Darin Fisher [InfluxData] | Security Monitoring in the Time Series Domain | InfluxDays Virtual Experience NA 2020

Security Monitoring in
the Time Series
Domain
Darin Fisher
Security Tools Manager, InfluxData

© 2020 InfluxData. All rights reserved. 3
Security Tools Manager
Tech Support
Sys Admin
Network Engineer
Security Director
Developer
ISPs
Banks
Telcos
Pharma
OPERATIONS
DEVELOPMENT
MANAGEMENT
Software

Why another security solution?

“The first step in finding anomalies in network and
device behavior is collecting the data and organizing
it into a collection of time series.”
-- Nate Fick Endgame

The strength of time series modeling is generally not used in almost all current
intrusion detection and prevention systems.
Intrusion Detection Forecasting Using Time Series for Improving Cyber
Defence
Azween Abdullah
Thulasyammal Ramiah Pillai
Long Zheng Cai
● Most are noisy and ineffectual
● SaaS access monitoring is generally not available
● Cross SaaS correlation is generally not available

Building Security Tools with InfluxDB

“That's another reason I was interested in coming to work at
InfluxData, where we can build our own security tools on top of
our own platform.” -- Peter Albert, CISO, InfluxData

“Everything should be made as simple as possible, but no
simpler.” -- Albert Einstein
● Build the tools we need to help keep our services safe
● Share these tools
○ InfluxDB Templates
● Collaborate with the community for more solutions
○ What would help you?

Security monitoring is noisy,
focus!

● SaaS first company
● 100 separate providers
● SaaS provider
● Continually changing attack surface
● Anomaly Detection
It can be difficult to determine what to watch with a large
number of providers and an ever changing infrastructure.

● SaaS Access Activity
○ Compromised accounts are the #1 cause of security
breaches
○ Increased failure rate
○ Source address and account ID cardinality
● Cloud Access Activity
○ Increased resource utilization
○ Access changes
○ Network changes
○ Increase in costs
Do we see activity anomalies …?

● Network Attack Surface
○ Public address changes
○ Public port changes
● Account Audits
○ Is the terminated account removed from all SaaS
providers?
● State of Security Controls
○ Is authentication active and functional?
○ Is there activity from a disabled account?
Continuous Auditing

What are we looking at?
● Authentication activity
● Authentication functionality
● Account and source location cardinality changes
● Multi SaaS correlation
● Changes to the attack surface
● State changes
● Service cost increase
● SSL Certificate validation

Data Collection ...
● Telegraf
● InfluxDB with Flux
● FaaS using your favorite programming language
● Provider API
● Raw log files
InfluxDB Cloud for storage and analysis

Endpoint Monitoring InfluxDB Template
● General Availability
● Authentication Availability
● Authentication Functionality
● Certificate Status

● Google Workspace (G Suite)
● Authentication Failure Spikes
● Source Address Cardinality
SaaS Authentication Anomaly Monitoring

Next Up … ?
● Multi-SaaS correlation
● Network availability changes
● Multi-SaaS account auditing
● Ingress activity tracking
● Geographic usage observability

● Access to event information from the SaaS providers
● Normalizing fields
● Visibility
○ What are good triggers?
○ Other indicators, i.e. provider billing services
● Data collection methods
● Deriving state for faster ongoing reference - "rollup"
Ongoing efforts require overcoming a few hurdles

Cloud based software services must provide better access to
authentication and activity data.
● SaaS and Cloud providers activity log access via API
● API access should be standard for all subscriptions levels
● Ability to create “service accounts” or read-only roles for
automated API access

Time series data is very well suited for security
analysis, providing anomaly detection, real-
time audit capabilities, and much more.
SaaS account activity and simple endpoint
observations is a good start.
Better access to SaaS audit data is necessary
for better security tools

Thank you!
Slack: @darin - InfluxDB Community

Darin Fisher [InfluxData] | Security Monitoring in the Time Series Domain | InfluxDays Virtual Experience NA 2020

Darin Fisher [InfluxData] | Security Monitoring in the Time Series Domain | InfluxDays Virtual Experience NA 2020

Recommended

More Related Content

What's hot

What's hot(20)

Similar to Darin Fisher [InfluxData] | Security Monitoring in the Time Series Domain | InfluxDays Virtual Experience NA 2020

Similar to Darin Fisher [InfluxData] | Security Monitoring in the Time Series Domain | InfluxDays Virtual Experience NA 2020(20)

More from InfluxData

More from InfluxData(20)

Recently uploaded

Recently uploaded(20)

Darin Fisher [InfluxData] | Security Monitoring in the Time Series Domain | InfluxDays Virtual Experience NA 2020