Free and Open Discourse

In the world of network traffic analysis and network security monitoring, free and open discourse is extremely important.  Analytical techniques that are subject to discussion and critique will always be better than those that aren't.  Quite simply put, analysts cannot thrive in a bubble, and neither can a robust network security monitoring program.

Unfortunately, there are some organizations that keep their analysts insulated, for whatever reason.  These organizations tend to wall themselves off from the free exchange of ideas.  In my experience, this hurts those organizations, as their analysts often fall behind the collective intelligence.

The good news is that ideas are always willing to be heard if someone is willing to listen.

What? When? Where? How?

When conducting network traffic analysis in support of an incident investigation, it's important to remember the four questions of incident response that an analyst should seek to answer. They are:

What?
When?
Where?
How?

The other two question words in the English language, namely the questions of Who? and Why? are best left for law enforcement to answer for a number of reasons. That's a bit beyond the scope of this blog, so I'll brush it aside for now.

The four questions of incident response can be elaborated a bit more as:

What happened? What type of incident has occurred? What damage has occurred?
When did the incident happen? When was the incident detected?
Where did the incident occur? Is it isolated or widespread? Where is the incident coming from?
How did the incident occur? How did the intruders get in (the infection vector)?

If an analyst keeps these four questions in mind, it's much easier to focus an incident investigation/analysis and ensure that the correct supporting evidence is maintained and that the correct information is reported.

It's an intuitive approach that has been proven to help analysts focus their attention to the most value-added activities. Hopefully you'll find it useful as well.

Spear Phishing

Spear phishing is a common way that attackers get into organizations. Sometimes, when attempting to spear phish an organization, an attacker will spoof one of the targeted organization's email addresses to make the spear phishing message look more legitimate. Mail protocols aren't great at prohibiting this, and thus, it's a fairly successful technique.

A simple analytical method to monitor for this is to watch mail logs or a PCAP solution for "From" addresses claiming to be from within your organization, but from mail gateway IP addresses or sender IP addresses that are outside of your organization. The data resulting from this is quite fascinating. Have a look!

GFIRST Presentation

The GFIRST Agenda came out today, and I saw that I will be presenting on the Wednesday afternoon of the conference. I'm going to be speaking about layer 7 meta-data. My goal is to get people thinking about the difference between data value and data size. I'm hoping the talk is well received!

I always enjoy GFIRST, as I seldom have the opportunity to be around so many like-minded analyst geeks at one time.

4G Hotspot

I recently picked up a 4G hotspot and am loving it so far. It did make me realize, however, that there are now more than a few options for bringing your own network with you wherever you go and hopping on-line from anywhere. Think mobile phones, tablets, 3G/4G hotspots, etc. Why am I blogging about this? Because it occurred to me that it's now possible to physically sit inside an enterprise and send and receive information over your own portable network. Guess what? There's no way for an enterprise to monitor that. Scary.

Loss of Visibility

A couple of months ago, I spoke on a panel discussing some looming challenges in the field of cyber security. As might be expected, many people asked questions of the panel relating to the move to cloud computing. At one point, I was asked what my greatest fear was relating to the cloud. My answer? Loss of visibility. When an organization moves to the cloud, that organization effectively outsources all of its logging and auditing. What if the cloud provider doesn't have all the painful lessons learned that many of us do? It pays to ask, IMO.

Remember, even the best analyst can't identify security issues on a network if the data isn't there to support the analysis....

We Already Use Layer 7 Enriched Meta-Data and Don't Know It

It occurred to me the other day that many of us analyst types already use layer 7 enriched meta-data and likely don't realize it. In thinking about it, it dawned on me that DNS logs, proxy logs, IDS alerts, etc. are all a highly specialized versions of layer 7 enriched meta-data. Think of the power of a generalized layer 7 enriched meta-data -- the ability to exploit all the advantages of meta-data, while simultaneously providing much of the detail necessary for determining the true nature of network traffic of interest. Possibly the uber data source?