Cisco connect winnipeg 2018 stealthwatch whiteboard session and cisco security integration
•
2 j'aime•843 vues
Cisco connect winnipeg 2018 stealthwatch whiteboard session and cisco security integration
![Cisco Confidential© 2016 Cisco and/or its affiliates. All rights reserved. 1
Cisco Stealthwatch
Jason Maynard
Consulting Systems Engineer Cybersecurity
CCIE, CC[N|I|D]P, SFCE, C|EH, RCSS, GICSP, GPEN
#FE80CC1E
http://cs.co/Jason_Maynard_YouTube_Channel
Cisco
Connect](https://image.slidesharecdn.com/ciscoconnectwinnipeg2018-stealthwatchwhiteboardsessionandciscosecurityintegration-180531112510/85/Cisco-connect-winnipeg-2018-stealthwatch-whiteboard-session-and-cisco-security-integration-1-320.jpg)
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Cisco connect winnipeg 2018 stealthwatch whiteboard session and cisco security integration
Similaire à Cisco connect winnipeg 2018 stealthwatch whiteboard session and cisco security integration (20)
Plus de Cisco Canada
Plus de Cisco Canada (20)
Dernier
Dernier (20)
Cisco connect winnipeg 2018 stealthwatch whiteboard session and cisco security integration
- 1. Cisco Confidential© 2016 Cisco and/or its affiliates. All rights reserved. 1 Cisco Stealthwatch Jason Maynard Consulting Systems Engineer Cybersecurity CCIE, CC[N|I|D]P, SFCE, C|EH, RCSS, GICSP, GPEN #FE80CC1E http://cs.co/Jason_Maynard_YouTube_Channel Cisco Connect
- 2. Cisco Confidential 2© 2016 Cisco and/or its affiliates. All rights reserved. Today’s Agenda • Finding The Needle • Cisco Stealthwatch Whiteboard • Encrypted Analytics • Flow Analysis
- 5. Data Hoarding Exfiltration SMB Probe C2C 0 Day PCI ALERT OT Alert Worm Propagation DDOS Attempt Recon HIPAA Alert Exfiltration Exfiltratio Malware C2C Bad GEO APT Worm P SMB Pro
- 7. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet
- 8. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet N S W E Netflow Physical, Virtual, Cloud sFlow, jFlow cFlow, qFlow IPFIX…… Network Security Compliance Top Hosts Top Apps Net Perf APT, Bots Malware DDoS Data EXF 0 Day PCI SCADA HIPAA Audit Etc… Action Router (Null Route) Firewall (SHUN) ISE Quarantine
- 9. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet N S W E Netflow Physical, Virtual, Cloud sFlow, jFlow cFlow, qFlow IPFIX…… Network Security Compliance Top Hosts Top Apps Net Perf APT, Bots Malware DDoS Data EXF 0 Day PCI SCADA HIPAA Audit Etc… Action Router (Null Route) Firewall (SHUN) ISE Quarantine FC SMC FS Older Switch – 2960 - Generates Netflow - Layer 7 Visibility - DPI (Applications) - RTT (Round Trip Time) - SRT (Server Response Time)
- 10. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet N S W E Netflow Physical, Virtual, Cloud sFlow, jFlow cFlow, qFlow IPFIX…… Network Security Compliance Top Hosts Top Apps Net Perf APT, Bots Malware DDoS Data EXF 0 Day PCI SCADA HIPAA Audit Etc… Action Router (Null Route) Firewall (SHUN) ISE Quarantine FC SMC FS Older Switch – 2960 - Generates Netflow - Layer 7 Visibility - DPI (Applications) - RTT (Round Trip Time) - SRT (Server Response Time) Packet Analyzer 42 TB Rolling Buffer
- 11. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet N S W E Netflow Physical, Virtual, Cloud sFlow, jFlow cFlow, qFlow IPFIX…… Network Security Compliance Top Hosts Top Apps Net Perf APT, Bots Malware DDoS Data EXF 0 Day PCI SCADA HIPAA Audit Etc… Action Router (Null Route) Firewall (SHUN) ISE Quarantine FC SMC FS Older Switch – 2960 - Generates Netflow - Layer 7 Visibility - DPI (Applications) - RTT (Round Trip Time) - SRT (Server Response Time) Packet Analyzer 42 TB Rolling Buffer Anyconnect - NVM (IPFix) - User - Device - Application - Location - Destination Endpoint Concentrator
- 12. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet N S W E Netflow Physical, Virtual, Cloud sFlow, jFlow cFlow, qFlow IPFIX…… Network Security Compliance Top Hosts Top Apps Net Perf APT, Bots Malware DDoS Data EXF 0 Day PCI SCADA HIPAA Audit Etc… Action Router (Null Route) Firewall (SHUN) ISE Quarantine FC SMC FS Older Switch – 2960 - Generates Netflow - Layer 7 Visibility - DPI (Applications) - RTT (Round Trip Time) - SRT (Server Response Time) Packet Analyzer 42 TB Rolling Buffer Anyconnect - NVM (IPFix) - User - Device - Application - Location - Destination PxGrid - ISE provides the following - User/Device/MAC – EX: 10.1.1.1 = Jason | iPhone | MAC - SMC Behavioral Change Endpoint Concentrator
- 13. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet N S W E Netflow Physical, Virtual, Cloud sFlow, jFlow cFlow, qFlow IPFIX…… Network Security Compliance Top Hosts Top Apps Net Perf APT, Bots Malware DDoS Data EXF 0 Day PCI SCADA HIPAA Audit Etc… Action Router (Null Route) Firewall (SHUN) ISE Quarantine FC SMC FS Older Switch – 2960 - Generates Netflow - Layer 7 Visibility - DPI (Applications) - RTT (Round Trip Time) - SRT (Server Response Time) Packet Analyzer 42 TB Rolling Buffer Anyconnect - NVM (IPFix) - User - Device - Application - Location - Destination PxGrid - ISE provides the following - User/Device/MAC – EX: 10.1.1.1 = Jason | iPhone | MAC - SMC Behavioral Change SIEM UDP Director - Flows sent centrally - Duplicate as required Endpoint Concentrator
- 14. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet N S W E Netflow Physical, Virtual, Cloud sFlow, jFlow cFlow, qFlow IPFIX…… Network Security Compliance Top Hosts Top Apps Net Perf APT, Bots Malware DDoS Data EXF 0 Day PCI SCADA HIPAA Audit Etc… Action Router (Null Route) Firewall (SHUN) ISE Quarantine FC SMC FS Older Switch – 2960 - Generates Netflow - Layer 7 Visibility - DPI (Applications) - RTT (Round Trip Time) - SRT (Server Response Time) Packet Analyzer 42 TB Rolling Buffer Anyconnect - NVM (IPFix) - User - Device - Application - Location - Destination PxGrid - ISE provides the following - User/Device/MAC – EX: 10.1.1.1 = Jason | iPhone | MAC - SMC Behavioral Change SIEM UDP Director - Flows sent centrally - Duplicate as required Cloud Host1 Host2 - Stealthwatch Cloud (Public/Private) - Agentless, - EX: AWS - VPC Flow Logs - Other feed sources Endpoint Concentrator
- 15. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet N S W E Netflow Physical, Virtual, Cloud sFlow, jFlow cFlow, qFlow IPFIX…… Network Security Compliance Top Hosts Top Apps Net Perf APT, Bots Malware DDoS Data EXF 0 Day PCI SCADA HIPAA Audit Etc… Action Router (Null Route) Firewall (SHUN) ISE Quarantine FC SMC FS Older Switch – 2960 - Generates Netflow - Layer 7 Visibility - DPI (Applications) - RTT (Round Trip Time) - SRT (Server Response Time) Packet Analyzer 42 TB Rolling Buffer Anyconnect - NVM (IPFix) - User - Device - Application - Location - Destination PxGrid - ISE provides the following - User/Device/MAC – EX: 10.1.1.1 = Jason | iPhone | MAC - SMC Behavioral Change SIEM UDP Director - Flows sent centrally - Duplicate as required Cloud Host1 Host2 - Stealthwatch Cloud (Public/Private) - Agentless, - EX: AWS - VPC Flow Logs - Other feed sources Web Proxy Proxy Logs - Provides URL Insight Endpoint Concentrator
- 16. Overview Stealthwatch Visibility Detection Incident Response Router Firewall Core / Distribution Switch Access Access Access PC PC Internet N S W E Netflow Physical, Virtual, Cloud sFlow, jFlow cFlow, qFlow IPFIX…… Network Security Compliance Top Hosts Top Apps Net Perf APT, Bots Malware DDoS Data EXF 0 Day PCI SCADA HIPAA Audit Etc… Action Router (Null Route) Firewall (SHUN) ISE Quarantine FC SMC FS Older Switch – 2960 - Generates Netflow - Layer 7 Visibility - DPI (Applications) - RTT (Round Trip Time) - SRT (Server Response Time) Packet Analyzer 42 TB Rolling Buffer Anyconnect - NVM (IPFix) - User - Device - Application - Location - Destination PxGrid - ISE provides the following - User/Device/MAC – EX: 10.1.1.1 = Jason | iPhone | MAC - SMC Behavioral Change SIEM UDP Director - Flows sent centrally - Duplicate as required Cloud Host1 Host2 - Stealthwatch Cloud (Public/Private) - Agentless, - EX: AWS - VPC Flow Logs - Other feed sources Web Proxy Netflow and Proxy = Telemetry Extended Visibility & Behavioral Analytics Advanced Threat Detection Encrypted Traffic Analysis Endpoint ConcentratorProxy Logs - Provides URL Insight
- 18. Overview of ETA (Encrypted Traffic Analysis) Gartner predicts that by 2019, 80 percent of web traffic will be encrypted. 100
- 19. Overview of ETA (Encrypted Traffic Analysis)
- 20. Overview of ETA (Encrypted Traffic Analysis)
- 21. Overview of ETA (Enhanced Netflow) Encrypted Traffic Analytics focuses on identifying malware communications in encrypted traffic through passive monitoring, the extraction of relevant data elements and supervised machine learning with cloud based global visibility. Sequence of Packet Lengths and Times (SPLT): SPLT conveys the length (number of bytes) of each packet’s application payload for the first several packets of a flow, along with the inter arrival times of those packets. SPLT can be represented as an array of packet sizes (in bytes) along with an array of times (in ms) representing the time since the previous packet was observed. Byte distribution: The byte distribution represents the probability that a specific byte value appears in the payload of a packet within a flow. The byte distribution of a flow can be calculated using an array of counters. The major data types associated with byte distribution are full byte distribution, byte entropy and the mean/standard deviation of the bytes. For example, using one counter per byte value, an HTTP GET request, “HTTP/1.1.”, can be calculated by incrementing the corresponding counter once for the “H,” then incrementing another counter twice for the two consecutive “T” s and so on. Although the byte distribution is maintained as an array of counters, it can easily be turned into a proper distribution by normalizing by the total number of bytes. Initial Data Packet (IDP): IDP is used to obtain packet data from the first packet of a flow. It allows extraction of interesting data such as an HTTP URL, DNS hostname/address and other data elements. The TLS handshake is composed of several messages that contain interesting, unencrypted metadata used to extract data elements such as cipher suites, TLS versions and the client’s public key length. Enhanced Netflow
- 22. Overview of ETA (Example of good vs. bad) Client to Server Server to Client
- 23. Overview of ETA (Example of good vs. bad)
- 24. Overview of ETA (Example of good vs. bad)
- 25. Overview of ETA (Cognitive – Machine Learning and Statistical Analysis)
- 26. Overview of ETA (Stealthwatch Insight Dashboard with Cognitive) The Security Insight dashboard on the Stealthwatch Management Console (SMC) provides a view of affected users identified by Cognitive Analytics by risk type. An expanded Cognitive Analytics dashboard provides detailed information regarding the top risk escalations and relative threat exposure
- 27. Overview of ETA (Malicious Encrypted Traffic) Upon discovery, a malicious encrypted flow can be blocked or quarantined by Stealthwatch. Policy-driven remediation actions via pxGrid using Cisco Identity Services Engine (ISE) with Cisco TrustSec® and Software-Defined Access (SD Access) simplify and accelerate network security operations
- 28. Overview of ETA (Cryptographic Compliance) Encrypted Traffic Analytics also identifies encryption quality instantly from every network conversation providing the visibility to ensure enterprise compliance with cryptographic protocols. It delivers the knowledge of what is being encrypted and what is not being encrypted on your network so you can confidently claim that your digital business is protected. This cryptographic assessment is displayed in Stealthwatch and can be exported via APIs to third-party tools for monitoring and auditing of encryption compliance
- 29. Flow Analysis
- 30. Stealthwatch Analyzing Flows Flow Analysis Process • Flow Analysis Scenarios (Malware)
- 31. Flow Analysis Scenarios Malware – Malware running on the network – Help!!! We see the following • Suspicious Internal Hosts for today • Worm Propagation for the last 14 days • Worm Propagation for today. Lets drill into this some more
- 32. Flow Analysis Scenarios Malware – Malware running on the network – Help!!! Zooming in here we can see the IP address of the hosts. • Purple – hosts are a source of infections • Green – hosts are exhibited the same behavior of the purple hosts • Blue – hosts that are being scanned We can double click the host to view the “Host Snapshot”. We can then perform the same analysis as we did in previous examples. Nowhere to hide!
- 33. Flow Analysis Scenarios Malware – Malware running on the network – Help!!! We get the identity – Start Active Time, End Active Time, Username, MAC Address, Device Type, Domain Name, Switch Port the host is connected. If you have ISE you could also quarantine the host with a single click. We can see that the host is scanning ports on 5900 (VNC Port).
- 34. Flow Analysis Scenarios Malware – Malware running on the network – Help!!! Moving to the “Alarms”. Here we can acknowledge the alarm after we have determined that the issue has been resolved. EX: Helpdesk took the previous information and scanned the machine and cleaned the infections. Right click the host go to “Workflow” and click “Acknowledge Selection” Provide some detail and hit “Ok”
- 35. Stealthwatch Analyzing Flows Flow Analysis Process • Flow Analysis Scenarios (Botnet)
- 36. Flow Analysis Scenarios Botnet – Botnets running on the network – Help!!! • C&C Server Traffic – Today • Trend of Infected Hosts – Last 30 Days • Top Infected Host Today • Top C&C Servers Today
- 37. Flow Analysis Scenarios Botnet – Botnets running on the network – Help!!! Lets drill into “Top Infected Hosts” and click the “Host Snapshot” to learn more about what took place and the finer details. We get the identity – Start Active Time, End Active Time, Username, MAC Address, Device Type, Domain Name, Switch Port the host is connected. If you have ISE you could also quarantine the host with a single click.
- 38. Flow Analysis Scenarios Botnet – Botnets running on the network – Help!!! This gives us insight into the active flows and we can drill into the specifics as needed. We can see a lot of different “Security Events” that have taken place. Some of which may automatically qualify for next steps in the investigation . We could export the details into a csv file and share it with other teams. Lets drill into the infected host “Security Event”
- 39. Flow Analysis Scenarios Botnet – Botnets running on the network – Help!!! Select the row of interest and click “Quick View this Row” We now get more details perhaps the IP address of the target is something we want to blacklist – we can use other tools to action this mitigation technique. Cisco NGFW, Cisco Endpoint AMP, etc.
- 40. Flow Analysis Scenarios Botnet – Botnets running on the network – Help!!! We have completed our investigation it is now time to acknowledge the alarm and move onto the next threat that may take place. Give it a description and select ok.
- 41. Stealthwatch Analyzing Flows Flow Analysis Process • Flow Analysis Scenarios (Copyright Infringement)
- 42. Flow Analysis Scenarios Copyright Infringement– You get an email from a copyright infringement authority telling you to stop this behavior or legal action will be taken. All you have is a timeline, file name, and external IP Address. We will use the web GUI for this exercise.
- 43. Flow Analysis Scenarios Copyright Infringement– You get an email from a copyright infringement authority telling you to stop this behavior or legal action will be taken. All you have is a timeline, file name, and external IP Address. We will use the web GUI for this exercise. Here we populate the information we got from the copyright authority and begin our search.
- 44. Flow Analysis Scenarios Copyright Infringement– You get an email from a copyright infringement authority telling you to stop this behavior or legal action will be taken. All you have is a timeline, file name, and external IP Address. We will use the web GUI for this exercise. “Select” the flow of interest. I can see the following details – Search Subject, Subject Port, Date and Time, Inside Host, Inside Port , Outside Host, Outside Port, Application, Total Bytes. Lets pivot into the “Inside Host”
- 45. Flow Analysis Scenarios Copyright Infringement– You get an email from a copyright infringement authority telling you to stop this behavior or legal action will be taken. All you have is a timeline, file name, and external IP Address. We will use the web GUI for this exercise. I can see everything about the host – I know the internal IP, natted IP (got that insight in the previous flow search), host details, Peers, Alarms, Users and Sessions, Application Traffic both Inbound and Outbound. If integrated with ISE I can “Quarantine and unquarantine instantly from Stealthwatch.