Security Data Visualization

8/14/2019 Security Data Visualization

1/59

Shane

Hartman

CISSP,

GCIA,

GREMSuncoastSecuritySociety


2/59

DataVisualization

NetworkVisualization

Whatdoyouknow

SecurityVisualizations

CreatingaVisualizationSystem

Future


3/59

Themain

goal

of

data

visualization

is

to

communicateinformationclearlyandeffectively

throughgraphicalmeans


4/59

Withoutvisualization

we

rely

on

Tables

Lists Datasets

Emailalerts

Logfiles


5/59

Beenaround

sense

there

has

been

data

to

view

Everyoneisfamiliarwithgraphs

Bar,pie,

line,

etc.


6/59

Prettymaturearea

Lotsof

applications

in

this

area

including

InsightbyHP

SolarWinds

BigBrother

Customscripts

Mostof

these

programs

rely

on

agents

or

snmp

togathertheirinformationfordisplay

Not

all

of

them

display

visually


7/59


8/59


9/59

Thereis

little

to

no

applications

for

Security

Visualization

Applications

exist

but

they

are Toospecificcoveringonearea LikeIDS

Notvisual likesyslog

Donot

support

enough

different

areas

ie.

Routers,Switches,Firewalls,etc.

Where

does

this

lead.


10/59

Misconfiguration Failuretolockdownsystems

Fearto

make

changes

to

systems

Complacency

Exploitation Why?


11/59

Mostadministrators

dont

know

their

network

Hereiswhattheyknow

Installation

and

configuration

of

operating

systems Basicknowledgeofapplications

Basicknowledgeofnetworking

Basicknowledge

of

how

to

keep

things

working

ThePoint Basic,Basic,Basicknowledge


12/59

Intimateknowledgeofoperatingsystems,

applications,andnetworkingincluding:

Defaultconfiguration

Protocolimplementation

Hardeningstandards

Interactionwiththenetwork

Interactionwitheachother

Howdoyoudoit?

Letslookatwhatwecandonowandthengoing

forward..


13/59

FirewallLog

Visualization

Port/ApplicationVisualization

TrafficVisualization

IntrusionDetectionVisualization


14/59

Firewallsajust

routers

with

arule

base

Mostdonotprovidemuchvisualinformation

Visualinformation

is

usually

limited

to

Configurationofrules

Visuallogging

Currentactivity


15/59


16/59


17/59


18/59

Eventhough

the

system

doesnt

provide

the

informationyoucanstillgetit

Using

log

parsers

such

as

LogParser

can

allow

youtocreategraphsfromdata


19/59


20/59


21/59

UsesSQLlikestatementsforparsedata

1;31Dec2008;23:47:27;172.24.66.31;log;accept;;eth1c0;inboun

d;VPN1&

FireWall

1;;26;{E41F3FA2

3714

42E2

A4E0

02D2A79D7EBF};;domainudp;172.24.66.211;205.171.2.65;udp;65.127.183.98;;0;0;domai

nudp;62205;;28062;;;;;;;;;;;;;;;;;;;;;;;

logparser i:TSV iSeparator:; fixedSep:ON"selecttop20

service_id,count(*)

as

hits

into

Chart1.gif

from

2009

01

01.txtgroupbyservice_idorderbyhitsdesc"


22/59

Everyapplicationusesportsandprotocolsto

communicateacrossthenetwork

Manycanbeisolatedtothewellknownports

HTTP Port80

SMTP Port

25

SQL Port1433

SMB

Port

445 NetBios Port139


23/59

Doyou

known

what

servers

are

using

what

ports

Doyouknowwhatyouportdistributioninthe

network

is Doyouknowhowyourportdistributionhas

changedovertime


24/59


25/59


26/59

Arethesedistributionsnormal

DoIunderstand

why

aport

distribution

would

increaseordecreaseovertime

More/Less

servers Moreservicesperserver

Application(s)leveragingextraports

Howwere

these

graphs

created


27/59

Inadditiontoknowingportsinuseistraffic

patternsover

the

network

Throughpacketcapturesandvisualizationyou

can

Determinetrafficpatterns

Lockdownports

Optimizenetwork

topology


28/59


29/59


30/59

Arethesepatternsnormal

Isthere

anything

unusual

Isthereroomtochangeorupdatethenetwork

Howwere

these

graphs

created


31/59

Basedonsignaturesmuchlikevirusscanners

Onlyproducesinsightintowhatitdetects

Requiresagreatdealofmonitoringandmaintenance

Notas

many

questions

can

be

raised

because

everydetectisconsideredaproblem..


32/59


33/59

Becausemanyofsystemsareselfcontained

thereis

not

much

you

can

do

with

them

However:

Manyofthesystemswritetodatabases

Withsometimeandeffortyoucancreatea

commoninterfacewhichdisplaysadashboard

viewof

all

the

systems.


34/59


35/59

Beforewe

look

at

the

future

lets

get

acontext

of

whatwehavelearnedthroughanexample.

In

this

example

we

are

going

to

look

at

three

subjectsandhowmuchmoneyincoinstheyhave


36/59

Nicholashas

$2.71

in

coins

in

his

pocket.


37/59


38/59

Whatconclusionscanbedrawn

Whatcanbetheorizedaboutthesituation

Nicholashas21coinstotaling$2.71

Nicholashasmorequartersthananyother

MaybeNicholas

is

about

to

get

paid

Maybehelikesquarters

Inother

words

not

much

can

be

concluded

Toolittledata

Nothingtocompareto

Onlyassumptioncanbemade


39/59

Markhas$1.91incoins

Nicholashas$2.71incoins


40/59


41/59

Whatconclusionscanbedrawn

Markhasmorenickelsanddimes

Nickhasmorepenniesandquarters

Inotherwordsnotmuchcanbeconcluded

Still,too

little

data

Nobasistoconcludeanything

Only

assumption

can

be

made


42/59

Markhas$1.91incoins

Nicholashas$2.71incoins

Danielhas

a$1.63

in

coins


43/59

Still not much can be learned

- Lets add some more data / data types to the story


44/59


45/59


46/59


47/59


48/59

Thereismorethanonewaytolookatthedata

By

manipulating

how

data

is

displayed

you

can Getabetterunderstandingofdata

Makeassumptions

Planbetter


49/59

Datawillbevisualizedinwayswhere

assumptionswillinstantlybeknown

Someofthesevisualizationsarealreadythere

theyjustneedtobeappliedtonetworks

Lookto

other

areas

and

fields

to

see

what

they

aredoinglike

Social

Networks,

Psychology Medicine,Movies

Meteorology,etc.

Hereare

some

examples


50/59


51/59


52/59


53/59


54/59


55/59


56/59


57/59


58/59


59/59

Visualizationorgraphingofdataisgrowing

beyondsimple

bar

charts

Looksforpatternsbeyondwhatthedatasays

Visualizations

include Color

Size

3D

Sound*

Documents

Security Data Visualization