The document discusses a proof of concept for network security monitoring (NSM) in the cloud. It outlines the challenges of cloud NSM due to lack of network visibility. The proposed solution is a server-side NSM client that would capture full packet data and transfer it to a Security Onion server for analysis. The core design principles are to integrate with Security Onion, maintain NSM principles, support multiple platforms, be open source, and ensure security and long-term sustainability. The document describes the basic architecture using WinTAP and OpenVPN to bridge traffic between cloud servers and the Security Onion sensor. It provides details on installation, performance metrics, validation testing, and real world usage scenarios to demonstrate cloud NSM.

1. The Cloud Client
Network Security Monitoring for the Cloud
Security Onion Conference - Fall 2014

2. Who am I?
Josh Brower
@DefensiveDepth, DefensiveDepth.com

3. Objectives
-Difficulties of Cloud NSM
-Showcase Cloud NSM PoC
-Architecture, Performance, Validation, Real World Use
-Jumpstart more R&D in Cloud NSM

4. Cloud Servers & NSM
-Rise of Cloud Servers (Amazon EC2, Rackspace)
-No network-level visibility

5. Proposed Proof of Concept
-Server-side NSM Client
-Target Audience
-SMB with a few Cloud servers

6. Core Design Principles
-Integration with Security Onion
-No compromise of NSM Principles
-Multi-Platform(netcraft)
-Windows & IIS = 38%
-Linux & Apache/Nginx = 49%

7. Core Design Principles cont.
-Open Source
-Security
-Long-Term Sustainability

8. Basic Architecture
Full packet capture on server,
transfer to SO for analysis
1) Batch copy & Replay
2) Batch copy & Import

9. Basic Architecture cont.
3) Remote PCAP Utilities
ie. WinPCAP RPCAP...
-No usable encryption
-No stable multi-platform integration
-Not maintained
-Not Open Source

10. Final Design

11. WinTAP

12. Basic Setup: Sensor
1) Install OpenVPN
2) Bridge-utils
3) sosetup
4) Start OpenVPN

13. Basic Setup: Target Server
1) Install OpenVPN & Daemonlogger
2) Start OpenVPN
3) Start Daemonlogger
4) http://testmyids.com

14. Misc Install Issues
-OpenVPN Bridge Adapter Line Speed (Win)
-Suricata Stream Alerts
-NIC Offloading - Cloud Images

15. Performance Metrics

16. Stability & NSM Validation
-Traditional SO Setup
-Local Cloud Client Setup
-Rackspace Cloud Client Setup

17. Real World Scenarios -
PetSitter

18. Real World Scenarios cont.
#1 - Cloud Client, Local Server
#2 - Standalone Cloud
#3 - Cloud Sensor, Local Server

19. Cloud Client,
Local Server

20. Standalone
Cloud

21. Cloud Sensor,
Local Server

22. Since Publication...

23. In Summary...
Cloud is here to stay
Cloud NSM is needed
Where do you fit in?

24. Questions?
Comments?
Snide Remarks?
Please feel free to reach out to me:
Josh@DefensiveDepth.com