2014_protect_presentation
- 1. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
- 2. TB3288 - Leveraging Advanced Persistent Threat (APT) Threat Indicator Feeds with Enterprise SIEM/SEM to Improve Cyber Security Incident Detection Accuracy Tom Baltis, Deputy Chief Information Security Officer, Blue Cross & Blue Shield of IL, TX, NM, OK, MT Jeff Holland, Security Architect, Blue Cross & Blue Shield of IL, TX, NM, OK, MT Blue Cross and Blue Shield of Illinois, Blue Cross and Blue Shield of Montana, Blue Cross and Blue Shield of New Mexico, Blue Cross and Blue Shield of Oklahoma, and Blue Cross and Blue Shield of Texas, divisions of Health Care Service Corporation, a Mutual Legal Reserve Company, and Independent Licensee of the Blue Cross and Blue Shield Association
- 3. 2 Outline I. Need for APT indicator feed integration with ESM and overview II. Framework benefits and template III.Example use cases 1. Gaps in anti-virus detection 2. Improperly categorized domains in web proxy logs 3. Data exfiltration from malware-infected hosts IV. Summary and recommendations
- 4. 3 Introduction Siloed monitoring methods, such as anti-virus, intrusion detection systems, and firewalls, don’t always detect advanced malware infections and other potential incidents. Today’s malware is polymorphic in nature and easily bypasses signature-based detection tools Bot infected hosts communicate back with command and control servers over HTTP/HTTPS through the firewall Malicious malware drop sites rapidly change their domain/IP, making it difficult for proxy technologies to black-list them Integrating Advanced Persistent Threat (APT) feeds with ArcSight ESM will increase incident detection accuracy. This presentation will enable you to: 1) Update ArcSight with advanced content that uses threat indicator feeds 2) Apply a framework to systematically create and document this content
- 5. 4 Threat Data Feed Sources External threat data feeds provide capabilities not readily available internally: Larger sample sizes of IP/domains More use-cases supported: malware, APT, fraud, phishing, DDoS Richer data than just IP/domains: URLs, file names, emails, etc. Multiple data collection methods: web scraping, email lists, honeynets, etc. Examples of Open Source Threat Feeds zeustracker.abuse.ch/blocklist.php?download=domainblocklist rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt malwaredomainlist.com/mdlcsv.php dshield.org/feeds/suspiciousdomains_High.txt Examples of Commercial Threat Feeds HP/ArcSight RepSM ThreatStream
- 6. 5 Integrating Threat Feeds with ESM Once threat feeds are identified and selected, they must be integrated with ESM. Open Source Commercial Source 1. Download open source lists 2. Parse data feeds and normalize into a common format 3. Write or customize a flexconnector to read that common format 4. Import threat feed to ESM with the new flexconnector 5. Load data into Active Lists using rules 1. Utilize a commercial product that aggregates the threat intel data, e.g. HP/ArcSight RepSM ThreatStream 2. Import threat feed to ESM with connector (e.g. CEF Syslog) or a flexconnector 3. Load data into Active Lists using rules
- 7. 6 Extending Threat Detection Capabilities Past presentations have shown how rules can be written to identify when internal hosts connect to a malicious IP/domain found in the active lists. Leveraging previous work in this area, a software development methodology approach, and advanced ESM features such as rule chaining, we created a framework to help develop advanced content. We will apply the framework to demonstrate key benefits using three use case examples.
- 8. 7 Benefits of the Threat Feed Use Case Framework In order to take threat detection correlation beyond just knowing when a host connects to a malicious IP or domain, we propose a threat use case framework that provides the following benefits: Higher incident detection accuracy An opportunity to identify missing data sources related to the content you want to develop and document them Improved investigation quality by enabling systematic and creative problem solving (e.g. reduce investigation false positives) Creation of a knowledge base for threat lists, their content, false positive sensitivity, etc.
- 9. 8 Overview of the Threat Feed Use Case Framework Apply this framework to create use cases and associated content: 1. Determine what feeds are available, what intelligence they provide, what the false positive rate is (e.g. Low, Medium or High) 2. Determine what complementing log sources are available (e.g. firewall, (N)IDS, Anti-Virus, Malware Protection, File Integrity, etc) 3. Determine gaps in current logging sources that need to be addressed and those that threat intel can help bridge 4. Outline content logic, paying attention to any rule chaining or watchlist linkages 5. Create proof of concept content and test with live data, if possible
- 10. 9 Advanced Correlation Use Cases Using Threat Data We utilized the framework to create three use case examples that leverage threat data to: 1. Identify potential gaps in anti-virus reporting when a malware-infected host is not being detected 2. Detect when a web proxy solution is not properly blocking a host connecting to a malicious site 3. Identify potential data exfiltration from a malware-infected host using firewall events
- 11. 10 Use Case 1: Potential Gaps in Anti-Virus A rule fires when an internal host connects to an IP identified as a malware drop site. The return traffic from the malicious IP to the internal host is observed.
- 12. 11 Use Case 1: Potential Gaps in Anti-Virus (cont.) The threat intel content adds the internal user to a possibly compromised active list (watchlist).
- 13. 12 Use Case 1: Potential Gaps in Anti-Virus (cont.) Another rule looks for anti-virus events for the internal host. If this rule doesn’t fire, a malware infected host was not detected by the anti-virus system, i.e. a gap exists.
- 14. 13 Use Case 1: Potential Gaps in Anti-Virus (cont.) If an anti-virus base event is observed for the same host, the rule removes the internal host from the watchlist and creates a case indicating a compromised host has been confirmed.
- 15. 14 Use Case 1: Potential Gaps in Anti-Virus (cont.) A potentially infected internal host connects to a IP address identified as a malware drop site. By using the APT feeds and the framework, you will be able to: Identify gaps in signature based anti-virus tools. Identify potential false positives in threat data if the investigation finds no malware infection Investigate cases to determine if the host is actually compromised Derive malware infection detection metrics through auto case creation
- 16. Use Case 2: Improperly Categorized Domains in Web Proxies A threat intel rule fires when an internal user connects to a malicious domain. The web proxy doesn’t block the traffic as the malicious domain has not been categorized by the vendor. 15
- 17. 16 Use Case 2: Improperly Categorized Domains in Web Proxies (cont.) If the multi-event join rule fires, a case is generated for investigation and the internal host is added to a possibly compromised active list.
- 18. 17 Use Case 2: Improperly Categorized Domains in Web Proxies (cont.) A potentially infected internal host connects to a malicious domain that was not categorized by the web proxy vendor. By using the APT feeds and the framework, you will be able to: Identify web users connecting to a potentially malicious site that the web proxy technology missed Provide feedback for the web proxy product vendor to improve the product Identify potential false positives in threat data if the investigation finds no malware infection Investigate cases to determine if the host is actually compromised Derive malware infection detection metrics through auto case creation
- 19. 18 Use Case 3: Data Exfiltration from a Malware Infected Host Firewall logs indicate a permitted connection from internal DHCP pool to external IP of more than 500 bytes, as seen below A rule identifies a possible data exfiltration by matching the destination IP to a threat data active list containing malicious IP's
- 20. 19 Use Case 3: Data Exfiltration from a Malware Infected Host (cont.) If a match is found, the rule adds the source IP/destination IP pair to a suspicious watchlist with a TTL and creates a case for investigation
- 21. 20 Use Case 3: Data Exfiltration from a Malware Infected Host (cont.) A potentially infected internal host sends “significant” traffic to an IP address on the APT list and may be communicating with a command and control server. By using the APT feeds and the framework, you will be able to: Identify potential data exfiltration between internal host and malicious external IP based upon a user-defined threshold Identify potential false positives in threat data if the investigation finds no malware infection Investigate cases to determine if the host is actually compromised Derive malware infection detection metrics through auto case creation
- 22. 21 Conclusion and Recommendations Benefits Threat based use cases help derive value from integrating APT feeds with ESM to solve security issues such as identifying malware infected hosts A use case framework facilitates creating correlation content that improves incident detection accuracy Use cases can be developed to verify the accuracy of other event sources such as web proxy logs Auto case creation from rules can help derive metrics To apply what you’ve learned, we recommend the following: Identify and adopt an appropriate knowledge base system Apply framework to create use cases and update the knowledge base Execute the use cases to create content
- 23. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.22 Please fill out a survey. Hand it to the door monitor on your way out. Thank you for providing your feedback, which helps us enhance content for future events. Session TB3288 Speaker Tom Baltis and Jeff Holland Please give me your feedback
- 24. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Thank you
- 25. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.