building a campus dshield randy marchany it security lab va tech blacksburg, va 24060...
TRANSCRIPT
![Page 1: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/1.jpg)
Building a Campus Dshield
Randy MarchanyIT Security LabVA TechBlacksburg, VA [email protected]://security.vt.edu
![Page 2: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/2.jpg)
VT Defense-in-Depth Strategy
Layer 1: Blocking Attacks: Network Based Layer 2: Blocking Attacks: Host Based Layer 3: Eliminating Security
Vulnerabilities Layer 4: Supporting Authorized Users Layer 5: Tools to minimize business losses
![Page 3: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/3.jpg)
Putting the Pieces Together
RDWEB – locate any device in our network DSHIELD – Collect Firewall logs SNORT – Sensors monitoring for patterns SAFETYNET – “pull” vulnerability scanner CHECKNET – “push” vulnerability scanner REMEDY – Trouble Ticket system used by
Help Desk CENTRAL SYSLOG – collects syslogs
![Page 4: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/4.jpg)
IDS Infrastructure
Campus Systems
VT Dshield
DshieldMySQL DB
SNORT Base
MySQL DB
CheckNet Failure DB
CheckNetWWW
NessusScanners
SafetyNet
MySQL DB
Remedy TroubleTicket System
CIRT Help Desk
IPS
SNORTSensors
CentralSyslogServers
![Page 5: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/5.jpg)
VA Tech Defense in Depth
Layer 1: Blocking Attacks: Network Based
– Network Intrusion Prevention Systems– Discovery and mitigation– Firewalls– Secure Web Filtering– Secure Email, Anti-Spam
![Page 6: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/6.jpg)
VA Tech Defense in Depth
Layer 2: Blocking Attacks: Host Based– Personal firewalls– Spyware removal– Scan & Block/Quarantine Networks– Antivirus
![Page 7: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/7.jpg)
VA Tech Defense in Depth
Layer 3: Eliminating Security Vulnerabilities
– Vulnerability management & remediation– Patch management– Configuration management– Security configuration compliance– Application security testing
![Page 8: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/8.jpg)
Putting the Pieces Together
REN-ISAC weather reports Dshield.org IPS Netflows UCONN netreg VSC scanners
![Page 9: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/9.jpg)
You Already Belong to a “Dshield”
Default setting for Windows XP Personal Firewall sends copies of your firewall logs to http://hackerwatch.org
Why not belong to one that you know about?
![Page 10: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/10.jpg)
![Page 11: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/11.jpg)
Dshield – Internet Storm Center
Internet Storm Center concept was developed after analysts noted that time zones provided an early warning system for some attacks
Attacks originating in Asia occurred 12+ hours before hitting North America– People coming to work and logging in their
computers
![Page 12: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/12.jpg)
![Page 13: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/13.jpg)
Dshield
Similar to weather reporting infrastructure Mapping probes similar to mapping weather
fronts Admins could look at the data real-time and
use this info to prepare for an attack Similar to looking at a weather map to
prepare for tomorrow’s weather
![Page 14: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/14.jpg)
Weather Report vs. Internet Storm Ctr
Small sensors in as many places as possible recording basic weather info
Regional weather stations providing tech support, summarize and display it for local meteorologists
National weather centers summarize and map regional data to provide overall weather picture
Small IDS tools send logs to regional/campus site
Regional site provides automated support and reporting tools
Global Analysis & Coordination Centers provide early warning to network community of impending/ongoing attacks
![Page 15: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/15.jpg)
DShield Configuration
Hardware– DEC 2650, 2GB RAM, 785GB disk
Software– Red Hat Enterprise– Apache WWW server– PHP– MySQL– Dshield base system from Internet Storm Center
![Page 16: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/16.jpg)
The Good News, The Bad News
Good News Dshield code is already set
to do the functions shown later
You do some local mods and you’re ready to go
Software can handle the load
Fairly universal feeds Good reporting tool
Bad News Code is hard to get Basic documentation Convincing your
environment to feed your dshield
Need to tailor firewall configurations
Needs an analyst to interpret the results
![Page 17: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/17.jpg)
![Page 18: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/18.jpg)
![Page 19: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/19.jpg)
![Page 20: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/20.jpg)
![Page 21: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/21.jpg)
![Page 22: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/22.jpg)
![Page 23: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/23.jpg)
![Page 24: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/24.jpg)
![Page 25: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/25.jpg)
![Page 26: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/26.jpg)
![Page 27: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/27.jpg)
![Page 28: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/28.jpg)
![Page 29: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/29.jpg)
![Page 30: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/30.jpg)
![Page 31: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/31.jpg)
![Page 32: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/32.jpg)
![Page 33: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/33.jpg)
![Page 34: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/34.jpg)
![Page 35: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/35.jpg)
![Page 36: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/36.jpg)
![Page 37: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/37.jpg)
![Page 38: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/38.jpg)
References
http://isc.sans.org http://dshield.org http://dshield.cirt.vt.edu Randy Marchany
– VA Tech IT Security Lab– 1300 Torgersen Hall, VA Tech– Blacksburg, VA 24060– 540-231-9523, [email protected]
![Page 39: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/39.jpg)
![Page 40: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/40.jpg)
IDS/IPS States
BLOCK NO BLOCK
ALERT GOOD GOOD
NO ALERT
BAD GOOD if Failover
BAD if not
![Page 41: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/41.jpg)
VA Tech Defense in Depth
Layer 4: Supporting Authorized Users – ID and access management– File Encryption– Secure communications– PKI– VPN– IPSEC based VPN– SSL VPN– Secure remote access
![Page 42: Building a Campus Dshield Randy Marchany IT Security Lab VA Tech Blacksburg, VA 24060 marchany@vt.edu](https://reader036.vdocuments.us/reader036/viewer/2022081513/56649d9f5503460f94a8a087/html5/thumbnails/42.jpg)
VA Tech Defense in Depth
Layer 5: Tools to minimize business losses
– Security information management– Business transaction integrity monitoring– Security skills development (training)– Forensic tools– Regulatory compliance tools– Business recovery– Backup