8/11/2016

OperationalizingacyberSecurityOperationsCenter (SOC) using a Security InformationandEventManagement(SIEM)solution.Final Project T411 Wireless networking: George Brown College, Toronto, ON,

Canada.August,2016

RanganGrama-Yoga 101017090

AnkitDivyeshPandya 100984504

LakshayChamoli 101026076

ZhouLu 101015405

1

TABLEOFCONTENTS

Agenda..........................................................................................................................................................................3

Introduction..................................................................................................................................................................3

Intheproject........................................................................................................................................................3

Itinerary................................................................................................................................................................3

Splunk...........................................................................................................................................................................4

IntroductiontoSplunk..........................................................................................................................................5

Problem/OpportunityAssessment..............................................................................................................................6

OurProject....................................................................................................................................................................7

ImplementationPhase..........................................................................................................................................8

SearchingData......................................................................................................................................................9

CreatingTraps.....................................................................................................................................................11

DataAnalysis......................................................................................................................................................11

LogdataFile........................................................................................................................................................13

UseCase1...............................................................................................................................................................14

DetectionofPossibleBruteForceAttack..........................................................................................................14

UseCase2...............................................................................................................................................................15

DetectionofInsiderThreat................................................................................................................................15

AcceptableUseMonitoring(AUP).....................................................................................................................15

UseCase3...............................................................................................................................................................18

ApplicationDefenseCheck.................................................................................................................................18

UseCase4...........................................................................................................................................................19

SuspiciousBehaviorofLogSource...............................................................................................................19

ExpectedHost/LogSourceNotReporting.........................................................................................................19

UseCase5...........................................................................................................................................................20

UseCase6...............................................................................................................................................................20

DetectionofAnomalousPorts,ServicesandUnpatchedHosts/NetworkDevices..........................................20

2

Conclusion...........................................................................................................................................................21

Credits.........................................................................................................................................................................22

3

AGENDA

This particular project report Embracing the Practice ofNetwork Security: An analysis of the

mergingcontextwasborneoutofaseriesofprocessesundergonebythesecuringofmultiple

systemsinaccordancewithtomaintainasecurenetworkenvironmentinthefieldofnetworking.

INTRODUCTION

Securityinformationandeventmanagement(SIEM)isanapproachtosecuritymanagementthat

seeks to provide a holistic view of an organization's information technology (IT) security.

ImplementationofSIEMsoftwareinanynetwork,todetect,controlandresolvevariousattacks

and threats faced inCyber security. In this simulationwewill be showinghowvarious cyber

activitiesaremonitoredandeventsregardingtheactivitiesofvariousobjectsinthenetworkare

monitored, accounted and flagged with various flagging events that occur in an enterprise

environment.

INTHEPROJECT

• SimpleSNMPexperimentwithADDCserver

• Multiplemachinesaddedinthesamedomain

• EventsRaised

• Communicationstopped

• Eventsaddressed

• Communicationstoppeduntilresolved

• Splunkcanbecompletelyunattended

• Eventraisedandemailsent

ITINERARY

• CiscoASA(AdaptiveSecurityAppliance)Firewall5520withoutVLANsupport

• WindowsServer2008R2|OperatingSystem

4

• Ubuntu12.3|OperatingSystem• Splunk|SIEM(SecurityInformationandEventManagementSoftware)• Passware|BrutforceAttackSoftware• ActiveDirectoryService|MicrosoftWindowsServer2008R2• OracleVMBOX|Virtualization

SPLUNK

• DataManagementEngine

• Datatimedoesnotmatter

• Multiplesourcesupport

• Doesn‘trequireaswitchingcomponentfordatatranslation

• Multipleplatformintegration

5

FIGURE1:SOURCEDFROMSPLUNKWEBSITE

INTRODUCTIONTOSPLUNK

Toachieveoperationalintelligence,thefirstthingCIOsandCTOsmustdoisfindtechnologiesto

helpthem.Splunkisaplatformformachinedata.Itcollects,indexesandharnessesmachinedata

generatedbyany IT systemand infrastructure—whether it’sphysical, virtualor in the cloud.

Splunk laid its foundation helping IT find and fix problems faster, but its applications are far

broader,aswewillsee.Splunkmakessenseofmachinedatatosupportbusinessgoals.

Ithandlesboththeformandthesemanticsofmachinedata.

Itaccomplishesthisthroughauniqueapproachofuniversallyindexinganymachinedataacross

6

theinfrastructure.Itconsumesnetworktrafficandappserverlogsandtrackshypervisorsand

GPS,aswellassocialmediaactivity.ItevenabsorbsPBXandIPtelephonydata.Splunkdoesthis

withoutrequiringcostlyconnectorsoragents.Itdoesnotneedtofilterorparsethedatatoload

itintoadatabase.Byprovidingusersanindexofallthemachinedatageneratedbyallsystems

andinfrastructure,Splunkenablesuserstoaskanyquestionandfindanswersquicklytothemost

simpleorstrategicpropositions.

Splunkwas born to help ITmanage andmonitor the datacenter. System

administratorswere sniffing out security threats, server inefficiencies, network outages, and

bandwidthbottlenecks,notlookingforbusinessinsights.Butalongtheway,that’sexactlywhat

theydiscoveredinthewealthofmachine-generateddatathatisdrivingoperationalintelligence.

Analysts can have a conversation with the data and gradually uncover the structure and

relationshipsbetweenelements.Theycancreatecustomapplications,dashboards,andreports

that don’t just present information, but allow for deep drill-downs into the data to answer

questions.Splunkalsooffersprebuiltintegrationstocommondatastores,suchasHadoopand

traditionalrelationaldatabases.

PROBLEM/OPPORTUNITYASSESSMENT

Variousattacks(BruteForce,DDOS,Multipleaccess,etc..):wewouldshowvariousattacksthat

canoccurandhowtheseattackswouldbespottedandraisedasevents

Abrute-forceattackisacryptanalyticattackthatcan,intheory,beusedtoattempttodecrypt

anyencrypteddata(exceptfordataencryptedinaninformation-theoreticallysecuremanner).

Suchanattackmightbeusedwhenitisnotpossibletotakeadvantageofotherweaknessesin

anencryptionsystem(ifanyexist)thatwouldmakethetaskeasier

FalseAlarm:Userinteractionwithserveragainstanexternalthreat,thiswouldraisealotoffalse

alarmsandsegregationofevents.

DDOS-Adistributeddenial-of-service(DDoS)iswheretheattacksourceismorethanone,often

thousandsofuniqueIPaddresses.Itisanalogoustoagroupofpeoplecrowdingtheentrydoor

orgatetoashoporbusiness,andnotlettinglegitimatepartiesenterintotheshoporbusiness,

disruptingnormaloperations.ThescaleofDDoSattackshascontinuedtoriseoverrecentyears,

evenreachingover400Gbit/s.

EventLogging:Alleventsthatoccuronaserverisloggedandthedataflowispresented.

Authenticationtrackingandaccountcompromisedetection;adminandusertracking.

7

Compromised- and infected-system tracking:malware detection by using outbound firewall

logs,NIPSalertsandWebproxylogs,aswellasinternalconnectivitylogs,networkflows,etc.

Validating intrusiondetectionsystem/intrusionpreventionsystem(IDS/IPS):AlertsbyusingvulnerabilitydataandothercontextdataabouttheassetscollectedintheSIEM

Monitoringforsuspiciousoutboundconnectivityanddatatransfers:Byusingfirewalllogs,Web

proxylogsandnetworkflows;detectingexfiltrationandothersuspiciousexternalconnectivity

Tracking system changes and other administrative actions: Across internal systems and

matchingthemtoallowedpolicy;detectingviolationsofvariousinternalpolicies,etc.

TrackingofWebapplicationattacksandtheirconsequencesbyusingWebserver:WAFand

application server logs; detecting attempts to compromise and abuse web applications by

combininglogsfromdifferentcomponents.

KeyDeliverablestobeproducedbystudents:

Logmanagement:VariouseventsflaggedbySIEMsoftwaretomemappedandlogged.

WindowsEvents:Windowsapplication,securityandsystemeventlogs,Detectproblemswith

businesscriticalapplications,securityinformationandusagepatterns.

WireData:DNSlookupsandrecords,protocollevelinformationincludingheaders,contentand

flow records. Proactively monitor the performance and availability of applications, end-user

experiences,incidentinvestigations,networks,threatdetection,monitoringandcompliance.

OURPROJECT

We created a test environment and implemented Splunk on DMZ where the Servers were

located.ThefollowingSchematicsisthenetworkdesignofourimplementation.

8

FIGURE2:NETWORKDESIGN

AstheabovescchematicsshowwededicatedaserverontheDMZ(De-MiletarisedZone)where

theother serverswouldbeplacedaswell.Making the splunk serveras secureasyourother

servers.Butforthetestpurposes,weimplemeteddesignonVirtualMachines.

WealsomadesurethatallthedataflowwasmonitoredontheperticularportthatSplunkhad

accessto,givingsplunkthepowertoaccessallmachinedataremotelyandlocally.

IMPLEMENTATIONPHASE

After implementingSplunkonasimplenetworkwegatheredthefollowingdata.Weinstalled

SplunkandaddedvariousdataSourcesformonitoring.Andasshowninthepicture,wehave

addedActiveDirectoryasonethesourcesfordata,alongwithvariousotherservicesthatwere

monitored.

Thevarioussourcesofdatawereaddedwithease.Allwehadtodowas:

Settings>DataInputs>EventLogCollections>‘selectthelocaldatasourcethatyouwouldliketoadd’

9

FIGURE3:ADDINGDATASOURCES

SEARCHINGDATA

As soon a the sources were added to monitor, events from every source was gathered

immidietly. This data that we gathered was collected and analysed for event management

purposes. For the sakeof testingpurposes,weonly implementedMultiple loginusingActive

directoryservices.Andfindingthedatawasextremelyeasywiththesearchservice.-

10

FIGURE4:LOCALEVENTSOURCE

Andoncewegotontothesourcesthatwerebeinggatheredbythelocalhost,wenoticedthat

all3sourcesofdatawererecognisedandindexed.

FIGURE5:REMOTEDATASOURCES

11

CREATINGTRAPS

Wecreatedatrapwithjustasimplesearchandhighlightingtheserachresulttobethesourceof

thetrap,andsettherefreshrateat30seconds.Thiscouldalsobechangedtolivemonitoring

whichwouldallowyoutolookatlivetrapmonitoring.

FIGURE6:DATASEARCH

DATAANALYSIS

Insteadofjustcollectionofdata,thefalseLogininformationwascollectedandSearchedwiththe

nativemachinelanguage.Thisalsoholdstrueforanyscriptorcodingerrorsthatmightoccur.

12

FIGURE7:MACHINEDATA

Thecreatedserachquerrtcanbefurthersavedasadashboardwhereineveryrelatedquerryis

monitoredandactivityissavedasadashboard.

13

FIGURE8:ALERTDASHBOARD

We saved the dash board as ‘Brute force’, as we used Passware to break into network

authentication on the Active Directory server using brute force attack. These events were

monitoredandaccountedfor.Theaboveimageshowsvariousvlanscreatedonthenetworkand

loginattemptsusingthesamelogincredentials.ThefailedloginshowhowmanytimestheActive

Directoryservicewasblocked.

LOGDATAFILE

ThelogDataFilehasbeenattachedinthisforyourreference:

Event_Log _for_multile_Access.csv

14

USECASE1

DETECTIONOFPOSSIBLEBRUTEFORCEATTACKWiththeevolutionoffasterandmoreefficientpasswordcrackingtools,bruteforceattacksare

onahighagainsttheservicesofanorganization.Asabestpractice,everyorganizationshould

configure logging practices for security events such as invalid number of login attempts, any

modification to system files, etc., so that any possible attack underwaywill get noticed and

treatedbeforetheattacksucceeds.Organizationsgenerallyapplythesesecuritypoliciesviaa

GroupPolicyObject(GPO)toallthehostsintheirnetwork.

Tocheckforbruteforcepattern,wehaveenabledauditingonlogoneventsintheLocalSecurity

PolicyandwewillbefeedingmySystemWin:SecuritylogstoSplunktocheckforabruteforce

patternagainstlocalloginattempts.

15

Belowisthecorrelationsearch(SPL)thatiscreatedinSplunkagainstWin:Securitylogstomonitor

real time login attempts. In this search, brute force criteria get matched with two failure

attempts.

sourcetype="WinEventLog:Security" (EventCode=4625 AND "Audit Failure") NOT

(User_Name="*$" OR Account_Name="*$") NOT Failure_Code=0x19 | stats count by

Account_Name|wherecount>2

Note: EventCode: 4625 is used in new versions of theWindows family likeWin 7. In older

versions,theeventcodeforinvalidloginattemptsis675,529.

Afterthis,Ilogoffmymachine,andenteredthepasswordincorrectlythreetimesinattemptto

impersonateabruteforceattack.

SincetheseactivitiesgetsloggedinWin:Security,whichinturnisfeedingSplunkinrealtime,an

alertwill be created in Splunk, giving analysts an incident to investigate and take responsive

actions,likechangingthefirewallpolicytoblacklistthatIP.

USECASE2

DETECTIONOFINSIDERTHREATReportedly,more than30percentof attacks are frommalicious insiders in anyorganization.

Therefore,everyorganizationmustkeepthesamelevelofsecuritypoliciesforinsidersalso.

ACCEPTABLEUSEMONITORING(AUP)AcceptableUseMonitoring covers a basic questions, i.e.what resource is being accessed by

whomandwhen.Organizationsgenerallypublishpoliciesforuserstounderstandhowtheycan

use the organization’s resources in the best way. Organizations should develop a baseline

documenttosetupthresholdlimits,criticalresourcesinformation,userroles,andpolicies,and

usethatbaselinedocumenttomonitoruseractivity,evenafterbusinesshours,withthehelpof

theSIEMsolution.

16

Forexample,thebelowillustrationisofloggingauseractivityonanobject.Fordemonstrative

purposes,wehavecreatedafilenamed“Test_Access”onmysystem.Auditingonobjectaccess

isenabledinmysystem,likebelowintheLocalSecurityPolicy.

Enablingauditingonsecuritypoliciesisnotenough,andnowwehavetoenabletheauditingon

therespectivefile,alsonamed“Test_Access”inthiscase.WehaveenabledauditingforGroup

Name –”Everyone” on this file. Organizations should fingerprint all the sensitive files and

correspondingprivilegesandusergroupaccessonthem.

17

Fordemonstrativepurposes,wehaveselectedalltheobjectpropertiestobeaudited.

After this,weaccessedthe“Test_Access” file,whichgeneratesanevent inSecurity logswith

Event ID 4663, giving user name, action performed, time it was accessed, etc. This useful

informationcanbefedintotheSIEMsolutionthroughsecuritylogstodetectanyunauthorized

orsuspiciousobjectaccess.

Organizationsshoulddevelopfingerprintsonallthesensitivedocuments,filesandfolders,and

feed all this information to respective security solutions such as data leakage prevention

18

solutions,applicationlogs,WAF,etc.intotheSIEMsolutiontodetectapotentialinsiderthreat.

OrganizationscandevelopthebelowusecasesintheSIEMsolutionunderAUP

• TopmaliciousDNSrequestsfromuser

• IncidentsfromusersreportedatDLP,spamfiltering,webproxy,etc

• Transmissionofsensitivedatainplaintext

• 3rdpartyusersnetworkresourceaccess

• Resourceaccessoutsidebusinesshours

• Sensitiveresourceaccessfailurebyuser

• Privilegeduseraccessbyresourcecriticality,accessfailure,etc

USECASE3

APPLICATIONDEFENSECHECK

Besides network, perimeter, and end point security, organizations must develop security

measurestoprotectapplications.WithattackslikeSQLinjection,Crosssitescripting(XSS),Buffer

overflow,andinsecuredirectobjectreferences,organizationshaveadoptedsecuritymeasures

likesecurecodingpractices,useofWebApplicationFirewall(WAF)whichcaninspecttrafficat

layer7 (Application layer)againsta signature,patternbased rules,etc.Alongwith the logof

applications,organizationsmustalsofeedSIEMwithlogsoftechnologiessuchasWAF,whichcan

correlateamongvarioussecurityincidentstodetectapotentialwebapplicationattack.Oneof

thevery importantpointstocheckfor inasensitiveapplication isthattheapplicationshould

encryptthesensitiveinformationlikePIIinthelogsaswell,astheselogswillbefedintoSIEM,

andifunencrypted,sensitiveinformationcouldbeexposedinSIEM.

Organizationsmustalsodevelopastrategytosecuretheoperatingsystem(OS)platformonto

whichtheapplicationishosted.OSaswellasapplicationperformanceloggingfeaturesmustalso

be enabled. Below are some of the use cases that can be implemented in SIEM to check

Applicationdefense.

• TopWebapplicationAttacksperserver

• MaliciousSQLcommandsissuedbyadministrator

• Applicationssuspiciousperformanceindicator,resourceutilizationvector

19

• ApplicationPlatform(OS)patch-relatedstatus

• Webattackspostconfigurationchangedonapplications

USECASE4

SUSPICIOUSBEHAVIOROFLOGSOURCEEXPECTEDHOST/LOGSOURCENOTREPORTING

LogsourcesarethefeedsforanySIEMsolution.MostoftheSIEMsolutionthesedayscomeswith

anagent-managerdeploymentmodel,whichmeansthatonallthelogsources,lightweightSIEM

agentsoftwareisinstalledtocollectlogsandpassthemtoamanagerforanalysis.Anattacker,

aftergainingcontroloveracompromisedmachine/account,tendstostopallsuchagentservices,

sothattheirunauthorizedandillegitimatebehaviorgoesunnoticed.

Tocountersuchmalformedactions,SIEMshouldbeconfiguredtoraiseanalertifahoststops

forwardinglogsafterathresholdlimit.Forexample,thebelowsearchquery(SPL)inSplunkwill

raiseanalertifahosthasnotforwardedthelogsformorethanonehour.

|metadatatype=hosts|whererecentTime<now()-3600|convertcTime(recentTime)as"Lasttimethelogsourcereported"|renamehostas"LogSources"|table"LogSources""Lasttimethelogsourcereported"

Assoonasanalert is receivedwith the IPaddressof themachineunderattack, the Incident

ResponseTeam(IRT)canstartmitigatingthisissue.

UnexpectedEventsPerSecond(EPS)fromLogSources

Another common pattern found among compromised log sources is that attackers tends to

changetheconfigurationfilesofendpointagentsinstalledandforwardalotofirrelevantfilesto

theSIEMmanager,causingabandwidthchokebetweentheendpointagentandmanager.This

affectstheperformanceofrealtimesearchesconfigured,storagecapacityofunderlyingindex

forstoringlogs,etc.Organizationsmustdevelopausecasetohandlethissuspiciousbehaviorof

logsources.Forexample,belowisthesearch(SPL)createdinSplunkwhichcandetectunusual

forwardingofeventsfromlogsourcesinoneday.

index=_internalearliest="-1d@d"latest="-0d@d"source=*license_usage.logtype=Usageh!="*ip*"|evalMb=b/1024/1024|bucketspan=1h_time|searchMb>5|statssum(Mb)asMBby_time,h|sort-MB,h|deduph|renamehas"Workload"MBas"Totalevents"

AnalertwillbeconfiguredwithittogettriggeredwhenevertheamountofEPSfromalogsource

exceedsathresholdvaluefortheIRTteamtoinvestigate.

20

USECASE5

MALWARECHECKThesedays,organizationsbelieve inprotectingtheirnetworkendtoend, i.e. right fromtheir

networkperimeterwithdeviceslikefirewall,NetworkIntrusionPreventionSystem(NIPS),tillthe

endpointshostswithsecurityfeatureslikeantivirusandHostIntrusionPreventionSystem(HIPS),

butmostorganizations collect reportsof security incidents from these securityproducts ina

standalonemode,whichbringsproblemlikefalsepositives,etc.

CorrelationlogicisthebackboneofeverySIEMsolution,andcorrelationismoreeffectivewhen

itisbuiltovertheoutputfromdisparatelogsources.Forexample,anorganizationcancorrelate

varioussecurityeventslikeunusualportactivitiesinfirewall,suspiciousDNSrequests,warnings

fromWebApplicationfirewallandIDS/IPS,threatsrecognizedfromantivirus,HIPS,etc.todetect

apotentialthreat.Organizationscanmakefollowingsub-usecaseunderthiscategory.

• Unusualnetworktrafficspikestoandfromsources

• Endpointswithmaximumnumberofmalwarethreats

• Toptrendsofmalwareobserved;detected,prevented,mitigated

• BruteforcepatterncheckonBastionhost

USECASE6

DETECTIONOFANOMALOUSPORTS,SERVICESANDUNPATCHEDHOSTS/NETWORKDEVICESHostsornetworkdevicesusuallygetexploitedbecausetheyoftenleftunhardened,Unpatched.

Organizations first must develop a baseline hardening guideline that includes rules for all

requiredportsandservicesrulesasperbusinessneeds,inadditiontobestpracticeslike“default

deny-all”.

Forexample,tocheckfortheservicesbeingstarted,systemslogsfromevent-viewermustbefed

into the SIEM solution, and a corresponding correlation searchmust be created against the

sourcenameof “ServiceControlManager” todetectwhatanomalous servicesgot startedor

stopped.

21

Organizationscanalsocheckoutforvulnerableports.Servicescanbeexposedbydeployinga

vulnerabilitymanagerandrunningaregularscanonthenetwork.Thereportcanbefedintothe

SIEMsolutiontogetamorecomprehensivereportencompassingriskrateofthemachinesinthe

network.Someusecasesthatanorganizationcanbuildfromreportsare:

• Topvulnerabilitiesdetectedinnetwork

• Mostvulnerablehostsinthenetworkwithhighestvulnerabilities

Another importantaspectthatanorganizationshouldconstantlymonitoraspartoftheSIEM

processisthatallclientsorendpointsareproperlypatchedwithsoftwareupdatesandfeedthe

clientpatchstatusinformationintotheSIEMsolution.Therearevariouswaysanorganization

canplanoutforthischeck.

• Organizationscanplanouttocheckthepatch–relatedstatusbydeployingaVulnerability

ManagerandrunningaregularscantocheckoutforUnpatchedendpoints

• Organizationscandeploya“centralizedupdatemanager”likeWSUSandfeedtheresults

of theupdatedstatusofendpoints into theSIEMsolutionor can feed the logsof the

manager endpoint deployed on endpoints directly into SIEM to detect all unpatched

endpointsinthenetwork

CONCLUSION

Aboveuse-casesarenotacomprehensiveSIEMsecuritychecklist,butinordertohavesuccess

with SIEM, the above listed use cases must be implemented at the minimum on every

organization’schecklist.

AnSOC(Cyber-SecurityOperationsCentre)canfunctionmucheasilywiththehelpofSIEMsuch

asSplunkwhichdoesn’trequirealotofmonitoringandcanhandlemachinedatawithoutaltering

itssourceformat.

WiththehelpofSIEMsolution,wewereabletoanalyse,detectandalsopreventmultipleattacks

on the network. We also saw how SIEM can be used as an IDS on an enterprise network.

DetectionofvariousthreatsismucheasierwiththehelpofSplunkonalargescalenetwork.

22

CREDITS

Role Individual Profile LinkedIn

CourseInstructor ShaukatMullaCourseInstructor,

GeorgeBrownCollege

https://ca.linkedin.com/in/smulla

ProjectDesigner WayneWard

NetworkSecurity

Implementation

Lecturer,George

BrownCollege

https://ca.linkedin.com/in/wayneward1

Mentorandprojectexecutionvision

AliKhan

SeniorManager,Cyber

RiskAdvisory,Deloitte

LLP.

https://ca.linkedin.com/in/khanuali

ProjectLead RanganGrama-

Yoga

Student,George

BrownCollegehttps://ca.linkedin.com/in/ranganiyengar

ProjectTeamMember AnkitPandya

Student,George

BrownCollege

https://ca.linkedin.com/in/ankit-pandya-

98316a4b

ProjectTeamMember LakshayChamoli

Student,George

BrownCollege

https://ca.linkedin.com/in/lakshay-

chamoli-48b319118

ProjectTeamMember ZhouLu

Student,George

BrownCollege

https://ca.linkedin.com/in/zhou-lu-

28512a122

Atotalof300manhourswasputintotheexecutionofthisproject.

All theUsecasesand thedataweresourced fromvarioussourcesusing theinternet.