-: Detecting, preventing, and responding
to reconnaissance.
So we've talked a lot in the last couple of hours here
about all the ways that bad guys can start looking
at your network and collecting data,
and what we can do as incident responders
to see a lot of that data as well.
But now we're gonna talk about how we can
detect it, prevent it, and respond to it
when we see this stuff happening.
So, successful reconnaissance doesn't
always mean there was a successful attack.
Instead we need to realize that we
wanna limit the damage that could happen
as much as possible.
Because just because they got information
about your company, doesn't mean they were
actually able to break into your company, yet.
So we wanted to limit that.
So we're gonna utilize the same techniques
to limit the attack from both casual
and direct data reconnaissance by performing
good security practices.
Now, this is gonna minimize our threat,
which minimizes our risk.
The first thing we need to be able to do
is detect reconnaissance.
And this is gonna be monitoring
that's gonna occur at connection points
between two network zones.
So often, between your intranet and your internet,
or between your intranet and your DMZ.
You perform data collection
so you can analyze that data later.
This can be things like packet capture,
net flow capture, and logs.
All of this stuff goes in so you can detect
if somebody has been looking at your network
and trying to find a way in.
Now, there's lots of different data sources
out there to detect reconnaissance.
You can use network traffic analysis
using intrusion detection systems,
intrusion protection systems,
network based ones, host based ones,
firewalls and other security devices.
You can do this through packet analysis.
You can do it through protocol analysis,
traffic and network flow analysis,
device and system logs,
ports and vulnerability scans,
security information and event management logs,
all those things we talked about
in the last about hour worth of content
is all coming back here as places
that we can be looking to detect reconnaissance.
If you outsource your services,
you might have to rely on your software
as a service, or platform as a search provider
to detect it for you.
Because they are the ones who have access
to all these logs and you don't.
If you're doing this stuff in house,
then you'll have access to all of this.
Now, you need to be able to perform data analysis
to be able to detect reconnaissance as well.
We'll do this in many different ways,
and there's five big ones.
The first one is anomaly analysis.
You're gonna say, what is different about this?
What's not normal?
If you know what normal is, what your baseline is,
you could detect the abnormal spikes
and figure out that reconnaissance was happening.
Trend analysis.
This is gonna help you identify future problems
based on past performance.
For example, if you look and every night at midnight
there's traffic congestion on your site,
you may need to figure out why,
and it may be because you're doing
off site backups at that time.
Or, some part of the world is waking up
and buying a lot of your product, right?
These are the trends you need to figure out
and they'll help you determine
if there's reconnaissance going on
or just business practices you need to fix.
Signature analysis.
This is gonna be based off fingerprints
or hashes to detect threats.
So if we have somebody trying to get
a stage one dropper on your system,
there's a hash associated with that
particular file, we can detect it.
Heuristic or behavioral analysis.
This is things that are gonna detect threats
based on the behavior of the thing,
similar to that dynamic analysis
we talked about with malware,
and it's also useful to detect unknown threats.
You can see what they're doing
and based on that behavior, you can block them.
And finally, manual analysis.
Manual analysis requires human expertise
to analyze the data.
Hey, that's you.
That's somebody who's CSA+ qualified.
Somebody who's a security analyst.
They are your manual analysis person.
So, how do we prevent active reconnaissance?
Well, we talked about all sorts of ways
to do active reconnaissance, and there's
really four big ways to prevent it.
The first is to employ network defenses.
You're going to put up firewalls.
You're going to put up intrusion detection
and intrusion prevention systems.
Web application firewalls and other things like this.
You want to limit your exposure of services
and know your forward facing footprint.
So what does that mean?
It means get outside your network
and try to do a fingerprinting of your network
and see what the attackers can see.
That's the external network scan we talked about.
You want to utilize an intrusion prevention system
to limit or stop probes and scans.
They can detect things like ping scans,
ping sweeps, excuse me, as well as other different
types of things that are doing
reconnaissance on your network
and they can block them.
Also, you wanna utilize monitoring and alert systems
that are based on signature, behavior, or anomaly
based detection like we talked about
in the last slide, to figure out how
you're going to detect and stop those
things from happening based on either behavior,
or signature, or anomaly based detection methods.
Now, some other things we can do to prevent
passive reconnaissance, is we can control
the information release.
This is like good security practices.
Do I wanna put out everything on the internet?
Well, no.
Certain things need to be scrubbed.
We're gonna clean the metadata off,
we're gonna clean off the excess,
and we're gonna post those documents at that point.
We're gonna blacklist systems that keep
abusing our services.
If there is one particular computer that keeps trying
to scan our network over and over, just black hole it,
don't let 'em come on your network, right?
If you have data entry forms,
you wanna stop scripts and bots from detecting your data,
you can use CAPTCHAs.
That's those words, or those pictures
that you have to type in manually
to show that you are a human when you do a search.
That's the idea there.
You can utilize third-party registration
for domain and IPs.
You saw that when I showed you the Google example
for their WHOIS.
It said it was a private registrar
and that way you can see all the data
that you wanna be able to see,
and a lot of big companies are using that.
You wanna set rate limits for lookups and searches.
So we talked about that before
when we talked about DNS harvesting,
you can set that rate limit so instead of every second
that they can do a look up, they can do
it every minute, or every 10 minutes,
or whatever it is you wanna set it.
You can do the same thing for any
lookups or searches on your sites and servers.
And then you wanna avoid publishing your zone files.
That DNS zone transfer files,
don't allow that, because that's just
a gold mine of information for an attacker.
And then finally, one of the most important things
is you need to educate your users
about social media risks.
Because your users are your biggest threat.
They are your biggest technical threat,
and they're your biggest operational threat.
You can put up all the firewalls you want.
You can put up all the stringent controls
and control what your company posts,
but if you have somebody in the mail room
that clicks on that link,
they're gonna let me right in the front door, right?
Or if they're posting information about your company,
that's information I can steal.
All of that stuff is based on your users,
so remember, users are your biggest threat.
You've gotta make sure you train them properly
on how to do proper security in your network.