-: Detecting Network Events, so we've talked about how
you can monitor the network, now, let's start talking
about what specific events we can be concerned with
and how we're gonna find them,
so, when we detect network events, security analysts
should be able to determine if an incident has occurred
based on the events they see in the logs,
and in that correlation.
You're gonna analyze the logs and other data to get
a key understanding of if the event will become an incident,
based on your instant response policies;
there are many different types of events,
but we're gonna focus on four in this particular lecture;
beaconing, unusual bandwidth consumption,
link and connection failures, and unexpected traffic.
So, beaconing, what is it?
Well, beaconing, or a heartbeat, sends a signal
to a Command and Control server, or a C2 system
that is due to a botnet or malware infection,
so you may have a work station sitting
in one of your sales forces, or one of your
accounting systems, that is sending out a ping,
maybe every 10 seconds or every five minutes.
Or every fifteen minutes, or whatever that pattern is,
and it's gonna be sent over HTTP or HTTPS, normally;
this can be difficult to detect,
but what you're gonna be looking for is a frequency
of a certain pattern, now, traditionally,
beaconing has been every blank minutes or every
blank seconds, however often that is.
But some of the newer ones are actually doing it
at random intervals, making it even harder to detect,
so you have to go through and correlate those logs
to see if you can figure it out;
now, as we look at beaconing, you have to be concerned
with the fact that beaconing is an indication of malware;
generally, as you start seeing that, you're gonna go
through the logs and see that consistent pattern,
go look at that machine and and scan for malware,
and see what other evidence you can find.
You are, if you're already taking the CSA+ exam,
or, in the real world, you are gonna see beaconing a lot;
it is very common place, because malware is so common place
at this point; generally, the beacon calls out
to the Command and Control server,
and when the Command and Control server is ready
to take action, it will then respond back to that system,
because it knows it is part of its network,
because it is continually sending that beacon.
Unusual bandwith consumption; unusual bandwidth consumption
could be a cause of service issues and can be a sign
of larger trouble, so if you're looking through your logs
and you see a high spike, as you can see here on the screen,
that's something that should be worrying you;
you want to go back and see,
why do we have that large spike?
Is it because we just brought a new service online?
But if so, wouldn't that be a continual spike?
Is it there because we had a big product announcement?
Or, is it somebody stealing a bunch of your data?
You've gotta look into this and figure out why,
now, on the CSA+ exam, you'll see this
in many different forms; you may see it in a graphical form
like this, or you may see it in a text-based output,
where they give you network utilization,
and if you can see that the norm is three or four
megabits per second, and now you're up at 10 or 15
or 20 megabits per second,
that's unusual bandwidth consumption.
And that's probably a sign that somebody
is ex-filtrating data out of your network,
so you want to look into this, and figure out why
is there such a high usage, and where that's coming from.
The next one we want to talk about is link
and connection failures, now, this generally, is gonna occur
due to a hardware, firmware or software issue,
and it's usually a problem for the IT service management
side of the house, but as you investigate it,
it could be something as simple as a bad module,
a broken cable, or an unplugged connector,
but it also could be due to bad software
or malicious software.
And if that's the case, you're gonna be getting involved
as part of the instant response,
so as you look through those graphs, you might see,
instead of the high spike, you see the low spike,
and that low spike indicates an outage.
As you can see here, on the screen, we went from 12
to one o'clock; everything was going fine,
we were operating at about five and a half megabits
per second, and then at 12:20 to 12:25,
we go to zero; why is that?
Well, we might be under a denial of service attack,
we might have a link failure, or some other issue,
something that needs to be investigated,
and we'll look at that through our instant response lens.
Now, unexpected traffic is the last category;
an unexpected traffic can be detected
by intrusion detection systems, or intrusion protection
systems, traffic monitoring systems,
or by manual observation.
You need to understand what normal is and what
a baseline is, to understand what is unexpected;
for example, if in my network, I don't use VPNs,
but I start seeing VPN traffic, that's unexpected,
and that's something that's unusual, based on my input
location, my traffic, or the amount of traffic,
or the type of traffic, in this case, a VPN.
Now, not all unexpected traffic is malicious,
but it should be investigated and understood
to determine if it is; for example, if you have a lot
of people connecting to you from Russia,
or you have a lot of people connecting to you from China,
or Uruguay or any other country, but you're a US company,
and you usually don't have that; that's unexpected
based on geography.
Look into that, and figure out the reason why;
now, how do you detect this unexpected traffic?
Well, there's three main ways; the first is by baseline
or anomaly-based, and this is, we understand what normal is,
and then we look at what is not normal,
so the monitoring system will alarm based on
traffic patterns that are outside the normal baseline;
now, the issue you have with creating a baseline,
and anomaly-based, is it's only as good as the baseline
you create, so you've gotta make sure that the period
of time you collect or create a baseline
is your normal period of time.
Don't collect it from one a.m. to two a.m.
and call it your baseline, because your employees
aren't there; create it over a long period of time,
maybe a week, maybe a month, maybe three months,
and that becomes your normal baseline of traffic;
anything outside of that, that would become unexpected.
Now, the second way we can do it is based on behavior,
or heuristics, and this is gonna use signatures
and define rules to detect, so we have a particular
signature, for instance, anything that comes from .cn,
from China, would be considered malicious off the bat
until we investigate it; that might be
your company's policy, right?
Or we may look at it and go, "anything that travels
"on port 21, which is FTP, we don't use FTP,
"that's considered heuristic; we don't want port 21
on our network," that's a behavior or heuristic-based thing.
And then, the last thing we have is protocol analysis,
and this seeks to detect what protocols are being used
that we're not expecting, so going back to my VPN example;
if I have VPNs being run on my network,
but I don't want VPNs in my network, this is something
that is out of the normal, and we would then look into
that protocol to figure out if it is something we want,
or if it's something that is malicious.
(distortion and vibration)