Using Logs for Breach Investigations and Incident Response by Dr Anton Chuvakin

Using Logs for Breach Investigations and Incident Response,[object Object],Dr. Anton Chuvakin,[object Object],@anton_chuvakin,[object Object],SecurityWarrior LLC,[object Object],www.securitywarriorconsulting.com,[object Object],BrightTalk Forensics Summit 2011,[object Object]

Logs for Breach Investigations,[object Object],A few thoughts to start us off …,[object Object], All attackers leave traces. Period! ,[object Object], It is just that you don’t always knowwhat and where,[object Object], And almost never knowwhy…,[object Object], Logs are the place to look, first,[object Object]

Outline,[object Object],Log and logging overview,[object Object],A brief on Incident response and forensics,[object Object],Logs in incident investigations,[object Object],Just what is log forensics?,[object Object],Conclusions and call to action!,[object Object]

Log Data Overview,[object Object],From Where?,[object Object],What logs?,[object Object],[object Object]

Various alerts and other messages,[object Object]

Logs at Various Stage of Incident Response,[object Object],Preparation: verify controls, collect normal usage data, baseline, etc,[object Object],Identification: detect an incident, confirm incident, etc <- really?,[object Object],Containment: scope the damage, learn what else is “lost”, what else the attacker visited/tried, etc,[object Object],Eradication: preserving logs for the future, etc,[object Object],Recovery: confirming the restoration, etc,[object Object],Follow-Up: logs for “peaceful” purposes (training, etc) as well as preventing the recurrence,[object Object]

Various Logs for Incident Response,[object Object]

Firewall Logs in Incident Response,[object Object],Proof of Connectivity,[object Object],Proof of NO Connectivity ,[object Object],Scans,[object Object],Malware: Worms, Spyware,[object Object],Compromised Systems,[object Object],Misconfigured Systems,[object Object],Unauthorized Access and Access Attempts,[object Object]

Example: Firewall Logs in Place of Netflow,[object Object],Why Look at Firewall Logs During Incident Investigation?,[object Object],1990-2001 – to see what external threats got blocked (in, failure) ,[object Object],2002-2011+ – to see what internal system got connected (out, success),[object Object],Thus, firewall logs is “poor man’s” netflow…,[object Object]

Recommendations,[object Object],Log denied connections,[object Object],Log allowed connection,[object Object],If cannot log all allowed connections, then log outbound allowed connections,[object Object],Watch for firewall rule changes,[object Object]

NIDS Logs in Incident Response,[object Object],Attack, Intrusion and Compromise Detection,[object Object],Malware Detection: Worms, Viruses, Spyware, etc,[object Object],Network Abuses and Policy Violations,[object Object],Unauthorized Access and Access Attempts,[object Object],Recon Activity,[object Object]

Just A Thought…,[object Object],Q: How many serious incidents were discovered by an IDS/IPS?,[object Object],A: Answers I’ve heard..,[object Object],0, 0, 0, 0 with an average of 0 ,[object Object]

Server Logs in Incident Response,[object Object],Confirmed Access by an Intruder,[object Object],Service Crashes and Restarts,[object Object],Reboots,[object Object],Password, Trust and Other Account Changes,[object Object],System Configuration Changes,[object Object],A World of Other Things ,[object Object]

Example: “Irrelevant, You Say”,[object Object],Using disk failures for IDS ,[object Object],What is really there? ,[object Object],Is this OUR server? Well …,[object Object],“Detection by catastrophe”,[object Object],Is CNN you IDS?,[object Object]

Recommendations,[object Object],On a typical Unix system log:,[object Object],Syslog = usually defaults are sensible,[object Object],Select file access = via kernel logging,[object Object],Select process execution = via kernel logging,[object Object],On a typical Windows server:,[object Object],Authentication = failure/success,[object Object],Account changes = failure/success,[object Object],Privilege use = failure/success,[object Object],Others as needed (see MS Recommended Audit Policy),[object Object]

Database Logs in Incident Response,[object Object],Database and Schema Modifications,[object Object],Data and Object Modifications,[object Object],User and Privileged User Access,[object Object],Database Backups (!),[object Object],Failures, Crashes and Restarts,[object Object],LOOK AT LOGS! ,[object Object]

Proxy Logs in Incident Response,[object Object],Internet access patterns,[object Object],Policy violations,[object Object],Accidental/malicious information disclosure,[object Object],Malware: spyware, trojans, etc,[object Object],Outbound web-hacking,[object Object]

Example: Proxy Logs vs Uploads,[object Object],How?,[object Object],Search for POST requests AND specific document content-types (e.g. msword, powerpoint, etc.),[object Object],What?,[object Object],Look for a uploads to unusual sites (especially with unresolved IPs), web mail, or for sensitive document names,[object Object],Especially, look for uploads to unusual ports,[object Object]

Antivirus Logs in Incident Response,[object Object],Virus Detection and Clean-up (or lack thereof!),[object Object],Failed and Successful Antivirus Signature Updates,[object Object],Other Protection Failures and Issues,[object Object],Antivirus Software Crashes and Terminations,[object Object]

Using Logs for Breach Investigations and Incident Response by Dr Anton Chuvakin

Using Logs for Breach Investigations and Incident Response by Dr Anton Chuvakin

Recommended

More Related Content

What's hot

What's hot(20)

Viewers also liked

Viewers also liked(10)

Similar to Using Logs for Breach Investigations and Incident Response by Dr Anton Chuvakin

Similar to Using Logs for Breach Investigations and Incident Response by Dr Anton Chuvakin(20)

More from Anton Chuvakin

More from Anton Chuvakin(14)

Recently uploaded

Recently uploaded(20)

Using Logs for Breach Investigations and Incident Response by Dr Anton Chuvakin