Network Security With - Pearsoncmg
Network Security withNetFlow and IPFIXBig Data Analytics for Information SecurityOmar SantosCisco Press800 East 96th StreetIndianapolis, Indiana 46240 USA
iiNetwork Security with NetFlow and IPFIXNetwork Security with NetFlow and IPFIXOmar SantosCopyright 2016 Cisco Systems, Inc.Published by:Cisco Press800 East 96th StreetIndianapolis, IN 46240 USAAll rights reserved. No part of this book may be reproduced or transmitted in any form or by any means,electronic or mechanical, including photocopying, recording, or by any information storage and retrievalsystem, without written permission from the publisher, except for the inclusion of brief quotations in areview.Printed in the United States of AmericaFirst Printing September 2015Library of Congress Control Number: 2015945876ISBN-13: 978-1-58714-438-7ISBN-10: 1-58714-438-7Warning and DisclaimerThis book is designed to provide information about network security using Cisco NetFlow. Every efforthas been made to make this book as complete and as accurate as possible, but no warranty or fitness isimplied.The information is provided on an “as is” basis. The authors, Cisco Press, and Cisco Systems, Inc. shallhave neither liability nor responsibility to any person or entity with respect to any loss or damagesarising from the information contained in this book or from the use of the discs or programs that mayaccompany it.The opinions expressed in this book belong to the author and are not necessarily those of CiscoSystems, Inc.Trademark AcknowledgmentsAll terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Cisco Press or Cisco Systems, Inc., cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark orservice mark.Special SalesFor information about buying this title in bulk quantities, or for special sales opportunities (which mayinclude electronic versions; custom cover designs; and content particular to your business, traininggoals, marketing focus, or branding interests), please contact our corporate sales department atcorpsales@pearsoned.com or (800) 382-3419.For government sales inquiries, please contact governmentsales@pearsoned.com.For questions about sales outside the U.S., please contact international@pearsoned.com.
iiiFeedback InformationAt Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each bookis crafted with care and precision, undergoing rigorous development that involves the unique expertiseof members from the professional technical community.Readers’ feedback is a natural continuation of this process. If you have any comments regarding how wecould improve the quality of this book, or otherwise alter it to better suit your needs, you can contact usthrough email at feedback@ciscopress.com. Please make sure to include the book title and ISBN in yourmessage.We greatly appreciate your assistance.Publisher: Paul BogerCopy Editor: Keith ClineAssociate Publisher: Dave DusthimerTechnical Editors: Lou Ronnau, John StuppiBusiness Operation Manager, Cisco Press:Jan CornelssenEditorial Assistant: Vanessa EvansAcquisitions Editor: Denise LincolnManaging Editor: Sandra SchroederSenior Development Editor:Christopher ClevelandProject Editor: Mandie FrankBook Designer: Mark ShirarComposition: CodeMantraSenior Indexer: Cheryl LenserProofreader: Sarah Kearns
ivNetwork Security with NetFlow and IPFIXAbout the AuthorOmar Santos is a Principal Engineer in the Cisco Product Security Incident ResponseTeam (PSIRT) part of Cisco’s Security Research and Operations. He mentors and leadsengineers and incident managers during the investigation and resolution of securityvulnerabilities in all Cisco products. Omar has been working with information technology and cyber security since the mid-1990s. Omar has designed, implemented, and supported numerous secure networks for Fortune 100 and 500 companies and for the U.S.government. Prior to his current role, he was a Technical Leader within the World WideSecurity Practice and the Cisco Technical Assistance Center (TAC), where he taught, led,and mentored many engineers within both organizations.Omar is an active member of the security community, where he leads several industrywide initiatives and standard bodies. His active role helps businesses, academic institutions, state and local law enforcement agencies, and other participants that are dedicatedto increasing the security of the critical infrastructure.Omar is the author of several books and numerous whitepapers, articles, and securityconfiguration guidelines and best practices. He has also delivered numerous technicalpresentations at many conferences and to Cisco customers and partners, in addition tomany C-level executive presentations to many organizations. Omar is the author of thefollowing Cisco Press books:nCCNA Security 210-260 Official Cert Guide, ISBN-13: 9781587205668nDeploying Next-Generation Firewalls Live Lessons, ISBN-13: 9781587205705nCisco’s Advanced Malware Protection (AMP), ISBN-13: 9781587144462nCisco ASA Next-Generation Firewall, IPS, and VPN Services (3rd Edition),ISBN-10: 1587143070nCisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive SecurityAppliance (2nd Edition), ISBN-10: 1587058197nCisco ASA: All-in-One Firewall, IPS, and VPN Adaptive Security Appliance,ISBN-10: 1587052091nCisco Network Admission Control, Volume: Deployment and Management,ISBN-10: 1587052253nEnd-to-End Network Security: Defense-in-Depth, ISBN-10: 1587053322
vAbout the Technical ReviewersJohn Stuppi, CCIE No. 11154, is a Technical Leader in the Cisco Security Solutions(CSS) organization at Cisco, where he consults Cisco customers on protecting their network against existing and emerging cyber security threats. In this role, John is responsible for providing effective techniques using Cisco product capabilities to provide identification and mitigation solutions for Cisco customers who are concerned with current or expected security threats to their network environments. Current projects includehelping customers leverage DNS and NetFlow data to identify and subsequently mitigatenetwork-based threats. John has presented multiple times on various network securitytopics at Cisco Live, Black Hat, and other customer-facing cyber security conferences. Inaddition, John contributes to the Cisco Security Portal through the publication of whitepapers, Security Blog posts, and Cyber Risk Report articles. Prior to joining Cisco, Johnworked as a network engineer for JPMorgan, and then as a network security engineer atTime, Inc., with both positions based in New York City. John is also a CISSP (#25525)and holds an Information Systems Security (INFOSEC) professional certification. Inaddition, John has a Bachelor of Science in Electrical Engineering degree from LehighUniversity and an MBA from Rutgers University. John lives in Ocean Township, NewJersey (a.k.a the Jersey Shore) with his wife, two kids, and his dog.Lou Ronnau is a Consulting Engineer in the Cisco Security Solutions group at CiscoSystems, where he has worked for more than 20 years. In this position, he works withcustomers to identify and mitigate threats to the secure operation of their data networks.Lou has presented at Cisco Live and other industry security conferences and is a CiscoPress author. In his spare time, Lou enjoys flying as a private pilot and scuba diving.
viNetwork Security with NetFlow and IPFIXDedicationI want to dedicate this book to my lovely wife, Jeannette, and my two beautiful children,Hannah and Derek, who have inspired and supported me throughout the developmentof this book.I also dedicate this book to my father, Jose, and write in memory of my mother,Generosa. Without their knowledge, wisdom, and guidance, I would not have the goalsthat I strive to achieve today.
viiAcknowledgmentsI want to thank the technical editors, John Stuppi and Lou Ronnau, for their time andtechnical expertise. They verified my work and corrected me in all the major and minormistakes that were hard to find.I also want to thank the Cisco Press team, especially Denise Lincoln, Chris Cleveland,and Mandie Frank for their patience, guidance, and consideration. Their efforts aregreatly appreciated.Kudos to the Cisco product development teams for delivering such a great product portfolio.Finally, I want to acknowledge the Cisco PSIRT and Security Research and Operations.Some of the best and brightest minds in the network security industry work there, supporting and protecting our Cisco customers, often under very stressful conditionsand working miracles daily.
viiiNetwork Security with NetFlow and IPFIXContents at a GlanceIntroduction xviChapter 1Introduction to NetFlow and IPFIXChapter 2Cisco NetFlow Versions and FeaturesChapter 3Cisco Flexible NetFlowChapter 4NetFlow Commercial and Open Source Monitoring and Analysis SoftwarePackages 75Chapter 5Big Data Analytics and NetFlowChapter 6Cisco Cyber Threat Defense and NetFlowChapter 7Troubleshooting NetFlowChapter 8Case StudiesIndex27324713959189111129
ixContentsIntroduction xviChapter 1Introduction to NetFlow and IPFIX 1Introduction to NetFlow1The Attack Continuum2The Network as a Sensor and as an EnforcerWhat Is a Flow?34NetFlow Versus IP Accounting and BillingNetFlow for Network Security67Anomaly Detection and DDoS Attacks 8Data Leak Detection and Prevention9Incident Response and Network Security Forensics 9Traffic Engineering and Network Planning 14IP Flow Information Export15IPFIX Architecture 16IPFIX Mediators17IPFIX Templates17Option Templates19Introduction to the Stream Control Transmission Protocol (SCTP) 19Supported Platforms 20Introduction to Cisco Cyber Threat Defense 21Cisco Application Visibility and Control and NetFlow 22Application Recognition22Metrics Collection and Exporting23Management and Reporting SystemsControl2323Deployment Scenarios 24Deployment Scenario: User Access Layer 24Deployment Scenario: Wireless LAN 25Deployment Scenario: Internet Edge 26Deployment Scenario: Data Center 28Public, Private, and Hybrid Cloud Environments32Deployment Scenario: NetFlow in Site-to-Site and Remote VPNs 33NetFlow Remote-Access VPNsNetFlow Site-to-Site VPNs3433
xNetwork Security with NetFlow and IPFIXNetFlow Collection Considerations and Best Practices 35Determining the Flows per Second and Scalability 36Summary 37Chapter 2Cisco NetFlow Versions and Features39NetFlow Versions and Respective Features 39NetFlow v1 Flow Header Format and Flow Record Format40NetFlow v5 Flow Header Format and Flow Record Format41NetFlow v7 Flow Header Format and Flow Record Format42NetFlow Version 943NetFlow and IPFIX ComparisonSummaryChapter 35757Cisco Flexible NetFlow 59Introduction to Cisco’s Flexible NetFlow 59Simultaneous Application Tracking 60Flexible NetFlow Records61Flexible NetFlow Key Fields61Flexible NetFlow Non-Key FieldsNetFlow Predefined RecordsUser-Defined RecordsFlow Monitors65Flow Exporters65Flow Samplers63656566Flexible NetFlow ConfigurationConfigure a Flow Record6667Configuring a Flow Monitor for IPv4 or IPv6 69Configuring a Flow Exporter for the Flow Monitor 71Applying a Flow Monitor to an Interface 73Flexible NetFlow IPFIX Export FormatSummaryChapter 47474NetFlow Commercial and Open Source Monitoring and AnalysisSoftware Packages 75Commercial NetFlow Monitoring and Analysis Software PackagesLancope’s StealthWatch Solution7576Plixer’s Scrutinizer 79Open Source NetFlow Monitoring and Analysis Software PackagesNFdump8180
xi86NfSenSiLK86SiLK Configuration Files87Filtering, Displaying, and Sorting NetFlow Records with SiLKCounting, Grouping, and Mating NetFlow Records with SilkSiLK IPset, Bag, and Prefix Map Manipulation ToolsIP and Port Labeling FilesSiLK Runtime Plug-Ins888989SiLK Utilities for Packet Capture and IPFIX ProcessingUtilities to Detect Network ScansSiLK Flow File UtilitiesAdditional SiLK Utilities90909091Elasticsearch, Logstash, and Kibana Stack 92ElasticsearchLogstash9292Kibana 93Elasticsearch Marvel and ShieldELK Deployment TopologyInstalling ELK949495Installing Elasticsearch96Install Kibana 105Installing Nginx106Install Logstash107SummaryChapter 5109Big Data Analytics and NetFlow 111Introduction to Big Data Analytics for Cyber SecurityWhat Is Big Data?111111Unstructured Versus Structured DataExtracting Value from Big Data112113NetFlow and Other Telemetry Sources for Big Data Analytics forCyber Security 114OpenSOCHadoopHDFS115116117Flume 1198788SiLK’s Python Extension88
xiiNetwork Security with NetFlow and 24Third-Party Analytic Tools 125Other Big Data Projects in the Industry 126Understanding Big Data Scalability: Big Data Analytics in the Internet ofEverything 127SummaryChapter 6128Cisco Cyber Threat Defense and NetFlow129Overview of the Cisco Cyber Threat Defense Solution 129The Attack Continuum 130Cisco CTD Solution Components131NetFlow Platform Support 133Traditional NetFlow Support in Cisco IOS SoftwareNetFlow Support in Cisco IOS-XR SoftwareFlexible NetFlow Support133135135NetFlow Support in Cisco ASA140Deploying the Lancope StealthWatch System 140Deploying StealthWatch FlowCollectors 142StealthWatch FlowReplicators146StealthWatch Management Console 146Deploying NetFlow Secure Event Logging in the Cisco ASA148Deploying NSEL in Cisco ASA Configured for Clustering 151Unit Roles and Functions in ClusteringClustering NSEL Operations152152Configuring NSEL in the Cisco ASA 153Configuring NSEL in the Cisco ASA Using ASDM153Configuring NSEL in the Cisco ASA Using the CLI155NSEL and Syslog156Defining the NSEL Export Policy157Monitoring NSEL 159Configuring NetFlow in the Cisco Nexus 1000V 160Defining a Flow Record161Defining the Flow Exporter162
xiiiDefining a Flow Monitor 163Applying the Flow Monitor to an Interface164Configuring NetFlow in the Cisco Nexus 7000 Series 164Configuring the Cisco NetFlow Generation Appliance166Initializing the Cisco NGA 166Configuring NetFlow in the Cisco NGA via the GUI 168Configuring NetFlow in the Cisco NGA via the CLI 169Additional Cisco CTD Solution Components 171Cisco ASA 5500-X Series Next-Generation Firewallsand the Cisco ASA with FirePOWER Services 171Next-Generation Intrusion Prevention Systems 172FireSIGHT Management Center 173AMP for Endpoints 173AMP for NetworksAMP Threat GridEmail Security176176177Email Security ApplianceCloud Email Security177179Cisco Hybrid Email Security 179Web Security180Web Security Appliance180Cisco Content Security Management ApplianceCisco Cloud Web Security184185Cisco Identity Services Engine 186Summary 187Chapter 7Troubleshooting NetFlow189Troubleshooting Utilities and Debug Commands 189Troubleshooting NetFlow in Cisco IOS and Cisco IOS XE Devices 194Cisco IOS Router Flexible NetFlow Configuration 195Troubleshooting Communication Problems with theNetFlow Collector 201Additional Useful Troubleshooting Debug and Show Commands 204Verifying a Flow Monitor Configuration204Displaying Flow Exporter Templates and Export IDsDebugging Flow Records212Preventing Export Storms with Flexible NetFlow213207
xivNetwork Security with NetFlow and IPFIXTroubleshooting NetFlow in Cisco NX-OS Software 214Troubleshooting NetFlow in Cisco IOS-XR Software 217Flow Exporter Statistics and Diagnostics219Flow Monitor Statistics and Diagnostics 222Displaying NetFlow Producer Statistics in Cisco IOS-XR 226Additional Useful Cisco IOS-XR Show Commands228Troubleshooting NetFlow in the Cisco ASA 228Troubleshooting NetFlow in the Cisco NetFlow Generation Appliance 235Gathering Information About Configured NGAManaged Devices 235Gathering Information About the Flow Collector 236Gathering Information About the Flow Exporter 237Gathering Information About Flow Records 237Gathering Information About the Flow Monitor 238Show Tech-Support 239Additional Useful NGA show CommandsSummaryChapter 8245246Case Studies 247Using NetFlow for Anomaly Detection and Identifying DoS Attacks 247Direct DDoS Attacks248Reflected DDoS AttacksAmplification Attacks248249Identifying DDoS Attacks Using NetFlow 250Using NetFlow in Enterprise Networks to Detect DDoS Attacks 250Using NetFlow in Service Provider Networksto Detect DDoS Attacks 253Using NetFlow for Incident Response and Forensics 254Credit Card Theft254Theft of Intellectual Property259Using NetFlow for Monitoring Guest Users and ContractorsUsing NetFlow for Capacity Planning267Using NetFlow to Monitor Cloud Usage 269SummaryIndex 273271262
xvCommand Syntax ConventionsThe conventions used to present command syntax in this book are the same conventionsused in the IOS Command Reference. The Command Reference describes these conventions as follows:nBoldface indicates commands and keywords that are entered literally as shown.In actual configuration examples and output (not general command syntax),boldface indicates commands that are manually input by the user (such as ashow command).nItalic indicates arguments for which you supply actual values.nVertical bars ( ) separate alternative, mutually exclusive elements.nSquare brackets ([ ]) indicate an optional element.nBraces ({ }) indicate a required choice.nBraces within brackets ([{ }]) indicate a required choice within an optional element.
xviNetwork Security with NetFlow and IPFIXIntroductionCisco NetFlow is now the primary network accounting technology in the industry.Visibility into the network is an indispensable tool for network and security professionals. In response to new requirements and cyber security headaches, networkoperators and security professionals are finding it critical to understand how the networkis behaving. Cisco NetFlow creates an environment where network administrators andsecurity professionals have the tools to understand who, what, when, where, and hownetwork traffic is flowing.Who Should Read This Book?This book serves as comprehensive guide for any network and security professional whomanages network security, installs and configures network security features to provideadditional visibility. It encompasses topics from an introductory level to advanced topics on Cisco NetFlow, Cisco Cyber Threat Defense, and big data analytics tools such asLogstash, Kibana, Elasticsearch, and many others.How This Book Is OrganizedThe following is an overview of how this book is organized:nChapter 1, “Introduction to NetFlow and IPFIX”: This chapter provides anoverview of Cisco NetFlow and IPFIX. Cisco NetFlow and IPFIX provide a keyset of services for IP applications, including network traffic accounting, usagebased network billing, network planning, security, denial-of-service monitoringcapabilities, and network monitoring. NetFlow provides valuable informationabout network users and applications, peak usage times, and traffic routing.Cisco invented NetFlow and is the leader in IP traffic flow technology.nChapter 2, “Cisco NetFlow Versions and Features”: This chapter covers thedifferent Cisco NetFlow versions and features available on each version. It alsocovers the NetFlow v9 export format and packet details, and includes a detailedcomparison between NetFlow and IPFIX.nChapter 3, “Cisco Flexible NetFlow”: Flexible NetFlow provides enhancedoptimization of the network infrastructure, reduces costs, and improves capacityplanning and security detection beyond other flow-based technologies availabletoday. This chapter provides an introduction to Cisco’s Flexible NetFlow, and itcovers the Flexible NetFlow components and fields. It also provides step-by-stepguidance on how to configure flexible NetFlow in Cisco IOS Software.nChapter 4, “NetFlow Commercial and Open Source Monitoring and AnalysisSoftware Packages”: This chapter provides details about the top commercialNetFlow analyzers. It also provides detailed information about the top opensource NetFlow analyzers including SiLK, Flow-tools, FlowScan, NTop, EHNT,BPFT, Cflowd, Logstash, Kibana, Elasticsearch, and others.
xviinChapter 5, “Big Data Analytics and NetFlow”: Big data analytics is a keyand growing network security, monitoring, and troubleshooting trend. CiscoNetFlow provides a source of relevant big data that customers should beanalyzing to improve the performance, stability, and security of their networks.This chapter describes how NetFlow is used for big data analytics for cybersecurity, along with other network telemetry capabilities such as firewalllogs, syslog, SNMP, and authentication, authorization and accounting logs,in addition to logs from routers and switches, servers, and endpoint stations,among others.nChapter 6, “Cisco Cyber Threat Defense and NetFlow”: Cisco has partneredwith Lancope to deliver a solution that provides visibility into security threatsby identifying suspicious traffic patterns in the corporate network. Thesesuspicious patterns are then augmented with circumstantial informationnecessary to determine the level of threat associated with a particular incident.This solution allows a network administrator or security professional to analyzethis information in a timely, efficient, and cost-effective manner for advancedcyber threats. This chapter provides detailed coverage of Cisco Cyber ThreatDefense Solution. Cisco Cyber Threat Defense Solution utilizes the LancopeStealthWatch System to analyze NetFlow information from Cisco switches,routers, and the Cisco ASA 5500 Next-Generation Firewalls to detect advancedand persistent security threats such as internally spreading malware, data leakage,botnet command-and-control traffic, and network reconnaissance. The Cisco ISEsolution supplements StealthWatch NetFlow-based behavioral threat detectiondata with contextual information such as user identity, user authorizationlevel, device type, and posture. This chapter provides design and configurationguidance when deploying the Cisco Cyber Threat Defense Solution.nChapter 7, “Troubleshooting NetFlow”: This chapter focuses on the differenttechniques and best practices available when troubleshooting NetFlowdeployments and configurations. It assumes that you already have an understandingof the topics covered in previous chapters, such as configuration and deploymentof NetFlow in all the supported devices.nChapter 8, “Case Studies”: This chapter covers several case studies and reallife scenarios on how NetFlow is deployed in large enterprises and in small andmedium-sized businesses.
This page intentionally left blank
This page intentionally left blank
Chapter 5Big Data Analytics and NetFlowThis chapter covers the following topics:nIntroduction to big data analytics for cyber securitynNetFlow and other telemetry sources for big data analytics for cyber securitynOpen Security Operations Center (OpenSOC)nUnderstanding big data scalability: Big data analytics in the Internet ofEverything (IoE)Introduction to Big Data Analytics for Cyber SecurityBig data analytics is the practice of studying large amounts of data of a variety of typesand a variety of courses to learn interesting patterns, unknown facts, and other usefulinformation. Big data analytics can play a crucial role in cyber security. Many in theindustry are changing the tone of their conversation, saying that it is no longer if orwhen your network will be compromised, but the assumption is that your network hasalready been hacked or compromised, and suggest focusing on minimizing the damageand increasing visibility to aid in identification of the next hack or compromise.Advanced analytics can be run against very large diverse data sets to find indicatorsof compromise (IOCs). These data sets can include different types of structured andunstructured data processed in a “streaming” fashion or in batches. NetFlow plays animportant role for big data analytics for cyber security, and you will learn why as youread through in this chapter.What Is Big Data?There are a lot of very interesting definitions for the phenomenon called big data. Itseems that a lot of people have different views of what big data is. Let’s cut through the
112 Chapter 5: Big Data Analytics and NetFlowmarketing hype and get down to the basics of the subject. A formal definition for bigdata can be obtained in the Merriam-Webster dictionary: ta.An accumulation of data that is too large and complex for processing by traditionaldatabase management tools.Big data usually includes data sets with sizes beyond the ability of commonly usedsoftware tools to capture, curate, manage, and process the data within a tolerableelapsed time.The size of data that can be classified as big data is a moving target. It can range from afew terabytes to yottabytes of data in a single data set. For instance:nA petabyte is 1000 terabytes.nAn exabyte is 1000 petabytes.nA zettabyte is 1000 exabytes.nA yoyabyte is 1000 zettabytes.Tip Cisco has created the Cisco Visual Networking Index (VNI). Cisco VNI is anongoing initiative to forecast and analyze the growth and use of the Internet, in additionto the data being transferred. You can find details of the Cisco VNI global IP trafficforecast and the methodology behind it at http://www.cisco.com/go/vni.Unstructured Versus Structured DataThe term unstructured data is used when referring to data that does not have a predefined data model or is not organized in a predetermined way. Typically, unstructureddata is defined as data that is not typically tracked in a “structured” or traditional rowcolumn database. The prime examples of unstructured data are as follows:nMultimedia content such as videos, photos, and audio filesnE-mail messagesnSocial media (Facebook, Twitter, LinkedIn) status updatesnPresentationsnWord processing documentsnBlog postsnExecutable filesIn the world of cyber security, a lot of the network can be also categorized as unstructured:nSyslognSimple Network Management Protocol (SNMP) logs
Introduction to Big Data Analytics for Cyber Security 113nNetFlownServer and host logsnPacket capturesnExecutablesnMalwarenExploitsIndustry experts estimate that the majority of the data in any organization is unstructured, and the amount of unstructured data is growing significantly. There are numerous,disparate data sources. NetFlow is one of the largest single sources, and it can grow totens of terabytes of data per day in large organizations, and it is expected to grow overthe years to petabytes. The differentiation in the usefulness of any big data solution isthe merging of numerous data sources and sizes that are all in the same infrastructureand providing the ability to query across all of these different data sets using the samelanguage and tools.There is an industry concept called Not-Only SQL (NoSQL), which is the name given toseveral databases that do not require SQL to process data. However, some of these databases support both SQL and non-SQL forms of data processing.Big data analytics can be done in combination of advanced analytics disciplines such aspredictive analytics and data mining.Note Cisco acquired Cognitive Security in 2013, a company focused on applyingartificial intelligence techniques to detect advanced cyber threats. The new Cisco securitysolutions integrate a range of sophisticated technologies to identify and analyze keythreats through advanced behavioral analysis of real-time data.Extracting Value from Big DataAny organization can collect data just for the matter of collecting data; however, theusefulness of such data depends on how actionable such data is to make any decisions(in addition to whether the data is regularly monitored and analyzed).There are three high-level key items for big data analytics:nnnInformation management: An ongoing management and process control for bigdata analytics.High-performance analytics: The ability to gain fast actionable information frombig data and being able to solve complex problems using more data.Flexible deployment options: Options for on-premises or cloud-based, software-asa-service (SaaS) tactics for big data analytics.
114 Chapter 5: Big Data Analytics and NetFlowThere are a few high-level approaches for accelerating the analysis of giant data sets. Thefollowing are the most common:nnnnnGrid computing: A centralized grid infrastructure for dynamic analysis with highavailability and parallel processing.Intra-database processing: Performing data management, analytics, and reportingtasks using scalable architectures.In-memory analytics: Quickly solves complex problems using in-memory, multiuseaccess to data and rapidly runs new scenarios or complex analytical computations.Support for Hadoop: Stores and processes large volumes of data on commodityhardware. Hadoop will be covered in a few pages in the section “Hadoop.”Visualizations: Quickly visualize correlations and patterns in big data to identifyopportunities for further analysis and to improve decision making.Examples of technologies used in big data analytics are covered in detail later in thischapter.NetFlow and Other Telemetry Sources for Big DataAnalytics for Cyber SecurityAs discussed in Chapter 1, “Introduction to NetFlow and IPFIX,” NetFlow providesdetailed network telemetry that allows the administrator to:nSee what is actually happening across your entire networknRegain control of your network, in case of denial-of-service (DoS) attacknQuickly identify compromised endpoints and network infrastructure devicesnMonitor network usage of employees, contractors, or partnersnObtain network telemetry during security incident response and forensicsnDetect firewall misconfigurations and inappropriate access to corporate resourcesAs previously mentioned, NetFlow data can grow to tens of terabytes of data per dayin large organizations, and it is expected to grow over the years to petabytes. However,many other telemetry sources can be used in conjunction with NetFlow to identify, classify, and mitigate potential threats in your network.
topics at Cisco Live, Black Hat, and other customer-facing cyber security conferences. In addition, John contributes to the Cisco Security Portal through the publication of white- . NetFlow v7 Flow Header Format and Flow Record Format 42 NetFlow Version 9 43 NetFlow and IPFIX Comparison 57 Summary 57 Chapter 3 Cisco Flexible NetFlow 59
security in application, transport, network, link layers Network Security 8-3 Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing wireless LANs 8.8 Operational security
and Security. Phil's areas of expertise include sanctioned attack and penetration, digital and network forensics, wireless security, network security architecture, and policy work. Phil is also an adjunct professor at St. John's University in Queens, New York, teaching wireless security to all levels of undergraduate students.
3 CONTENTS Notation 10 Preface 12 About the Author 18 PART ONE: BACKGROUND 19 Chapter 1 Computer and Network Security Concepts 19 1.1 Computer Security Concepts 21 1.2 The OSI Security Architecture 26 1.3 Security Attacks 27 1.4 Security Services 29 1.5 Security Mechanisms 32 1.6 Fundamental Security Design Principles 34 1.7 Attack Surfaces and Attack Trees 37
Network Security Groups Network Security Groups are used to provide traffic control at the packet level. You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allo
network.edgecount Return the Number of Edges in a Network Object network.edgelabel Plots a label corresponding to an edge in a network plot. network.extraction Extraction and Replacement Operators for Network Objects network.indicators Indicator Functions for Network Properties network.initialize Initialize a Network Class Object
Part I: Network Security CHAPTER 1 Network Design 1 CHAPTER 2 Network Implementation 41 Part II: Compliance and Operational Security CHAPTER 3 Risk Management 69 CHAPTER 4 Response and Recovery 103 Part III: Threats and Vulnerabilities . CompTIA Security SY0-301 Authorized Exam Cram, Third Edition .
Network security administrators earn a good income. According to Glassdoor, network security administrators earn a national average of almost 70,000 per year. CompTIA Security is the first step in starting your career as a network security administrator or systems security administrator. Professionals who are CompTIA Security certified are
1 8: Network Security 8-1 Chapter 8: Network Security Chapter goals: understand principles of network security: cryptography and its manyuses beyond “confidentiality” authentication message integrity key distribution security in practice: firewalls security in application, transport, netwo
