-: Network Event Monitoring.
When we look at our networks,
and we start performing this incident response,
one of the first places we're gonna look
is at the network and the network devices.
Network event analysis is a very common practice
for cybersecurity analysts.
This is where we're gonna gather, correlate,
and analyze our data
from different systems and sensors across our network,
often looking at the routers, the switches,
and other network devices.
We're gonna talk all of this information
and start analyzing it so that we can detect
or prevent incidents in the future.
One of the first places we're gonna look
is on the router itself.
The router is gonna give us a place
that we can get data flows from,
on the network as well as information on the status
of the router itself as a device,
whether it's up or down, if there's any problems,
and on the data that's flowing through it.
This is gonna rely on capturing data
about the traffic that's passing through the router,
often called a network flow.
There's a couple different types of network flows out there.
One of the most common
is what we refer to as Netflow, sFlow, or J-Flow,
depending on the manufacturer type.
All of these are standards for monitoring the traffic flows
that go on on your network.
This is metadata.
It's data about data.
This is gonna count the information
on the traffic at the interface on the routers themselves
and often it will do a sampling.
One out of every 100 packets,
one out of every 1000 packets,
or one out of every 10,000 packets,
depending on the size and scope of your network.
This is gonna give us information
such as the connection types, the speeds,
and other data about the data,
not what's inside those packets themselves.
Another thing we can look at for network flow
is what's called RMON, or remote monitoring,
and this operates at layers 1, 2, 3, and 4 of the OSI model,
taking you from the physical
all the way to the session layer.
This is gonna operate as a client server model
and it uses probes to send the information
back to a centralized database.
This is gonna provide you statistics,
histories, alarms, events, all going back
into this management information base, or MIB.
The third thing that we can use
to get information about our networks is SNMP,
or Simple Network Management protocol.
There are three versions: Versions 1, 2, and 3,
and Version 3 is considered the most secure
and the one that you should be using nowadays.
This is gonna collect information
about your routers and switches
and they're self-reporting back again using SNMP protocol
all over port 161 back to a centralized server.
This information is about the devices themselves.
It says, "I'm up, I'm down, I'm having a problem."
It doesn't actually look at the network flow,
or the network data on those devices,
but just the status of the device itself.
Why do we wanna look at a router?
As you can see in this simple diagram,
you have switches connected to a router,
and then from those routers,
it will go through an IPS, a firewall,
and then out to the internet.
This gives you a nice centralized place
of looking at everything going in and out of the network
by collecting information on that router.
Here are some examples of network flows.
On the top you can see
the type of information you're gonna get.
It's got the time, the source it's coming from,
the destination it's going to,
the destination port, the protocol, the length,
and then the information.
I've blown that up in those
second, third and fourth areas on the screen.
You don't have to memorize this type of information,
but you should be able to look at a network flow
and dissect the information that you're seeing here.
Why is this important?
Because if you're gonna be on the CSA+ exam,
or you're a cybersecurity analyst,
you're gonna spend a lot of time going through network flows
and if you see that there is information going out
to a particular destination port,
or a particular destination that's malicious,
this is a way that you can correlate that data.
Using a standardized time is gonna help you
with that as you go through your network flows.
Notice that we don't know any of the contents
of the information itself.
We just know that a connection was made
from a source to a destination,
and how long it was and how much data was sent.
Another example of network flow is shown here.
This is a different direction,
and you're gonna see what interface it's on.
You're gonna see the direction
if it was going into your network or out of your network,
and you're gonna look at the utilization.
What is the maximum utilization
and what is the current utilization?
By looking at these utilization metrics,
you can start figuring out: is this normal?
If it's not normal, you can start investigating it further
by querying the information flows,
and getting a little bit more data,
and start digging into it.
One of the things you may find is that
people are exfiltrating data from your network.
When I look at this,
one of the ones that sticks out to me is the third line.
I see that the maximum utilization was 48%,
but right now the current utilization is 3%.
Maybe at some point in the past,
somebody started taking a lot of data out.
Why is that?
It could be something malicious
like somebody stealing data from your networks,
or it could be something explainable.
Every night at midnight,
you're doing backups to an off-site cloud,
and therefore your maximum utilization went up.
Looking at these type of things will flag
and allow you to start analyzing it to see:
is it normal or is it not normal?
SNMP, we talked about this earlier.
There's three versions: Versions 1, 2, and 3.
SNMP Version 3 is the one you should be using.
It adds encryption, authentication, and user capabilities
to the SNMP protocol, adding to security.
If you see Version 1 or 2 on your networks,
you should be asking yourself:
Why are we still using it?
Investigate it, see if there's a logical reason,
but if not, turn it off and go to SNMP Version 3
because it is much more secure,
and that's what you want to be using.
The next thing we want to talk about is active monitoring.
Everything we talked about before,
when we were talking about those network flows,
when we were talking about SNMP,
that's fairly passive activities.
We can also do active monitoring,
and active monitoring is gonna send a request
to a remote system and then data's gonna be sent back
from that endpoint to a centralized server.
The difference between active monitoring
and passive monitoring is that active is active.
You're doing something to get that information.
You're sending that request.
This can get you other information
that you might not get passively,
such as availability, routes, packet delays, packet loss,
and the bandwidth being utilized.
Some examples of active monitoring are Ping and iPerf.
Ping is when data is acquired by using ICMP
against a remote system.
I can get basic up and down information for a server,
and a latency associated with it,
by using something like Ping, Google.com,
and seeing how long it takes,
what the latency is to get from my server,
all the way out to Google and back.
iPerf is a program or tool
that's gonna measure the maximum bandwidth
for a given network.
There's internal versions of iPerf
and external ones based off their cloud servers
that will allow you to do remote-testing of your links
to ensure that they're operating efficiently
and seeing what the bandwidth is.
This is useful to determine a baseline of your network,
and you can see a picture here on the bottom of the screen
that just gives you an idea of what it looks like over time,
and it provides a graphical user interface
with that information.
Another thing we can look at is passive monitoring.
Passive monitoring is gonna use a network tab
to copy all of the traffic between two different devices.
If there's an incident on your network,
you'll put on a passive tap
between your router and your firewall
so you can collect that data of everything coming in
and out of your network.
This is very useful for after-the-fact analysis
and you can capture what's called pcap data,
or packet capture data.
This information will give you
the rate of traffic, the protocols used,
and most importantly,
the content of those packets if they're not encrypted.
If they're encrypted, you'll still collect it,
but you won't be able to break into it
because it's encrypted.
If somebody's using an HTTP session,
that's in plain text,
and you can actually read
the contents of that packet going across your network
by using these passive collection methods.