My Security is a Graph Your Argument is Invalid · 2014-08-04 · Attack Paths –Email Password...

My Security is a Graph –Your Argument is Invalid

Who am I

• @gdbassett

• https://github.com/gdbassett

• http://blog.infosecanalytics.com/

• http://www.infosecanalytics.com/

• Information Security Analytics LLC

• Security Architect

• I love solving problems with graphs

HERE’S THE PLAN

Infosec + Graph Theory = Sexy Defense

Graph Theory and Infosec

• What are Graphs

• What can you do with them (the math stuff)

• Kill chains, attack paths, and attack paths

• How to work with graphs

• What Can you do with them (the infosec stuff)

• What I’m doing with them

WTF is a Graph

SWhat are Graphs

What can you do with them (the math stuff)

Kill chains, attack paths, and attack paths

How to work with graphs

What Can you do with them (the infosec stuff)

What I’m doing with them

DATABASES ARE ABOUT RECORDS.GRAPHS ARE ABOUT RELATIONSHIPS.8

Graphs/Networks is EasyNodes/Vertexes Edges/Lines

When you put them together, you get a graph

• Actor: Some with free will

• Threat: A mean actor

• Risk: A potential future negative situation. Likelihood and Impact

• Vulnerability: A vulnerable condition. Something that increases risk likelihood

• Mitigation: A mitigating condition. Something that decreases risk likelihood

• Consequence: A negative event or condition

• Impact: Just how bad a consequence is

Math Happens Here

What are Graphs

THE COOL THING ABOUT GRAPHS IS THAT MATH HAPPENS ALL UP IN THEM13

Depth First Search

http://en.wikipedia.org/wiki/File:Depth-first-tree.svg14

Breath First Search

http://en.wikipedia.org/wiki/File:Breadth-first-tree.svg15

PageRank – The Drunken Walk

http://upload.wikimedia.org/wikipedia/commons/f/fb/PageRanks-Example.svg16

Hot Infosec Pro in Pony Tails

Shortest Path

http://www.cs.sunysb.edu/~skiena/combinatorica/animations/dijkstra.html18

Centrality

http://en.wikipedia.org/wiki/File:Centrality.svg19

Communities / Modularity

20http://en.wikipedia.org/wiki/Community_structurehttp://en.wikipedia.org/wiki/Modularity_(networks)

Bipartite Networks

Monopartite Networks

Bayesian Math

http://en.wikipedia.org/wiki/Bayes%27_formula24

Kill Chains and Attack Graphs

What are Graphs

Kill chains, attack paths, and attack graphs

Quick Example

26http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf

Lockheed Martin Kill Chains

http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf

ATTACK PATHS

A threat

Events

Conditions

28http://infosecanalytics.blogspot.com/2013/07/cyber-attack-graph-schema-cags-10.html

Attack Paths – Dave’s a FB Hacker

Dave (a threat)

wants to embarrass me by posting our

honeymoon photos on my FB account

Attempts to brute force my FB

password (event)

I have a weak FB password

(condition)

FB has password brute force detection

(condition)

FB doesn’t notice the brute force

(event)

Dave finds my FB password (event)

Dave has my FB login credentials (condition)

Dave uses it to authenticate to FB

(event)

Dave is authenticated as me

(condition)

Dave posts our honeymoon photos

on my FB page (event)

Our bromance is outted! (condition)

Attack Paths – FB Password Brute Force

Dave (a threat)

Attempts to brute force my FB

password (event)

I have a weak FB password

(condition)

FB has password brute force

detection (condtion)

FB doesn’t notice the brute force

(event)

Dave finds my FB password (event)

Dave has my FB login credentials (condition)

(event)

(condition)

on my FB page (event)

Impact

Mitigation

Vulnerability

Likelihood

Consequence

ATTACK PATH

Kinda looks like a risk…

ATTACK PATHS

Dave has Options

Attack Paths – Email Password Brute Force

Events and Conditions thanks to An Attack Graph-Based Probabilistic Security Metric – Wang et al

Dave (a threat)

Attempts to brute force my email

password (event)

I have a strong email password (kind of)

(condition)

Dave finds my Email password (event)

Dave has my email login credentials

(condition)

Dave resets my FB password (event)

Dave gets the reset email and sets my FB

password (event)

(event)

(condition)

on my FB page

Attack Paths – Phishing with a Link

Dave (a threat)

Emails me a link to a malicious website

(event)

I open the mail, click sh*t, and get

pwned (event)

My computer is infected (condition)

The malware takes my FB

authentication cookie (event)

(event)

Dave is authenticated as me (condition)

on my FB page

Attack Paths – Phishing with Malware

Dave (a threat)

Emails me some custom pentestmalware from

Raphael (event)

I open the mail, click sh*t, and run

the malware (event)

The malware takes my FB

authentication cookie (event)

(event)

on my FB pageOnly these 2

changed

Attack Path Attributes

(attribute)

Dave (a threat)

Emails me some custom pentest malware from

Raphael (event)

I open the mail and run the malware (event)

The malware takes my FB authentication

cookie (event)

(event)

Dave posts our honeymoon photos on

my FB page

Has Raphael’s uberpentest malware

(attribute)

So Graphs are cool. How do I get me one?

What are Graphs

Tools and Stuff• Maltego: www.paterva.com• An infosec graph tool for threat modeling

• Gephi: www.gephi.org• A visual graph manipulation tool

• Neo4j: www.neo4j.org• A graph database• Cypher: A graph query language for neo4j

• Networkx: networkx.github.io• A python module for storing and using graphs

• Py2neo: py2neo.org• An easy python to neo4j binding

• Ubigraph: http://ubietylab.net/ubigraph/• Simple python binding to visualize graphs in 3D

• RDF: www.w3.org/RDF/• An easy way to describe graphs. (until you try and use it.)

• SPARQL: www.w3.org/TR/sparql11-overview/• Another graph query language, primarily associated with RDF

DEMO TIME

Lets make an attack graph out of those attack paths.

Attack Path SummaryActor(threat)

Motive Narrative Consequence

DaveKennedy…

wants to embarrass me by posting our honeymoon photos on my FB account. He…

Brute force’s my Facebook password, avoiding FB’s detection, gets my password, authenticates as me, logs into my account, and posts our honeymoon photos.

Our bromance is outted!

DaveKennedy…

Brute force’s my email password. Resets my FB password & collects the new login from my email, authenticates as me, logs into my account, and posts our honeymoon photos.

DaveKennedy…

Has some leet PT malware from Raphael that he emails to me. I run it and infect my computer. He steals my FB cookie, authenticates as me, logs into my account, and posts our honeymoon photos.

DaveKennedy…

He sends me a malicious link. I click it and infect my computer. He steals my FB cookie, authenticates as me, logs into my account, and posts our honeymoon photos.

THIS PREDICTS HUMAN BEHAVIOR

It doesn’t just predict infosec risks

Think Psychohistory

http://en.wikipedia.org/wiki/File:Isaac_Asimov_on_Throne.png43

Infosec Things to do with Graphs

What are Graphs

Make Pretty Pictures

Make Pretty PicturesG

Risk Management

Threat Modeling

51 http://www.secureworks.com/cyber-threat-intelligence/threats/chasing_apt/

Data Sharing(A)ID:

<value>

(D)WHOIS: <value>

(H)DNS QUERY:

(I)DNS RECORD: <value 2>

(J)RECORD TYPE:

(C)DOMAIN: <value>

(B)URL: <value> (E)DNS

QUERY: <value>

(F)DNS RECORD: <value>

(G)RECORDTYPE:

<value>

http://infosecanalytics.blogspot.com/2013/03/defensive-construct-exchange-standard-03.html

Intrusion Detection

Incident Investigation

Incident Documentation

My Tools

What are Graphs

https://github.com/gdbassett/odds_and_ends/tree/master/minionshttp://despicableme.com/post/1807http://ihdwallpapers.com/minions_in_despicable_me_2-wallpapers.html#

MY MINIONS

DCES – Defensive Construct Exchange Standard

DB Record

Graph (networkx)

Dictionary (JSON)

http://infosecanalytics.blogspot.com/2013/03/defensive-construct-exchange-standard-03.html

Moirai

Moirai (Autobahn, py2neo neo4j connection)

RPC PubSub

Log Search Client

Visualization Client

GUI ClientSecurity

ProxyIDS Client

https://github.com/gdbassett/moirai

Visualization

http://linkurio.us/ http://keylines.com/

http://sigmajs.org/Ghost in the Shell: Innocence

Moirai

61Neo4J

Moirai (Autobahn, py2neo neo4j connection)

RPC PubSub

Log Search Client

Visualization Client

GUI ClientSecurity

ProxyIDS Client

Other Ideas

• Offense:

• Auto-attack down an attack graph

• Automatic Pen Test Documentation

• Network Analysis

• Collect information about your network, the devices on it and their attributes using a graph database.

In Summary

Bla Bla Bla Evil Haxors

(Credit to @451wendy)64

Threats. Vulns.

BIGNUM

Hundreds of Threats

Thousands

Of Attacks

Millions of Logs

Solution: Graphs solve everything

Solution: ATTACK GRAPHS

Best & Unique Because…

ON • Is not antivirus

• Is not firewall

Best & Unique Because…

BIG DI DATA

Fastest Realest Time Because…

(Credit to @451wendy), http://giraph.apache.org/70

•Cloud

•Analytics

•Giraph (Hadoop but better)

CYBER CYBER CYBER CYBER CYBER CYBER

CONCLUSION

Infosec + Graph Theory = Sexy Defense

Now you try!

• My Blog: http://infosecanalytics.blogspot.com/• Has DCES, CAGS, Attack Path, CPT standards

• My Code: https://github.com/gdbassett/• Maltego: www.paterva.com• Gephi: www.gephi.org• Neo4j: www.neo4j.org• Networkx: networkx.github.io• Py2neo: py2neo.org• Ubigraph: http://ubietylab.net/ubigraph/• RDF: www.w3.org/RDF/• SPARQL: www.w3.org/TR/sparql11-overview/• Visualization: http://linkurio.us/, http://keylines.com/,

http://sigmajs.org/• Lockheed Martin paper: http://goo.gl/pU2KXF• Giraph: http://giraph.apache.org/• Wikipedia Articles: Community structure, Graph theory, Depth-first

search, Breath-first search, Shortest path problem, Dijkstra's algorithm, Modularity (networks), Centrality, Bayesian inference, Bipartite graph, Psychohistory (fictional), PageRank

My Security is a Graph Your Argument is Invalid · 2014-08-04 · Attack Paths –Email Password...

Documents

Attack-Graph Threat Modeling Assessment of Ambulatory ... · Attack-Graph Threat Modeling Assessment of Ambulatory Medical Devices ... and Implantable Medical Devices (IMDs).

Cyber Security Attack and Trend

An Attack Graph-Based Probabilistic Security Metric · An Attack Graph-Based Probabilistic Security Metric Lingyu Wang 1, Tania Islam , Tao Long , Anoop Singhal2, and Sushil Jajodia3

LNCS 4237 - Attack Graph Based Evaluation of Network Security...Attack Graph Based Evaluation of Network Security Igor Kotenko and Mikhail Stepashkin SPIIRAS, 39, 14 Liniya, St.-Petersburg,

Mining known attack patterns from security-related … of unrelated security events to the attack pattern(s) ... the attack under investigation. •The system considerably ... our

SEED WORKSHOP · SQL Injection Attack CSRF Attack Shellshock Attack Day 2 (Software/Hardware Security) Software Security Basics Buffer-Overflow Attack Capture-the-Flag Race Condition

A Graph Patrol Problem with Random Attack Times

Security Optimization of Dynamic Networks with …people.cs.vt.edu › ... › TDSC-Attack-Graph-Probabilistic-Yao.pdflinear programming that is extensively applied and studied in

Devouring Security XML Attack surface and Defences

An Attack Graph-Based Probabilistic Security Metricpeople.cs.ksu.edu/~halmohri/files/An Attack Graph-Based Probabilist… · This now becomes feasible due to a model of causal re-lationships

Topology Attack and Defense for Graph Neural Networks: An ... · Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective Kaidi Xu1, Hongge Chen2, Sijia

A test of attack graph-based evaluation of IT-securityumu.diva-portal.org/smash/get/diva2:696145/FULLTEXT01.pdf · A test of attack graph-based evaluation of IT-security Fredrik Johan

Internet Security CS457 Seminar Zhao Cheng. Security attacks interruption, interception, modification, fabrication passive attack, active attack

Attack on graph

Big-Data Architecture for Cyber Attack GraphsBig-Data Architecture for Cyber Attack Graphs Representing Security Relationships in NoSQL Graph Databases Steven Noel, Eric Harley, Kam

Security Cyber Attack

Basics of Security and Attack

Mitigating Security Risks through Attack Strategies

E ective Network Vulnerability Assessment through Model ...xou/publications/dimva11.pdf · Keywords: enterprise network security, attack graph, quantitative vul-nerability assessment,

Graph-Based Metrics for Insider Attack Detection in …IEEETRANSACTIONS ON VEHICULAR TECHNOLOGY, VOL.62,NO.4,MAY2013 1505 Graph-Based Metrics for Insider Attack Detection in VANET