Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

"You Got That SIEM. Now What Do You Do?"  by Dr. Anton Chuvakin

5,455 views

Published on

"You Got That SIEM. Now What Do You Do?"  by Dr. Anton Chuvakin

Many who acquired SIEM tools have realized that they are not ready to use many of the advanced correlation features, despite promises that "they are easy to use." So, what should you do to achieve success with SIEM? What logs should you collect? Correlate? Review? How do you use log management as a step before SIEM? What process absolutely must be built before SIEM purchase becomes successful.Here you can learn from the experience of those who did not have the benefit of learning from other's mistakes. Also, learn a few tips on how to "operationalize" that SIEM purchase you've made. And laugh at some hilarious stories of "SIEM FAIL" of course!

Published in: Technology
  • Be the first to comment

"You Got That SIEM. Now What Do You Do?"  by Dr. Anton Chuvakin

  1. 1. You Got That SIEM. Now What Do You Do?<br />Dr. Anton Chuvakin<br />Security Warrior Consulting<br />www.securitywarriorconsulting.com<br />BayThreat 2010<br />
  2. 2. DIRE WARNING:<br />This presentation does NOT mention PCI DSS…<br />…oh wait <br />www.pcicompliancebook.info<br />
  3. 3. DIRE DISCLAIMER:<br />This presentation does NOT contains jokes about Cisco MARS!<br />
  4. 4. Outline<br />Brief: What is SIEM/LM?<br />“You got it!”<br />SIEM Pitfalls and Challenges<br />Useful SIEM Practices<br />From Deployment Onwards<br />SIEM “Worst Practices”<br />Conclusions<br />
  5. 5. About Anton<br />Former employee of SIEM and log management vendors<br />Now consulting for SIEM vendors and SIEM users<br />SANS class author (SEC434 Log Management)<br />Author, speaker, blogger, podcaster (on logs, naturally )<br />
  6. 6. SIEM?<br />Security Information and Event Management!<br />(sometimes: SIM or SEM) <br />
  7. 7. Got SIEM?<br />Now what?<br />
  8. 8. SIEM and Log Management <br />LM:<br />Log Management<br />Focus on all uses for logs<br />SIEM: <br />Security Information <br />and Event Management<br />Focus on security useof logs and other data <br />
  9. 9. Why SO many people think that “SIEM sucks?”<br />
  10. 10. SIEM Evolution<br />1997-2002 IDS and Firewall<br />Worms, alert overflow, etc<br />Sold “SOC in the box”<br />2003 – 2007 Above + Server + Context <br />PCI DSS, SOX, users<br />Sold “SOC in the box”++<br />2008+ Above + Applications + …<br />Fraud, activities, cybercrime<br />Sold “SOC in the box”+++++<br />
  11. 11. What SIEM MUST Have?<br />Log and Context Data Collection<br />Normalization<br />Correlation (“SEM”)<br />Notification/alerting (“SEM”)<br />Prioritization (“SEM”)<br />Reporting and delivery (“SIM”)<br />Security role workflow (IR, SOC, etc)<br />
  12. 12. What SIEM Eats: Logs<br /><18> Dec 17 15:45:57 10.14.93.7 ns5xp: NetScreendevice_id=ns5xp system-warning-00515: Admin User anton has logged on via Telnet from 10.14.98.55:39073 (2002-12-17 15:50:53) <br /><57> Dec 25 00:04:32:%SEC_LOGIN-5-LOGIN_SUCCESS:LoginSuccess [user:anton] [Source:10.4.2.11] [localport:23] at 20:55:40 UTC Fri Feb 28 2006<br /><122> Mar 4 09:23:15 localhostsshd[27577]: Accepted password for anton from ::ffff:192.168.138.35 port 2895 ssh2<br /><13> Fri Mar 17 14:29:38 2006 680 Security SYSTEM User Failure Audit ENTERPRISE Account Logon Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0    Logon  account:  ANTON    Source Workstation: ENTERPRISE    Error Code: 0xC000006A     4574 <br />
  13. 13. BTW…<br />… yesterday I saw an RFC5424-compliant syslog message with structured data.<br />OMG! They really do exist!! Well, this one does – produced by rsyslog application itself….<br />
  14. 14. What SIEM Eats: Context<br />http://chuvakin.blogspot.com/2010/01/on-log-context.html<br />
  15. 15. Popular #SIEM_FAIL<br />… in partial answer to “why people think SIEM sucks?”<br />Misplaced expectations (“SOC-in-a-box”)<br />Missing requirements (“SIEM…huh?”)<br />Missed project sizing<br />Political challenges with integration<br />Lack of commitment<br />Vendor deception (*)<br />And only then: product not working <br />
  16. 16. SIEM Planning Areas<br />Goals and requirements<br />Functionality / features<br />Scoping of data collection<br />Sizing<br />Architecting<br />
  17. 17. What is a “Best Practice”?<br />A process or practice that<br />The leaders in the field are doing today<br />Generally leads to useful results with cost effectiveness<br />P.S. If you still hate it – say <br />“useful practices”<br />
  18. 18. BP1 LM before SIEM!<br />If you remember one thing from this, let it be:<br />Deploy Log Management BEFORE SIEM!<br />Q: Why do you think MOST 1990s SIEM deployments FAILED?<br />A: There was no log management!<br />
  19. 19. Graduating from LM to SIEM<br />Are you ready? Well, do you have…<br />Response capability<br />Prepared to response to alerts<br />Monitoring capability<br />Has an operational process to monitor<br />Tuning and customization ability<br />Can customize the tools and content<br />
  20. 20. SIEM/LM Maturity Curve<br />
  21. 21. BP2 Evolving to SIEM <br />Steps of a journey …<br />Establish response process<br />Deploy a SIEM<br />Think “use cases”<br />Start filtering logs from LM to SIEM<br />Phases!<br />Prepare for the initial increase in workload<br />
  22. 22. Example LM->SIEM Filtering<br />3D: Devices / Network topology / Events<br />Devices: NIDS/NIPS, WAF, servers<br />Network: DMZ, payment network (PCI scope), other “key domains”<br />Events: authentication, outbound firewall access<br />Later: proxies, more firewall data, web servers<br />
  23. 23. “Quick Wins” for Phased Approach<br />Phased <br />approach #2<br /><ul><li>Focus on 1 problem
  24. 24. Plan architecture
  25. 25. Start collecting
  26. 26. Start reviewing
  27. 27. Solve problem 1
  28. 28. Plan again</li></ul>Phased <br />approach #1<br />Collect problems<br />Plan architecture<br />Start collecting<br />Start reviewing<br />Solve problem 1<br />Solve problem n<br />
  29. 29. BP3 SIEM First Steps<br />First step = BABY steps!<br />Compliance monitoring<br />“Traditional” SIEM uses<br />Authentication tracking<br />IPS/IDS + firewall correlation<br />Web application hacking<br />Simple use cases <br />based on your risks<br />What problems do YOU want solved?<br />
  30. 30. Example SIEM Use Case<br />Cross-system authentication tracking<br />Scope: all systems with authentication <br />Purpose: detect unauthorized access to systems<br />Method: track login failures and successes<br />Rule details: multiple login failures followed by login success<br />Response plan: user account investigation, suspension, communication with suspect user<br />
  31. 31. 10 minutes or 10 months?<br />A typical large customer takes 10 months to deploy a log management architecture based on our technology<br />?<br />Our log management appliance can be racked, configured and collecting logs in 10 minutes<br />
  32. 32. Secret to SIEM Magic!<br />
  33. 33. What is a “Worst Practice”?<br />As opposed to the “best practice” it is …<br />What the losers in the field are doing today<br />A practice that generally leads to disastrous results, despite its popularity<br />
  34. 34. WP for SIEM Project scope<br />WP1: Postpone scope until after the purchase<br />“The vendor says ‘it scales’ so we will just feed ALL our logs”<br />Windows, Linux, i5/OS, OS/390, Cisco – send’em in!<br />WP2: Assume you will be the only user of the tool<br />“Steakholders”? What’s that? <br />Common consequence: two or more <br />simiilartools are bought<br />
  35. 35. Case Study: “We Use’em All”<br />At SANS Log Management Summit 200X…<br />Vendors X, Y and Z claim “Big Finance” as a customer<br />How can that be?<br />Well, different teams purchased different products …<br />About $2.3m wasted on tools<br />that do the same!<br />
  36. 36. WPs for Deployment<br />WP3: Expect The Vendor To Write Your Logging Policy OR Ignore Vendor Recommendations<br />“Tell us what we need – tell us what you have” forever…<br />WP4: Unpack the boxes and go!<br />“Coordinating with network and system folks is for cowards!”<br />Do you know why LM projects take months sometimes?<br />WP5: Don’t prepare the infrastructure <br />“Time synchronization? Pah, who needs it”<br />WP6: Deploy Everywhere At Once<br />“We need it everywhere!! Now!!”<br />
  37. 37. WPs for Expanding Deployment<br />WP7: Don’t Bother With A Product Owner<br />“We all use it – we all run it (=nobody does)”<br />WP8: Don’t Check For Changed Needs – Just Buy More of the Same<br />“We made the decision – why fuss over it?”<br />WP9: If it works for 10, it will be OK for 10,000<br />“1,10,100, …, 1 trillion –<br />they are just numbers”<br />
  38. 38. More Quick SIEM Tips<br />Cost countless sleepless night and boatloads of pain….<br />No SIEM before IR plans/procedures<br />No SIEM before basic log management <br />Think "quick wins", not "OMG ...that SIEM boondoggle"<br />Tech matters! But practices matter more<br />Things will get worse before better. Invest time before collecting value!<br />
  39. 39. Conclusions<br />SIEM will work and has value … but BOTH initial and ongoing time/focus commitment is required<br />FOCUS on what problems you are trying to solve with SIEM: requirements!<br />Phased approach WITH “quick wins” is the easiest way to go<br />Operationalize!!!<br />
  40. 40. And If You Only …<br />… learn one thing from this….<br />… then let it be….<br />
  41. 41. Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! <br />Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! Requirements! <br />Requirements<br />Requirements<br />Requirements<br />Requirements<br />Requirements<br />Requirvements<br />
  42. 42. Questions?<br />Dr. Anton Chuvakin <br />Email:anton@chuvakin.org<br />Site:http://www.chuvakin.org<br />Blog:http://www.securitywarrior.org<br />Twitter:@anton_chuvakin<br />Consulting:http://www.securitywarriorconsulting.com<br />
  43. 43. More Resources<br />Blog: www.securitywarrior.org<br />Podcast: look for “LogChat” on iTunes<br />Slides: http://www.slideshare.net/anton_chuvakin<br />Papers: www.info-secure.org and http://www.docstoc.com/profile/anton1chuvakin<br />Consulting: http://www.securitywarriorconsulting.com/<br />
  44. 44. More on Anton<br />Consultant: http://www.securitywarriorconsulting.com<br />Book author: “Security Warrior”, “PCI Compliance”, “Information Security Management Handbook”, “Know Your Enemy II”, “Hacker’s Challenge 3”, etc<br />Conference speaker: SANS, FIRST, GFIRST, ISSA, CSI, RSA, Interop, many, many others worldwide<br />Standard developer: CEE, CVSS, OVAL, etc<br />Community role: SANS, Honeynet Project, WASC, CSI, ISSA, OSSTMM, InfraGard, ISSA, others<br />Past roles: Researcher, Security Analyst, Strategist, Evangelist, Product Manager<br />
  45. 45. Security Warrior Consulting Services<br />Logging and log management strategy, procedures and practices<br />Develop logging policies and processes, log review procedures, workflows and periodic tasks as well as help architect those to solve organization problems <br />Plan and implement log management architecture to support your business cases; develop specific components such as log data collection, filtering, aggregation, retention, log source configuration as well as reporting, review and validation<br />Customize industry “best practices” related to logging and log review to fit your environment, help link these practices to business services and regulations<br />Help integrate logging tools and processes into IT and business operations<br />SIEM and log management content development<br />Develop correlation rules, reports and other content to make your SIEM and log management product more useful to you and more applicable to your risk profile and compliance needs<br />Create and refine policies, procedures and operational practices for logging and log management to satisfy requirements of PCI DSS, HIPAA, NERC, FISMA and other regulations<br />More at www.SecurityWarriorConsulting.com<br />

×