Defend Against NextGen Attacks with Wire Data Pete

Defend Against Next-Gen Attacks with Wire Data Pete Anderson Senior Systems Engineer, Extra. Hop

My Background • Transplant from the frozen north (Chicago) • University of Illinois, Urbana-Champaign • 15+ years as a systems engineer in the visibility space

Wire Data as a Rich Information Source “Wire data — radically rethought and used in new ways —. . . will prove to be the most critical source of data for availability and performance management over the next five years. ”* Gartner Research Note *Source: Gartner, "Use Data- and Analytics-Centric Processes With a Focus on Wire Data to Future-Proof Availability and Performance Management, " Vivek Bhalla and Will Cappelli, March 10, 2016

NPMD: Responding to Security Breaches Gartner report titled, Network Performance Monitoring Tools Can Play A Critical Role In Responding to Security Breaches, licensed for distribution and available for download at: https: //www. extrahop. com/lp/npmd-respond-to-security-breach-direct/ Link:

2016 Revisited • The continued emergence of the “Human Vector” • 7. 3% of users are successfully phished (Execute Malicious Attachment) • Social media (43% of breaches are social) feeds intelligence • Ransomware made over $1 B in 2016, variants grew by 30 X • Io. T exploited as an attack vector Google Word Interest for “Ransomware”

Shortage of Info. Sec Talent

Security as a Strategy • • It’s a discipline, not a destination. Define a strategy, but continually refine. Identify areas that pose highest risks. Identify sensitive areas of the network. Minimize attack surface. Know your network better than your attackers. Design an incident response plan. • Tool selection should be strategic, not tactical.

Key Security Initiatives for 2017 • The need to simplify security • Rethink existing tools and methods • Engage in and embrace orchestration/automation • • Embrace APIs Thread Cyber Threat Intelligence (CTI) into your Security Apparatus • Cyber Insurance has become a principal part of business’ protection strategy • Stop waiting for the bad actors to come to you, actively seek them out (Threat Hunting)

Everything Transacts On The Network It's a rich, underutilized source of real-time business, security, application, network, and operations data. Business Data Client Data Application Data Security Data Network Data Io. T Data User Experience Data Infrastructure Data

Questions a Security Professional Must Ask Where is my data going? How should I respond? Which devices are really talking to each other? Can I easily find out how widespread an incident is and where to start? What is in my data? Are my controls working? Can I track the movement of sensitive information around the network? Can I verify firewall rules against reality and provide auditors with records of observed activity? When did things change? Can I quickly identify if something has changed, and then figure out why, or at least who I need to ask?

Why Wire Data? • Not all systems log effectively • The quality of logs depend on the developer of the application • Events of interest may not get logged at all. • Once a system is rooted, logs are routinely shut off and/or deleted • Io. T devices (usually) don’t have any logging capability

NSA’s worst nightmare: "One of our worst nightmares is that out-of-band network tap that really is capturing all the data, understanding anomalous behavior that's going on, and someone's paying attention to it. You've gotta know your network. Understand your network, because we're going to. " — Rob Joyce

Why Wire Data: continued • When bad actors worked in days, you needed to react in hours • When bad actors worked in hours, you needed to react in minutes • When bad actors worked in minutes, you needed to react in seconds • Bad actors now work in seconds, you need to react in milliseconds HOW? • Wire Data observes at the microsecond increment • Wire Data acts at the Millisecond increment

A world of Microseconds: Human/SIEM vs Malware Shutter Speed SIEM/Human SIEM/HUMAN Surveillance SIEM/HUMAN Breach Program Execution Speeds Breaches 0 10000 20000 30000 40000 50000 60000 70000

A world of Microseconds: Wire Data vs. Malware Shutter Speed Wire Data Breaches Wire Data Surveillance 0 200 400 600 800 1000 1200

Breaches are Inevitable They key: Detection Time “It’s no longer a question of whether a company will be attacked but more a question of when. ” “According to research firm Gartner, the average lag time before a breach is detected is a shocking 205 days. ” “[Companies] need to broaden their focus, develop new measures like cyberrisk tolerances and such innovative monitoring techniques as key performance indicators. ” -Business Insider, July 2016

Anatomy of a Breach Evil DNS FTP SSH HTTP SMTP LDAP My. SQL Database Target Host ICMP & TCP Mail server • User receives malicious email. • User clicks something, initiates malware & C 2 • Network is surveyed, credentials are stolen • Sensitive data is collected. • Data is exfiltrated.

Data Exfiltration and C 2 via DNS According to the 2016 Cisco Annual Security Report, approximately 69% of organizations today don't monitor or control recursive DNS traffic. Attackers love this visibility gap and Cisco reports that 92% of malware today uses DNS to establish C 2 communication, exfiltrate data, or redirect traffic. Source: http: //www. darkreading. com/threat-intelligence/wekby-pisloader-abuses-dns/d/d-id/1325729

DNS Tunneling Used by Malware for C 2 Wekby’s pisloader is a great example. Source: http: //researchcenter. paloaltonetworks. com/2016/05/unit 42 -new-wekby-attacks-use-dns-requests-as-command-control-mechanism/

No trace of the breach other than: • ATM’s camera footage of the mule • A single line in the ATMs’ log file https: //motherboard. vice. com/en_us/article/atm-hack-russia-disappearing-malware

“Fileless” Attacks “A non-malware attack is one in which an attacker uses existing software, allowed applications and authorized protocols to carry out malicious activities. Non-malware attacks are capable of gaining control of computers without downloading any malicious files, hence the name. Nonmalware attacks are also referred to as fileless, memory-based or “living-off-the-land” attacks. ” • Runs in RAM • Uses native tools • C 2 over DNS • Undetectable by traditional antivirus https: //threatpost. com/new-fileless-attack-using-dns-queries-to-carry-out-powershell-commands/124078/ https: //www. carbonblack. com/2017/02/10/non-malware-fileless-attack/

Everything Transacts on the Network … even the bad guys Evil DNS FTP SSH HTTP SMTP LDAP My. SQL Database Target Host ICMP & TCP Mail server • Multiple L 7 protocols • Various behaviors (north-south, east-west) and data exchanged • Detection at the micro-second level

Port Scanning Detection Use trend-based alerts and / anomaly detection to identify port scans, even if they are performed slowly.

Authentication Monitoring • Track privileged user logins • Ensure applications are using approved authentication methods • Record every failed and successful logins across all systems • Store historical data to simplify audit reporting and enable investigation

FTP Audit Log Identify and alert on any anomalous FTP activity and follow every action.

Traffic Blacklisting • Set rules and alerting for undesired communication. • Known-bad IPs (threat intelligence feed) • Geographic lookup Policy violation!

DNS Tunneling Detect DNS tunneling activity based on behavioral analysis multivariate scoring process.

Io. T-initiated DDo. S 2016: The year menaces multiplied https: //www. theguardian. com/technology/2016/oct/26/ddos-attack-dyn-mirai-botnet

Io. T: 20 Billion Connected Devices by 2020 No logging, no agents, no instrumentation … who’s ready? 2012 • 1. 3 billion connected things in use worldwide • People outnumber connected devices by roughly 5: 1 2020 2016 • • 6. 4 billion connected things in use worldwide, up 30 percent from 2015 5. 5 million new things will get connected every day Source: Gartner, November 2015, http: //www. gartner. com/newsroom/id/3165317 • 20. 8 billion connected things in use worldwide • Internet-connected devices will outnumber people by at least 2: 1

The Io. T Calamity • • • Mirai was just the start Static Credentials Millions will be sold AGAIN this December No strategy for patching No logs, no agents, no MIBs The individuals responsible for securing Io. T are not hardened IT war horses like some industries

Medical Devices: Healthcare’s Vulnerable Io. T “…there are so many easy targets. More than 36, 000 healthcare-related devices in the US alone are easily discoverable on Shodan” "The combination is concerning, " he notes. "Attackers are leveraging legacy malware-spreading tools that bypass a lot of today's operating systems and target older systems. " https: //www. wired. com/2017/03/medical-devices-next-security-nightmare/

Healthcare Io. T (Medical devices) Telnet example

Targeted Anomaly Detection • Create a whitelist of users or devices allowed to access specific databases, get notified about unauthorized access • Set a threshold for normal application traffic activity New Model: Micro-Perimeters Remote Workers App A: Data App A: Assets • Alert on increased failed login attempts for devices that provide access to sensitive information Unauthorized Client Policy violation!

Ransomware Activity over Time Ransomware has unquestionably become the most successful /destructive malware type to date. Word Interest for “Ransomware”, according to Google. https: //www. troyhunt. com/everything-you-need-to-know-about-the-wannacrypt-ransomware/

Wanna. Cry: Why Was it Unsuccessful?

Ransomware Detection • Check for known file extensions that are commonly associated with ransomware attacks Attacker HTTP • Create a file extension “whitelist” to uncover potential attacks • Set a threshold for normal WRITE activity • Detect instructional files typically associated with ransomware variants that are left behind during an attack SMTP CIFS File Server Client CIFS Client Mail Server

Machine Learning: The Next Generation Machine learning is becoming a requirement, not “nice to have” Machine learning will have a big impact on IT Operations & Security

Extra. Hop Addy The first machine learning platform for wire data More Productive IT • The power of machine learning in their hands • Makes proactive remediation easier Always-on, Always Learning • Continuous baselines for every device, network, and application • The service continuously improves its accuracy Superhuman IT Vision • Cross-correlate events related to the anomaly • Reduce risk by identifying security events

Addy Gives Extra. Hop a Voice Select time period to see associated anomaly events Filter anomalies by protocol and source Contextual links back to the entity and anomaly Addy understands your existing application definitions Context to quickly understand the anomaly

Thank You!

Solving the Data Gravity Problem How to Apply Cloud-Based Machine Learning to the Richest Dataset Raw Network Packet Data Real-Time Stream Processor Structured Wire Data Machine Learning in the Cloud • High volume • Low volume, portable • Always-on • Low signal-to-noise • High signal-to-noise ratio • Analyze large datasets • Unmanageable • Contextual, real-time, definitive • Scalable resources

Integration / Automation is the Key Integrate with both perimeter and microsegmentation firewall APIs or other NAC solution such as Cisco ISE. Alternatively, populate event data to a Slack Channel or Service. Now Event tracking.

SIEM Integration Proactively Assess Actual Risk Profile Simplify Compliance & Audit Detect & Respond Faster Integrate with Security Infrastructure User behavior Application behavior Unstructured network packets Extra. Hop Stream Analytics Platform Open Data Stream System behavior Data behavior Network behavior Big Data lake for security

Deploy in Any Environment Branch Offices Branch 1 Branch 2 Extra. Hop EDA 1100 Branch 3 Public Cloud: Azure & AWS Branch 4 EDA 1100 Datacenter 1 EDA 1100 Datacenter 2 Internet Extra. Hop Command Extra. Hop Multiple Datacenters