Advanced Threat Defence Using NetFlow - A L C A T R O N . N E T

Components for NetFlow Security MonitoringStealthWatch ManagementConsole Management and reporting Up to 25 FlowCollectors Up 3 million fps globallyStealthWatch FlowCollector Collect and analyse Up to 2000 sources Up to sustained 120,000 fpsBest Practice: Centralisecollection globallyStealthWatch FlowReplicator UDP Packet copier Forward to multiplecollection systemsNetFlowStealthWatch FlowSensor Generate NetFlow dataStealthWatch FlowSensor VE Virtual environment Visibility into ESXCisco NetworkBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public33

Uni-directionalflow recordseth0/2eth0/1NetFlow Collection: Flow Stitching10.2.2.2port 1024Start TimeInterface10.1.1.1port 80Src IPSrc PortDest IPDest PortProtoPkts SentBytesSent10:20:12.221 eth0/110.2.2.2102410.1.1.180TCP5102510:20:12.871 eth0/210.1.1.18010.2.2.21024TCP1728712Start TimeClient IP PktsServer Server CP1025528712eth0/1eth0/2102417Bi-directional: Conversation flow record Allows easy visualisation and analysisBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public34

NetFlow Collection: De-duplicationDuplicatesRouter A: 10.2.2.2:1024 - 10.1.1.1:80Router B: 10.2.2.2:1024 - 10.1.1.1:80Router C: 10.1.1.1:80 - 10.2.2.2:102410.1.1.1port 80Router BRouter CRouter A Without de-duplication: Traffic volume can be misreported False positive would occur Allows for the efficient storage of flow data Necessary for accurate host-level reporting Does not discard dataBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.10.2.2.2port 1024Cisco Public35

Conversational Flow RecordWhoWhatHowWhoWhenMore DetailsBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public36

Integrating with a SIEMLog alarms and summary info to SIEM Complete visibility throughout network Leverage specialty data handlingSecurity EventsSIEMAPISyslogBRKSEC-2073SDEENetFlowAPI’s to access database Directly access flow data (ex. getFlows) Improved scale - collection and retention Decreased cost 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public37

AgendaIntroductionAdding ContextBRKSEC-2073UnderstandingtheLandscapeFlow CollectionIntroduction toNetFlowDesign andDeploymentFlow Export 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public38

Context is CriticalBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public39

ISE as a Telemetry SourceMonitor Mode Open Mode, Multi-Auth Unobstructed Access No impact on productivity Profiling, posture assessment Gain Visibility Maintain historical session tableCorrelate NetFlow to usernameBuild User-centric reportsStealthWatchManagementConsolesyslogCisco ISEAuthenticated Session TableBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public40

Configuration: Logging on ISE1. Create Remote Logging Target on ISE2. Add Target to Logging Categories12Required Logging categories: RADIUS Accounting Profiler Administrative and Operational AuditBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public41

Configuration: Add ISE to SMC1.2.3.4.3(Not Shown) Create Admin User on ISE(Not Shown) Configure ISE or CA certificate on SMC(Shown) Add Cisco ISE to SMC Configuration(Shown) Add additional ISE nodes34. Add additional ISE nodesBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public42

Global IntelligenceList of known Commandand Control ServersBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public43

Adding Situational AwarenessClient HostClient HostGroupServer HostServer HostGroupsApplicationDurationTotalTrafficStart ActiveTime10.201.3.149Sales andMarketing,End 6.56KJan 11, 2014BRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public44

Adding Situational AwarenessClientUserNameClient HostClientHostGroupServer cStartActiveTimeKen10.201.3.149Sales andMarketing,End 56.56KJan 11,2014BRKSEC-2073Zeus 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public45

AgendaIntroductionAdding ContextWorking w CollectionOrganising the dataIntroduction toNetFlowDesign andDeploymentFlow ExportRunning Queriesand Investigations 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public46

Behavioural Analysis & Anomaly DetectionBehavioural Analysis: Leverages knowledge of known bad behaviourAnomaly Detection: Identify a change from “normal”BRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public47

StealthWatch: IndicesConcern Index: Track hosts that appear to compromising network integrityTarget Index: Track hosts that appear to be victims of the suspicious behaviour of other hostsFile Sharing Index: Tracks behaviour that is indicative of peer-to-peer activityBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public48

StealthWatch: AlarmsAlarms Indicate significant behaviour changes and policy violations Known and unknown attacks generate alarms Activity that falls outside the baseline, acceptable behaviouror established policiesBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public49

Host GroupsVirtual container of multipleIP Addresses/ranges thathave similar attributesLab serversBest Practice: classify allknown IP Addresses in oneor more host groupsBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public50

Policy TuningTune alarm thresholdsPolicies can be created forindividual host groupsDefault policy for Inside and Outside hostsBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public51

Flow Query Basics – The Flow TableFilterDetailsBRKSEC-2073Filter conditionsMore details 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public52

Flow Query Basics - FilteringSelect host toinvestigateAll flows in which this host wasa client or serverBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public53

Flow Query Basics - FilteringAll flows for 10.10.200.79 in the last hourBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public54

Flow Table: Visibility across NATUserInside localBRKSEC-2073Outside global 2014 Cisco and/or its affiliates. All rights reserved.ServerCisco Public55

Querying Events - Leveraging NSELFlow denied events over many portsBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public56

Flow Table – IPv6BRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public57

Host Groups – Targeted MonitoringHost Group Dashboard forEngineersSuspiciouslybehaving hostsAlarmsBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public58

Host Groups – Application ReportApplications inboundApplications outboundBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public59

Host Groups – Targeted ReportingGeo-IP-based Host GroupSummary chart of trafficinbound and outbound fromthis Host GroupBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public60

Host Groups – Targeted ReportingTraffic inboundTraffic outboundBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public61

Host Groups – Discovering Rogue HostsCatch All: All unclassified RFC1918 addressesTable of all individual hostsBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public62

Host Groups – Discovering Rogue HostsRogue HostsBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public63

Indicators of CompromiseRaw flow analysisOutside notificationLog analysis (SIEM)IDS AlertBehavioural analysisActivity monitoringBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public64

Attack Lifecycle Model (AKA the Kill tePrivilegesCompleteMissionMandiant APT1 Report: http://intelreport.mandiant.com/Mandiant APT1 Report.pdfKill Chain: http://bit.ly/killchainBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public65

Building a latePrivilegesCompleteMissionIOC Found:Investigate forwardsand backwardBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public66

Identifying the CulpritSupplemental Information:Indicator ofCompromise Alarm Alarm TableAlarm SummaryIDS AlertOtherIs a wormindicated? Host IPAddressNoMost recent flows/Active flowsTraffic volume/typeOther AlarmsExporter interfacesActivity – scanning?ThresholdsTouchesHostSnapshotIdentity:Yes Hosts affectedHost Groups AffectedSubnets AffectedPorts UsedProtocols UsedBRKSEC-2073Is the behaviournormal orpermissible?WormTrackerYesUsernameDevice type and OSAccess locationOrganisation/GeoRole – Client or ServerNoTune 2014 Cisco and/or its affiliates. All rights reserved. RespondCisco Public67

APT1IOC: Mandiant publishes list of domain names and IP addresses known to be used by APT1IP AddressesCreate a HostGroup for APT1BRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public68

APT1 – Host Locking Violation AlarmSet client hosts to all Inside HostsCreate a Host LockViolation Alarm forcommunication to APT1Set server hosts to APT1Disallow all trafficTrigger alarm on anyunidirectional trafficBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public69

APT1 - InvestigateYou know today what you didn’t know yesterdayRun a Flow QueryOver the last 90 daysServer or client includesthe APT1 IP Address listBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public70

APT1 – Returned FlowsInfected hostsFTP TransfersAPT1 ServersBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public71

Investigating Malware Spread: Worm TrackerWorm trackerInitial infectionSecondary infectionsSubnets being scannedIOC: IDS Alert indicating a known worm operating inside your networkBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public72

Investigating Malware Spread: Host SnapshotEverything the systemknows about 10.10.200.59BRKSEC-2073Start with CI Events. We noticesignificant scanning activity 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public73

Investigating Malware Spread: IdentityTelemetry from the ISEUsernameBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.InfectedmachineCisco Public74

Investigating Malware Spread: Touched HostsThis infected host has established a connection with another hostBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public75

Investigating Malware Spread: Touched HostsAll hosts touched by 10.10.200.59BRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public76

High Concern IndexBaseline deviated by 2,432%!BRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public77

What was this Host up to?Target – entire subnet?Scanning on TCP-445BRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public78

NetFlow and (D)DoS DetectionIdentify targets Target of suspicious activity Abnormal traffic volume Decrease in performanceIdentify attackersBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public79

Volumetric DDoSTraffic SpikesBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public80

Identifying a DDoS ParticipantIOC: Notification from 3rd party that your IP Address is participating in a DDoSPublic IP addressTime of reported attackTarget serverBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public81

Identifying a DDoS ParticipantTime of reported attackValidate attack activityUserInside localBRKSEC-2073Outside global 2014 Cisco and/or its affiliates. All rights reserved.Target ServerCisco Public82

Identify a DDoS ParticipantHost snapshotOther suspicious activityBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public83

AgendaIntroductionAdding ContextWorking w CollectionOrganising the dataIntroduction toNetFlowDesign andDeploymentFlow ExportRunning Queriesand Investigations 2014 Cisco and/or its affiliates. All rights reserved.Cisco PublicSummary84

Links and Recommended ReadingMore about the Cisco Cyber Threat Defence ://www.lancope.comRecommended ReadingCyber Threat Defence Cisco Validated Design ral/ns1015/ns1238/cyber threat defense design guide.pdfBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public85

Key TakeawaysModern threats are consistentlybypassing the security perimeterThreat Detection requires visibility andcontext into network trafficNetFlow and the Lancope StealthWatch System provide actionable security intelligenceBRKSEC-2073 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public86

Q&A

Complete Your Online Session EvaluationGive us your feedback and receive aCisco Live 2014 Polo Shirt!Complete your Overall Event Survey and 5 SessionEvaluations. Directly from your mobile device on the Cisco LiveMobile App By visiting the Cisco Live Mobile Sitewww.ciscoliveaustralia.com/mobile Visit any Cisco Live Internet Station locatedthroughout the venuePolo Shirts can be collected in the World of Solutionson Friday 21 March 12:00pm - 2:00pmBRKSEC-2073Learn online with Cisco Live!Visit us online after the conference for full accessto session videos and presentations.www.CiscoLiveAPAC.com 2014 Cisco and/or its affiliates. All rights reserved.Cisco Public

Aside: Myths about NetFlow Generation 30 Myth #1: NetFlow impacts performance Hardware implemented NetFlow has no performance impact Software implementation is typically significantly 15% processing overhead Myth #2: NetFlow has bandwidth overhead NetFlow is a summary protocol Traffic overhead is typically significantly 1% of