Plugging Network Security Holes Using NetFlow

747 views

Published on

Published in: Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
747
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
34
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Plugging Network Security Holes Using NetFlow

  1. 1. Plugging Network Security Holes using NetFlowLoopholes in todays network security solutions and how NetFlow can help
  2. 2. About ManageEngine Servers & Windows Event Log & Network Desktop ServiceDesk Security Applications Infrastructure Compliance Network Server Desktop Active Windows Vulnerability Helpdesk Monitoring Monitoring Management Directory Event Logs Analysis Application NetFlow Asset ITIL Service Syslog Patch Perf SQL Server Analysis Management Desk Management Management Monitoring Software Network End User Remote Exchange Firewall Log Password License Config Mgmt Experience Control Server Analyzer Management Tracking ManageEngine is an IT management vendor focused on bringing a complete IT management portfolio to all types of enterprises
  3. 3. Network Security Concerns
  4. 4. Network Security Concerns Increasing Network Security Violations 2010 : Major DDoS attacks and arrival of STUXNET 2011 : HB Gary Federal & Sony PSN Hacked - Emails made public and user data stolen Since then : Sony Pictures, Nintendo, Fox Networks, Eve’s online, Lockheed Martin, PBS, Honda Canada, Booz Allen Hamilton, C.I.A…The list is growing
  5. 5. Network Security Concerns Malwares – More Numbers and More Sophisticated Malware 350 300 250 200 150 100 50 0 The start 1971 1990 2011
  6. 6. Network Security Concerns Malwares – More Numbers and More Sophisticated More numbers and more sophisticated malwares Symantec’s 2011 Internet Security Threat Report states: “In 2010, Symantec encountered more than 286 million unique variants of malware.” Targeted, custom malwares appearing. STUXNET is just the beginning The era of the zero-day malware and attacks is here
  7. 7. Network Security Concerns Telecommuting & Erosion of Perimeter Percentage of US workers Telecommuting 35 30 25 20 15 ?? 10 17% 5 7.5% 0 1994 2004 2014
  8. 8. Network Security Concerns Telecommuting & Erosion of Perimeter More number of telecommuters per enterprise Increasing number of enterprise users have mobile devices like laptops & tablets Disappearing perimeter – Users connect over VPN, 3G, Public Wi-Fi, etc. from home or mobile devices Less secure transactions - Susceptible to malwares and Trojans
  9. 9. Network Security Concerns Telecommuting & Erosion of Perimeter More number of telecommutersTelecommuting Percentage of US workers per enterprise 35 30 Increasing number of enterprise users have mobile 25 devices like laptops & tablets 20 15 ?? Disappearing perimeter – Users connect over VPN, 3G, 10 Public Wi-Fi, etc. from home17% mobile devices or 5 7.5% 0 Less secure transactions - Susceptible to malwares and 1994 2004 2014 Trojans
  10. 10. Network Security Concerns Faster Networks – More Business Localization Increasing Network Bandwidth – The fastest Ethernet will soon move from 10 Gigabit to 100 Gigabit Ethernet Newer applications and services added everyday Business localization – Increased users and thus higher volume of network traffic More unknown applications are encountered
  11. 11. Network Security Concerns Faster Networks – More Business Localization Increasing Network Bandwidth – The fastest Ethernet will soon move from 10 Gigabit to 100 Gigabit Ethernet Newer applications and services added everyday Business localization – Increased users and thus higher volume of network traffic More unknown applications are encountered
  12. 12. Network Security Concerns Star Topology Complex Meshed Networks Networks are no longer based on the simple STAR topology Distributed networks in MESH topology Huge number of devices and nodes interconnected Traffic moves in multiple directions through different nodes
  13. 13. Network Security Concerns Complex Meshed Networks Networks are no longer based on the simple STAR topology Distributed networks in MESH topology Huge number of devices and nodes interconnected Traffic moves in multiple directions through different nodes
  14. 14. Network Security Concerns Meshed Networks Complex Meshed Networks Networks are no longer based on the simple STAR topology Distributed networks in MESH topology Huge number of devices and nodes interconnected Traffic moves in multiple directions through different nodes
  15. 15. Loopholes in current network security systems
  16. 16. The Loopholes Internet IDS Internal Network M A L W A R E Signature Anomaly Blocked R E A L W A M Non Signature Anomaly Undetected
  17. 17. The Loopholes More targeted, custom made, STUXNET like malwares IDS and IPS is based on “signatures”, a known characteristic of some particular attack Increasing number of zero day attacks whose signatures has not yet been documented Firewalls are ineffective against zero-day malwares as they block only traffic defined by the user
  18. 18. The Loopholes Telecommuters – Access the Internet from public Wi-Fi spots & unknown networks Personal computers are easier to attack and infect Users carry infected devices into the network or connect via VPN - Malware spreads across the LAN Packet inspection technologies are impractical for use in LAN due to the number of nodes to be monitored IDS not feasible for internal network monitoring
  19. 19. The Loopholes Telecommuters – Access the Internet from public Wi-Fi spots & unknown networks Personal computers are easier to attack and infect Users carry infected devices into the network or connect via VPN - Malware spreads across the LAN Packet inspection technologies are impractical for use in LAN due to the number of nodes to be monitored IDS not feasible for internal network monitoring
  20. 20. The Loopholes With malwares in your LAN, your network could be the one hosting an attack or sending spam STUXNET spread across 100,000 computers and never used Internet as the stream Each time STUXNET infected a system, it connected to 2 public domains to report about the infected machines Egress traffic accounting can help with early detection IDS and IPS does only ingress traffic accounting
  21. 21. The Loopholes 10 Gigabit network is now standard & 100 Gigabit network is around the corner Organizations now have more traffic and applications Packet Inspection is rendered ineffective due to the volume of traffic involved High performance and scalable packet inspection tools are highly expensive
  22. 22. The Loopholes 10 Gigabit network is now standard & 100 Gigabit network is around the corner Organizations now have more traffic and applications Packet Inspection is rendered ineffective due to the volume of traffic involved High performance and scalable packet inspection tools are highly expensive
  23. 23. The Loopholes Localization and branching of enterprises means more users and many services Firewall rules are used to block any undesired traffic but web service traffic (port 80) is allowed in most networks Sophisticated attacks use port 80 with the ACK bit set so that traffic appears to be legitimate web transactions Such traffic surpasses the firewalls and enters your network
  24. 24. The Loopholes Localization and branching of enterprises means more users and many services Firewall rules are used to block any undesired traffic but web service traffic (port 80) is allowed in most networks Sophisticated attacks use port 80 with the ACK bit set so that traffic appears to be legitimate web transactions Such traffic surpasses the firewalls and enters your network
  25. 25. The Loopholes Meshed networks include more nodes than the STAR topologies of the old times Traffic between sites choose the best path and do not always traverse through a center node Packet analysis / inspection technology not be feasible at all nodes Multiple locations and hence data collection for packet inspection at each point is difficult
  26. 26. The Loopholes Meshed networks include more nodes than the STAR topologies of the old times Traffic between sites choose the best path and do not always traverse through a center node Packet analysis / inspection technology not be feasible at all nodes Multiple locations and hence data collection for packet inspection at each point is difficult
  27. 27. The Solution
  28. 28. The Solution Enter NetFlow Technology developed by Cisco Systems - initially used as a switching path Primary network IP traffic accounting technology All major vendors now support flow export : NetFlow - Cisco, Adtran, 3COM sFlow - Alcatel, HP, Brocade, Enterasys, Dell IPFIX - Nortel / J-Flow - Juniper
  29. 29. The Solution About NetFlow Captures specific information from network IP Traffic and stores to the device’s NetFlow cache Traffic information exported as UDP packets to the configured destination 7 Key fields defines a flow as one unique conversation in NetFlow
  30. 30. The Solution About NetFlow Source Interface (ifindex) Protocol Source IP Address Destination IP Address Source Port Destination Port ToS
  31. 31. The Solution Core Network Edge Router NetFlow enabled interface UDP NetFlow NetFlow Collector
  32. 32. The Solution Core Network Edge Router NetFlow enabled interface UDP NetFlow NetFlow Collector
  33. 33. The Solution ManageEngine NetFlow Analyzer Without NetFlow AnalysisTraffic Traffic Traffic Traffic Traffic Traffic Traffic Traffic TrafficTraffic Traffic Traffic Traffic Traffic Traffic Traffic Traffic Traffic With NetFlow AnalysisTCP ESP Kazaa HTTP Src IP Cnvrstn IPv4 DSCP Octets 80UDP GRE Torrent Telnet Dst IP Host IPv6 ToS Time 23
  34. 34. The Solution ManageEngine NetFlow Analyzer Leverages on the flow data exported from your network devices Reports on traffic, applications, hosts, conversations, QoS, etc. Easy to use GUI and extensive graph options for quick understanding and fast problem drill down
  35. 35. The Solution Source Port Source IP Address Who ? Destination Port What ? Destination IP Address Protocol When ? Packet Count Usage ? Flow Start and End time Octet count ToS QoS ? TCP Flags QoS ? Protocol NextHop Input and Output Interface Path ? Source AS Information Route ? (ifindex) Destination AS Information
  36. 36. The Solution Advanced Security Analytics Module Flow based network behavior analysis tool Add-On to ManageEngine NetFlow Analyzer and leverages on its agentless data collection capabilities Uses the NetFlow or sFlow data received by NetFlow Analyzer for internal and external threat detection Continuous Stream Mining Engine TM detects network anomalies in real-time
  37. 37. The Solution Advanced Security Analytics Module Flow based network behavior analysis tool Add-On to ManageEngine NetFlow Analyzer and leverages on its agentless data collection capabilities Uses the NetFlow or sFlow data received by NetFlow Analyzer for internal and external threat detection Continuous Stream Mining Engine TM detects network anomalies in real-time
  38. 38. The Solution NetFlow Data Advanced Security Analytics Module NetFlow Analyzer Flow based network behavior analysis tool Add-On to ManageEngine NetFlow Analyzer and Continuous Stream Mining Engine leverages on its agentless data collection capabilities Advanced Security Analytics Uses the NetFlow or sFlow data received by NetFlow Analyzer for internal and external threat detection Events Continuous Stream Mining Engine TM detects network anomalies in real-time User
  39. 39. Plugging Loopholes
  40. 40. Detect Hacking Attempts Network Hacking Reconnaissance Methods Port Scans DNS Lookup Ping Sweeps Traceroute Except port scan, all the traffic is detectable as it is using NetFlow data ASAM analyzes NetFlow data and detect scans – TCP Scans like SYN scan, reverse scan, Xmas-Tree scan
  41. 41. Detect Hacking Attempts Network Hacking Reconnaissance Methods Port Scans DNS Lookup Ping Sweeps Traceroute Except port scan, all the traffic is detectable as it is using NetFlow data ASAM analyzes NetFlow data and detect scans – TCP Scans like SYN scan, reverse scan, Xmas-Tree scan
  42. 42. Stopping Zero-Day Malwares Identify the Top N and baseline your network behavior Change in traffic patterns can be identified using NetFlow data Sudden increase in traffic, spike in UDP traffic, etc. Get alerted when such changes occur
  43. 43. Stopping Zero-Day Malwares Identify the Top N and baseline your network behavior Change in traffic patterns can be identified using NetFlow data Sudden increase in traffic, spike in UDP traffic, etc. Get alerted when such changes occur
  44. 44. Stopping Zero-Day Malwares Session based identification helps track malware Abnormal traffic to many hosts from single host on a single port can be a worm Traffic from IANA reserved addresses or over reserved protocols is malicious traffic ASAM identifies such traffic and creates alerts
  45. 45. Stopping Zero-Day Malwares Session based identification helps track malware Identify the Top N and baseline your network behavior Abnormal traffic to many hosts from single host on a Change in traffic patterns can be identified using single port can be a worm NetFlow data Traffic from IANA reserved addresses or over Sudden increase in traffic, spike in UDP traffic, etc. reserved protocols is malicious traffic Get alerted when such changes occur ASAM identifies such traffic and creates alerts
  46. 46. Internal Network Threat Detection Telecommuting brings malwares into the network An IDS deployment for internal traffic is not feasible NetFlow is light on the bandwidth and device resources Most of your devices come with support for NetFlow or similar flow format Enable flow export and get visibility on both ingress and egress traffic flow
  47. 47. Internal Network Threat Detection Telecommuting brings malwares into the network An IDS deployment for internal traffic is not feasible NetFlow is light on the bandwidth and device resources Most of your devices come with support for NetFlow or similar flow format Enable flow export and get visibility on both ingress and egress traffic flow
  48. 48. Monitoring High Speed Networks Packet inspection software capable of handling 10G network traffic are few and expensive NetFlow data captures just the important information from actual traffic Do traffic analytics using NetFlow information Use packet capture only where absolutely necessary Brings down cost and helps in faster troubleshooting
  49. 49. Monitoring High Speed Networks Packet inspection software capable of handling 10G network traffic are few and expensive NetFlow data captures just the important information from actual traffic Do traffic analytics using NetFlow information Use packet capture only where absolutely necessary Brings down cost and helps in faster troubleshooting
  50. 50. Solution for Meshed Networks The star (hub and spoke) networks are a thing of past Meshed networks today allow traffic to pass through all nodes depending on best path An IDS or packet inspection at each node is not feasible Utilize the already available NetFlow from your network devices in locations like branches
  51. 51. Solution for Meshed Networks The star (hub and spoke) networks are a thing of past Meshed networks today allow traffic to pass through all nodes depending on best path An IDS or packet inspection at each node is not feasible Utilize the already available NetFlow from your network devices in locations like branches
  52. 52. ManageEngine NetFlow Analyzer
  53. 53. ManageEngine NetFlow Analyzer An all software solution for bandwidth monitoring, traffic analytics and anomaly detection Supports all flow formats as well as most of Cisco’s performance monitoring technologies Cisco NBAR, CBQoS, IPSLA and WAAS reports Additional features includes AS reporting, capacity planning, support for Cisco ASA NSEL, usage alerts, etc.
  54. 54. What else is NetFlow AnalyzerHighly granular traffic reports based on speed, volume,utilization and packets updated in real-timeConversations details for each minute thus helping with thequick troubleshooting of network incidents
  55. 55. What else is NetFlow AnalyzerHighly granular traffic reports based on speed, volume,Details on protocol distribution, in real-time usage & customutilization and packets updated applicationapplication monitoringConversations details for each minute thus helping with theFuture ready with IPv6of network incidentsquick troubleshooting conversation reports
  56. 56. What else is NetFlow AnalyzerHighly granular traffic reports based on speed, volume,Details on protocol distribution, in real-time usage & customutilization and packets updated applicationapplication monitoringConversations details for each minute thus helping with theFuture ready with IPv6of network incidentsquick troubleshooting conversation reports
  57. 57. What else is NetFlow AnalyzerHighly granular traffic reports based on speed, volume,Details on protocol distribution, in real-time usage & customutilization and packets updated applicationapplication monitoringConversations details for each minute thus helping with theFuture ready with IPv6of network incidentsquick troubleshooting conversation reports
  58. 58. What else is NetFlow AnalyzerHighly granular traffic reports based on speed, volume,Details on protocol distribution, in real-time usage & customutilization and packets updated applicationapplication monitoringConversations details for each minute thus helping with theFuture ready with IPv6of network incidentsquick troubleshooting conversation reports
  59. 59. Advanced Security Analytics Module
  60. 60. ASAM – An Overview Security Posture page to list all detected anomalies grouped under problem classes Drill down on each problem for problem analysis or resource analysis In-depth details on each event, source, destination and route Helps you take quick decisions to block IP’s or take action on the device level
  61. 61. ASAM – An Overview Security Posture page to list all detected anomalies grouped under problem classes Drill down on each problem for problem analysis or resource analysis In-depth details on each event, source, destination and route Helps you take quick decisions to block IP’s or take action on the device level
  62. 62. ASAM – An Overview
  63. 63. Conclusion An IDS and firewall only system is a thing of the past New age networks face more sophisticated problems A combination of well set firewall rules, an effective IDS/IPS system and NetFlow analysis is the answer
  64. 64. Conclusion
  65. 65. Questions?ManageEngine NetFlow Analyzer is used by over 4000customers worldwide. Visit our website for details: www.manageengine.com www.netflowanalyzer.com sales@manageengine.com nfs@manageengine.com

×