Assume They're In Your Network Already

1       Background

Traditional network border defense strategies have focused on a) keeping intruders out of a network b) protecting internal devices from compromise. Historically, sites have implemented their security strategy from the border inward rather than from the endpoint outward.

895,871,345 records have been breached as of 2/21/2016 according to www.privacyrights.org. Data from this and similar sites suggests the traditional border network defense model has failed as a data protection strategy.

Border firewalls are not effective "protection" devices. They are, however, excellent "detection" devices. Why? Firewalls always have to let data pass through them. Wireless networks negate the effectiveness of a "border" firewall  by forcing the network border to be at the endpoint. Whitelisting outbound traffic is a challenge because most sites are now hosted by companies like Akemai which host thousands of sites. However, firewalls log packet traffic and this information is valuable in network forensics.

Continuous monitoring (CM) is an effective strategy to detect and interrupt data exfiltration.  Seth Misenar and Eric Conrad [1] list 4 points that show why Continuous Monitoring (CM) is a better strategy for detecting, preventing and/or interrupting data exfiltration. The 4 points are:

1.     Highly portable devices don’t benefit from the traditional border network defense model.

2.     Client-side exploitation significantly decreases the effectiveness of traditional network defense architectures.

3.     Lateral movement inside your network after a compromise increases the likelihood of endpoint exploitation.

4.     Endpoints must be able to defend themselves and aid in detection.

Monitoring outbound traffic allows a site to use CM techniques to determine if a data breach has happened. Unauthorized data transfers are rarely detected by traditional IDS, IPS or firewalls because intellectual property isn’t just the standard social security, credit card, driver license, bank/debit account numbers.  Intellectual property is harder to classify because the “sensitive” data elements are not the traditional items that DLP solutions can find. Netflow monitoring techniques can be used to detect anomalous traffic patterns.

2       Hacker Attack Strategy

When hackers attack a site, they have 3 primary goals:

• ·        Compromise the endpoint and search for data that can be stolen. 

• ·        Maintain control of the endpoint so it can be used to attack internal and external systems.

• ·        Be able to destroy the system to eliminate evidence of a compromise if discovered.

Hackers have adapted to inbound blocks by tricking internal users into initiating an outbound connection to the malware site. For example, the infostealer malware class searches the target system for sensitive data such as SSN, CCN, bank or debit account information, builds a list of files containing these data, phones “home” to let the hacker know it has data ready for exfiltration.
A compromised machine has to communicate back to the hacker when an attack is successful. If defenders interrupt the communications/control channel established, a data exfiltration is prevented or interrupted. This also prevents the hackers from issuing a “self destruct” command to cover their tracks.

3       Continuous Monitoring Defense

Prevention eventually fails but detection and containment are forever. CM assumes the attackers are inside your network and provides the data to find them. The defenders' best chance for containing the attack lies in interrupting hacker goal #2. Here’s how CM can help determine if a data breach of personally identifiable information (PII) has occurred.

1. The general security strategy should be "protect (encrypt) sensitive data regardless of location." Protecting devices is obviously important, however, if the sensitive data is protected then the probability of a data breach is reduced.

2. Monitoring outbound traffic can detect anomalous outbound transmissions. If a system is compromised, we ask if there was any sensitive data on the device.

a. No. Use logs (syslog, eventlog, net flow, sensor, firewall, IDS, DLP) to isolate the compromised host and if any external communication has happened. Reinstall/reimage compromised host. Go to step 1.

b. Yes. Run PII search tools like IdentityFinder, Find_SSN to find out how many records were potentially exposed. If the data files were encrypted, the chances of a data breach are minimal, go to step 2a. If PII was in the clear, determine how many unique records were in the file. Go to step 3. 

3. Determine if sensitive data file(s) were exfiltrated from the net. Use network forensics to determine:

a) when was the earliest communication between the attacker and the compromised endpoint. This helps us define the window of exposure.

b) if other internal hosts were accessed from this compromised host. This helps us define the extent of the attack.

c) the probability of sensitive data breach occurring by examining netflow data to and from the compromised host.

Historical network data is used to answer the above questions. That data comes from various sensors each fulfilling a role in CM. The biggest advantage defenders have is the ability to monitor their network traffic. A system whose logs have been wiped can still be monitored by examining network traffic.

4       A Continuous Monitoring Example

How do we detect a suspicious exfiltration? First, you have to establish a “traffic” baseline to see what is considered “normal” traffic.  Baselining provides you with the answer to “where do my organization’s packets go? For example, the chart shown in Figure 1 shows the countries that send and receive packets from a network in a month. The blue bar shows packets that enter the network from a country and the red bar shows packets that leave the network for a particular country.  Once you profile the inbound/outbound traffic, you can do a detailed analysis of the traffic.
Packet traffic within the United States is shown at the bottom of the figure. A possible explanation is the majority of this traffic goes to external search engines. For example, a search engine query for “Randy Marchany” sends a relatively short packet stream to a search engine. The results of the search are usually much greater in size than the original query. Obviously, not all traffic is web based but having this data allows you to do a detailed analysis of your network traffic.



Figure 1. Inbound/outbound network traffic by country

Figure 2 shows a different pattern. It shows a traffic pattern of a large amount of data packets leaving the network for China, Great Britain and Brazil. This pattern doesn’t confirm an exfiltration is happening but we certainly have reason to investigate this traffic further. The analysis confirmed an exfiltration was happening. The incident response team was able to take steps to contain and interrupt the data transfer.



Figure 2. Inbound/outbound traffic by country with anomaly

5       Summary

The traditional network border defense strategy has failed to prevent data breaches. It's time to change our defensive posture from inbound-centric to outbound-centric. Continuous Monitoring allows us to determine if a data exfiltration has happened. CM and network forensics are the difference between a small, internal breach and a major disaster.

 Some good reference books on this topic are "Extrusion Detection: Security Monitoring for Internal Intrusions" by Richard Bejtlich, "Network Forensics"  by Sherri Davidoff and Jonathan Ham, "Applied Network Security Monitoring" by Chris Sanders and Jason Smith.

EDU Are Small Cities

In a general sense, universities are small cities with the services that are provided by such localities. For example, Virginia Tech provides similar services to its community that the town of Blacksburg provides to its citizens. A cybersecurity architecture has to encompass all of these service areas. 

Some of these services include:

• Power generation – VT has its own power generation plant that provides electrical power, A/C and heating to facilities on campus. The power generation plant also provide power to some segments of the town itself.

•  Law enforcement – As many EDUs do, VT has its own campus police department with full LE authority and powers as any other state law enforcement officers (LEO).

• Dining Services – what used to be the traditional dining hall facilities has evolved to a wide variety of food choices.

• A Cultural scene – VT provides a wide variety of music, theatre, lecture, film events that open to the community as well as the general public

•  Library – this seems odd but since VT is a public institution, its library is open to anyone regardless of their affiliation with the University.

• ·Medical services – student health services, counseling services, wellness services, adult day care services are some of the traditional medical services provided

•  Athletic – from intramural, extramural sports to NCAA sanctioned sports, VT offers a wide variety of athletic events that are open to the public.

• Educational – VT is its own “school system”.

Urban universities offer the same services listed above with the exception of the power plant but they do have a facilities management program. 

 Corporations that offer a wide variety of services to their employees face the same security issues.  As you can imagine, it's a challenge to balance the security requirements of each of these service areas.