Toolkit Titans - Crafting a Cutting-Edge, Open-Source Security Operations Toolkit
•
0 likes•44 views
Welcome to the world of “Toolkit Titans,” where a global lack of funding, limited manpower, and inadequate support doesn’t stop us from saving the world! In this action-packed talk, we’ll dive into the depths of defensive security operations to build a toolkit that serves your needs. Security analytics, incident response, and adversary emulation – I’ll focus on the cost-effective integration of powerful open-source tools like Elastic, Zeek, Suricata, and Jupyter Notebooks. I’ll demonstrate how these tools can be combined to form a flexible solution for state response, in-garrison support, or austere operations. The best part? I’ve done a lot of the work for you and all the resources will be provided via a GitHub project during the presentation. So gear up, brave Titan, and let’s build the ultimate cyber defense!
Recommended
More Related Content
Similar to Toolkit Titans - Crafting a Cutting-Edge, Open-Source Security Operations Toolkit
Similar to Toolkit Titans - Crafting a Cutting-Edge, Open-Source Security Operations Toolkit (20)
More from Brandon DeVault
More from Brandon DeVault (13)
Recently uploaded
Recently uploaded (20)
Toolkit Titans - Crafting a Cutting-Edge, Open-Source Security Operations Toolkit
- 1. Toolkit Titans: Crafting a Cutting-Edge, Open-Source Security Operations Toolkit ShieldCon 2023 Brandon DeVault Principal Security Author, Pluralsight Defensive Cyber Operations, FL Air National Guard /in/brandon-devault www.devaultsecurity.com @Vivicat
- 2. Agenda • Challenges and Use Cases • Toolkits • Software • Hardware • Conclusion / Q&A
- 4. The Solution! Unlimited manpower Unlimited budget Unlimited time
- 6. Operations • Security Analytics • Storage • Incident Response • Case Management • Adversary Emulation • Framework / Reporting
- 7. Toolkits
- 8. So, my toolkit is unique… right?
- 9. 9
- 10. The Hunting ELK (HELK) 10
- 11. 11
- 13. So, what do I use?
- 15. Software
- 16. Alerts Typical Network log data 16 Packet captures (PCAP) Session and Protocol Metadata Logs
- 18. Suricata vs Snort 18 • Port independent protocol analysis • File extraction for HTTP and SMTP • Multithreaded (ahead of Snort by a decade) • Backwards compatible with Snort rules 1998
- 19. Suricata • Suricata uses a rule-set to compare against incoming traffic and it fires off alerts if it matches on a rule. • Open Information Security Foundation • Active community • Truly open source (not tied to corp.) • Fast rule writing / updating cycle • Extended Snort Language • Multithreaded (scaleable) 19
- 20. Additional Features • Extracts files (http & smtp) • IPv4 / v6 • GeoIP / Reputation • Port-independent protocol detection • Outputs to `eve.json` • Extensible Event Format • DNS parse / match / log • “NSM runmode” • just events (no alerting) 20
- 22. Zeek • Passive, open-source traffic Analysis platform • Most often used in cybersecurity, but helpful for performance monitoring and troubleshooting • Generates rich set of logs that summarize network protocol sessions* * But there’s so much more! 22
- 23. 200.1.1.6 Packet vs Network Events 23 10.0.0.1 (S) 10.0.0.1 (D) 10.0.0.1 (S) 10.0.0.1 (D) 200.1.1.6 (D) 200.1.1.6 (S) 200.1.1.6 (D) 200.1.1.6 (S) 10.0.0.1 10.0.0.1 200.1.1.6 200.1.1.6 Client Server ● Based on individual packets ● Source and destination change based on the direction of the communication 10.0.0.1 200.1.1.6 TCPdump Wireshark Suricata Zeek ● Based on who initiated the conversation ● Client and Server do not change over the course of the connection Packet Events (Source/Destination) Network Events (Client/Server) 10.0.0.1
- 24. Zeek Data Flow 24 OR conn.log files.log http.log I saw an HTTP connection that where a file was transferred!
- 26. Store, Search, & Analyze Visualize & Manage Ingest Elastic Stack Elastic Stack Kibana Elasticsearch Beats Logstash What is the stack?
- 28. Atomic Red Team • Library of Scripted Attacks • Red Canary • Community Developed
- 30. Jupyter Notebooks • Live code and documentation • Over 40-languages • Integrated code and text • Interactive Output • Reproducibility
- 31. Hardware
- 32. Laptop – ASUS VivoBook 14 ($400 - $500) • AMD Ryzen 5 (4-Core) • 8GB RAM • 256GB SSD
- 33. Laptop: Acer Swift X ($850) • AMD Ryzen 7 • 16GB RAM • 512GB SSD • NVIDIA 3050Ti
- 34. Intel NUC ($1,000 - $2,000) • 6x USB-A • 1x USB-C • 2x Thunderbolt • 2x Ethernet • 2x HDMI • And it’s silent!
- 36. Conclusion
- 37. Questions? • www.devaultsecurity.com • linkedin. • twitter. devaultsecurity.com • github. • brandon-devault@pluralsight.com • https://app.pluralsight.com/profile/author/brandon-devault • https://github.com/1dentified/Eldritch_Knowledge • https://github.com/Pluralsight-SORCERI/Incident-Response-Resources • https://github.com/Pluralsight-SORCERI/Threat-Hunting-Resources }