNetworkMonitoring?

NIKSUN,Inc.CONFIDENTIAL.--Seeconfiden0alityrestric0onson0tlepage. Slide7

SampleFlowlogs


  Surveillance&ThreatHun0ng  Top-downHolis0cviewofAllNetworkAc0vity  Cri0calNetworkInfrastructureIndicators  Real-0meContentAnaly0cs  Applica0onRecogni0on/Applica0onMetadata  Geo-IP

  Detec0on  Anomaly/Signatures/Content(DataLeakage)  IntelligenceFeeds

  IncidentResponse&Forensics  Applica0onReconstruc0on&Ar0factExtrac0on  SandboxIntegra0on  Flows&Connec0ons  RawPackets

  Other  Performance  Compliance

ComprehensiveMonitoring


EmailServerCRM

Server WebServer

Enterprise-wideMonitoring


Monitor across all deployed physical and virtual devices, centrally, from any smart device

FastMacro-to-MicroAnalysis

Slide11NIKSUN Inc., CONFIDENTIAL. See confidentiality restrictions on title page

Global Visibility

Regional View

Specific Session

Single Packet

NIKSUN, Inc. CONFIDENTIAL -- See confidentiality restrictions on title page. Slide 11

DeepContentInspec0on-Example


With just a few clicks, DPI / DCI can identify all of this information

UseCase–ContextualAwareness


UseCase:ContextualAwareness


Alarms

Firewall

Log Analyzer

IDS/IPS

Content Filters

SIEM

Scanners

Alarms

Incident Response -Integrated Analysis

Alarms

Attacks often occur over disparate parts of the network, over extended periods of time à forensic investigation is necessary to put together pieces of the puzzle and reveal how an attack was crafted

UseCase–FirewallMonitoring


  Trendinginforma0ontotuneFirewalls  TCP-SYNrate(commonfirewallmetric)  Fragmentedpacketrate(IPv4,IPv6)  UDP,ICMP,DNS,NTP,etc.packetrates  Bandwidth

  In-depthanalysisofaâckaêmpts  Resolveissueswithfirewalls

  FWvendors/usersokenneedpacketstotuneagainstanaâck  ComprehensiveIntelligenceonDDoSaâcks

  Isolatebadtrafficfromgood

  ThreatIntelligence(didanybadURLsmakeitpasttheFW?)  AnalyzeFirewalleffec0veness(Retrospec0veIDS)  ReplaytraffictotestnewFWrules

UseCase-FirewallMonitoring


Inline systems may face latency and complexity constraints, requiring a reduction in the deployed ruleset •  Monitoring becomes

invaluable for a constant pulse on critical infrastructure


FirewallInbound+OutboundMonitoring

Network Internet

Who is trying to get in?

What methods are they using?

Who got in?

What did they get

out?

Backdoor?

Slide17

DDoSMonitoring(Volumetric/Applica0on)


RedZone/GreenZone


TrafficVolume-BeforeandAkerFirewall


UseCase– Ransomware(Wannacry)


UseCase:WannacryInves0ga0on


UseCase:WannacryInves0ga0on(cont.)


•  Leverage retrospective IDS •  View SMB scans on your infrastructure •  Real-time intelligence feed related information

UseCase:WannacryInves0ga0on(cont.)


How can we know if the hosts scanned have actually been impacted?

UseCase–Compliance


  Discovercompliancelevelwithtrafficmonitoring  FasterthanPenTes0ng

  Validatesecuritypreandpostchanges  Firewalls,networks,servers

  Evidence  Rawdatacaptures

  Instantlyiden0fyinsecurecommunica0ons  Whoisusingnoncompliant:SSL2.0,SSL3.0,TLS1.0  Whoisusingwhichciphers–strongorweak?  WhatCer0ficatesareinuse?CertOrganiza0ons?  Cleartextprotocols,SSN

UseCase:Compliance-PCI/Fed/Gov


Compliance–SSLMetadata

Slide27NIKSUN,Inc.CONFIDENTIAL--Seeconfiden0alityrestric0onson0tlepage.

UseCase–InformaMonHiding/

ExfiltraMon



Scenic?

Slide29


AndNow?

Slide30COPYRIGHT 2013 - NIKSUN Inc.

Social Security Numbers hidden in picture… only way to tell is by drilling down to the raw packets!

UseCase–DNSServerHacked


  Spear-phishingaâckluredemployeestogototheirbanktoupdatetheirinfo

  TheywereredirectedtoaBADsite  DifficulttotraceastheDNSserverfixeditselfakersomeamountof0mesotheproblemcouldnotbeiden0fiedbytradi0onalmethods

  Forensicanalysis  Discoveredthatthe“windowofopportunity”wastransient  GaveIPaddressofallthosethatwereluredtothewrongsite  Reconstructedtheaâckandtracedtheaâcker’smovesstep-by-step

  DamagewasminimizedduetorapididenMficaMonandimmediateremediaMon

UseCase:DNSServerHacked


NIKSUN:HelpingYouKnowtheUnknown®[email protected]

Foraddi0onalinforma0on:


stackarmor microsummit - niksun network monitoring - dpi

Technology