Ayoi on the Importance of NSM Data

At my ShmooCon talk I provided a series of case studies showing the importance of Network Security Monitoring data. The idea was to ask how it would be possible to determine if an IDS alert represented a real problem if high-quality data didn't exist. Alert management is not security investigation, and unfortunately most products and processes implement the former while the latter is truly needed.

I noticed that Ayoi in Malaysia posted a series of blog stories showing his investigative methodology using NSM data and Sguil (Not Only Alert Data parts I, II, and III). These posts demonstrate several alerts and compare data available via an alert management tool like BASE versus a security investigation tool like Sguil. I am glad to see these sorts of stories because they show how people in the trenches do their jobs.

I have yet to meet an analyst -- someone responsible for finding intrusions -- who rejects my methods or the need for collecting NSM data. Almost everyone who argues against these methods is not directly responsible for the technical aspects of personally detecting and responding to intrusions.

Comments

Murali Raju said…
"Almost everyone who argues against these methods is not directly responsible for the technical aspects of personally detecting and responding to intrusions."

I could not agree with you more. On a lighter note, I am winning battles, but not the war on promoting NSM principles. It is a start...

_Raju
10:41 AM
Anonymous said…
Wow...good jobs Ayoi...
11:51 AM
Joel Esler said…
Richard--

I agree with you. It takes surrounding data.

When i used to be an analyst, I started with RealSecure, well, needless to say.. sucked.

Snort came next, and it was awesome, but not enuff.

I developed an IDS system with pcap logs, p0f, and Snort being analyzed by BASE.

Sguil wasn't as sharp as it is now, and wasn't as "stable", so it didn't work out for me. But being able to analyze a Snort alert by utilizing the src and dst, and running a tcpdump query for the surrounding timeframe was awesome. We found stuff we otherwise would have not found.

However, this approach was not feasible when we get over 10 sensors. The data being collected was just too much to deal with.

I can think of a 100 different scenarios where products like RNA, IPS, IDS, Sguil-ish NSM tools, and the like all have their place, some more than others, RNA provides alot of the contextual alerting without the need for "Immaculate Collection".

I don't disagree with you, but my point is, there is more than one way to skin a cat.
1:22 AM
Anonymous said…
Totally agree with you Joel Esler.
2:02 AM
Anonymous said…
So what would be the best way to monitor?

hackathology.blogspot.com
2:04 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more