RESTful Mash-Ups to Help Under-Staffed Infosec Teams

“This article was originally featured on <a href="http://wiredata.net/phuck-you-you-phishing-phucks-restful-mash-ups-to-help-under-staffed-infosec-teams/" target="_blank">Wire Data </a>on April 2nd, 2017.” In this post, we will couple <a href="https://www.extrahop.com/">ExtraHop’</a>s wire data analytics, Anomali STAXX, a leading <a href="https://www.anomali.com/community/staxx">threat intelligence</a> solution and <a href="https://packetjockey.slack.com/">Slack</a>, a cloud-based collaboration platform to demonstrate how we can use orchestration and automation in a manner that helps today’s under-(wo)manned security teams meet today’s threats with the level of agility needed! <iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/9M58XieQjeo" width="560"></iframe>I was fortunate enough to be selected to speak at RSAC 2017 and it was surely a career highlight for me. As several analysts pointed out post-show, automation and orchestration seemed to be the flavor of the year. Over the last 36 months, it has become glaringly obvious that we simply cannot keep bad actors and malicious software off of our networks. I have been preaching the folly of perimeter (only) based security since <a href="https://edgesightunderthehood.com/2010/03/15/monitoring-advanced-persistent-threat-malware-and-general-punk-busting-with-edgesight/">2010</a>. The speed with which systems are now compromised and the emergence of the “human vector” through phishing has all but assured us that the horde is behind the wall and needs to be directly engaged. The reliance on logs, SIEM products will give you a forensic view of what is going on but will do little to be effective against today’s threats where a system could be compromised by the time the log is written.While the idea of automation and orchestration is a great one, there are issues with it and will not be the first time “self-defending networks” have been brought to market. Bruce Schneier makes a very good point in his “Schneier on Security” <a href="https://www.schneier.com/blog/archives/2017/03/security_orches.html">blog post</a> when he states the following:“You can only automate what you’re certain about, and there is still an enormous amount of uncertainty in cybersecurity”. He also makes one of the greatest quotes in INFOSEC history when he states “Data does equal information and information does not equal understanding”.<img alt="" src="https://cdn.filestackcontent.com/UubPDtcfSfWA1DOOmwSd" style="width: 400px; height: 404px;"/>Perhaps the battle here is to get to a place of certainty, I too was once an advocate of “log everything and sort it out later” but the process of sorting through the data become extremely tedious and the amount of work it took to get to “certainty” I believe, gave bad actors time to operate while I wrote SQL queries, batch processes and parsing scripts for my context-starved data sets. Couple this with the fact that teams are digitally bludgeoned to death with alerts and warnings that the “INFOSEC death sentence” starts to take root as people get desensitized to the alerts.So where do we find certainty and how do we use it? While the industry is still developing, there have been great strides in Threat Intelligence. ISACs around the world are working together to build shared intelligence around specific threats and making the information readily available via TAXII, STIXX and CIF. There is even a confidence level associated with each record that we are able to use as a guide to determine if a specific action is needed. The challenge with good threat intelligence is how we make it usable. Currently most threat Intel is leveraged in conjunction with a SIEM or logging product. While I certainly advocate for logs, there are some limitations with them.<ul><li>Not everything logs properly (IoT Systems normally have NO logging at all)</li><li>You have a data gravity issue (you have to move the data into the cloud to be evaluated or you have to store petabytes of data to evaluate)</li><li>In some cases, only a small portion of the log is usable (but you pay to index the entire log with most platforms)</li><li>Their use is largely forensic with many of today’s threats</li></ul>The case for Wire Data Analytics: The key difference that I want to point out here is that using Wire Data Analytics with ExtraHop you can perform quite a bit of analysis in flight. ExtraHop “takes” data off the wire and is not dependent on another system to “give” the data to it. The only prerequisite for ExtraHop is an IP address. Examples of how I have made a SIEM more effective using wire data include:<ul><li>Reducing Logging by 5000% by looking at logins by IP and calculating the total THEN sending a syslog message to the SIEM for those IPs with more than 100 logins vs. sending tens of thousands of logs per minute to the SIEM and checking on the back end</li><li>Checking an EGRESS transaction to against threat intelligence THEN sending the syslog if there is a match</li><li>In an enterprise with tens of thousands of employees, rather than logging EVERY failed login, aggregate records into five-minute increments then send those with more than 5 login failures to the SIEM.</li></ul>The point here is that you can deliver some context when you leverage wire data analytics with your SIEM workflows. Using SIEM-only, you must achieve context by aggregating the logs and looking at them after they are written. Using ExtraHop with your SIEM, you are able to achieve context (and more importantly, get closer to Mr. Schneier’s certainty) BEFORE sending the data to the SIEM. You can keep all the workflows that are tied to the incumbent SIEM system, you are just getting better, and fewer, logs. Should I disable an account that has 50 login failures in the last five minutes (Locked out or not)…..HELL YES! While I don’t think that automation and orchestration are a panacea, I think there are SOME cases where the certainty level is high enough to orchestrate a response. Also, I believe that automation and orchestration is not just for responding but can be used to make your SOC more effective.Now that I have, hopefully, established the merits of using Wire Data Analytics, let’s keep in mind orchestration does NOT have to be a specific action or response. Orchestration can also be used to make your team more agile and hopefully, more effective. Most security teams I come across have at least one, two and in some cases, three open positions. The fact is, at a time when threats are becoming more complex, finding people with the needed skills to confront them is harder than ever. The situation has gotten so bad that the other day I typed “Human Capital Crisis” in Google and it auto-filled “in cybersecurity”. The job is getting tougher and there are fewer of us doing it, what I am going to show you in this post will never replace a human being but it might ease some of the heavy lifting that goes into achieving situational awareness.<img alt="" src="https://cdn.filestackcontent.com/8Q0cD3kkSiCAUkWEnheC" style="width: 500px; height: 112px;"/>PHISHING: “PHUCK YOU, YOU PHISHING PHUCKS!!!” Anyone who has ever been phished or worked in an organization that is experiencing a phishing/spear phishing campaign has felt exactly as the section title says. Let's have a look at how we can help our security teams get better data by leveraging the API’s of three unique platforms to warn them when a known phishing site has been accessed.For those of us who are working too hard to bring context to the deluge of data, my suggestion…get some REST!!! Below I am going to walk you through how I can monitor activity to known phishing sites by doing a mash-up of three technologies using the RESTFUL API of all three platforms.Solution Roster:<ul><li>ExtraHop Discovery/Explorer appliance ExtraHop provides wire data analytics and surveillance by working from a mirror of the traffic. Think of it as a CCTV for packets/transactions.</li><li>Anomali STAXX Virtual Machine Anomali STAXX provides me lists of current threat intelligence. Think of this as equipping the CCTV operator with a list of suspicious characters to look for.</li><li>Slack Collaboration Community Slack provides me a community at packetjockey.slack.com where my #virtualsoc team operations from anywhere in the world.</li><li>A python peer (Windows or Linux) This is the peer system that accesses the threat intelligence and pulls it off of the STAXX system and uploads the threat intelligence to the ExtraHop appliance.</li></ul>How it works: As you can see in the drawing below, the Linux peer uses the REST API to get a list of known phishing sites then executes a Python script to upload the data into the memcache on the ExtraHop appliance equipping it with the threat intelligence it needs. The ExtraHop appliance uses an application inspection trigger that checks every outgoing URI to see if it is a known phishing site. If there is a match, an alert is sent to Slack, Email/SMS in addition to being logged on their own internal dashboards and search appliance.<img alt="" src="https://cdn.filestackcontent.com/mGuc8qI1QoC0y8rGj847" style="width: 500px; height: 347px;"/>What the final product looks like: From my Linux box, (I don’t dare go to these sites on my Windows or Mac laptop) I do a “wget” on one of the known phishing sites and within milliseconds (Yes milliseconds, watch the video if you don’t believe me). We get the client IP, Server IP and the site that they went to. From here we can find out who owns that client machine and get them to change their password immediately as well as issue an ACL for the server in case this is a spear phishing campaign and they are targeting specific uses. Also, before you ask, “Yes” we can import the list of known malicious email addresses and monitor key executive recipients in case one of them gets an email from a known malicious address. We can also check HTTP referrers against the phish_url threat intelligence.In the screenshot below, you see my “wget” command and the result at 11:23:53 and you can see that the Slack warning came in at 11:26. If you watch the video you will see it takes milliseconds.<img alt="" src="https://cdn.filestackcontent.com/hlOXV0J5TnOhyj9IayHf" style="width: 500px; height: 296px;"/>I believe that by using slack you can also color code certain messages for specific messages and program in that awesome “WTF” emoji (if one exists) ExtraHop sends. Also, if you are not comfortable with specific information being sent to slack, we can configure the appliance to send you a link to the LOCAL URI that ONLY you and your team can access.Conclusion: While there is a lot of buzz around Orchestration and Automation I believe the pessimism around it is justified. Security teams have been promised a lot over the last few years and what we have found, especially lately, is that a lot of tried-and-true solutions either lack the shutter-speed or context to be effective. Here we are doing some orchestration and automation but we are doing so in order to give the HUMAN BEING better information. Our security director made a very good point to me the other day when he said the last thing a security team wants is more data. What we have hopefully shown in this post is that if you have open platforms like Anomali, SLACK and ExtraHop, you can craft an automation and orchestration solution that can actively help security teams in a manner that still leverages the nuance and rationalization that only exists in a human being. While there will be solutions that will effectively automatically block certain traffic, issue ACLs, Disable accounts, etc. We can also use automation to do some of the heavy lifting for today’s out(wo)manned security teams. To get where I think the Cyber Security space needs to be, it is going to take more than one product/tool/platform. If you have a solution that is closed and does not support any kind of RESTFUL API or open architecture, unless it fulfills a specific niche, get rid of it. If you are a vendor and you are selling a solution that is closed, do so at your own peril as I believe closed systems are destined to go the way of the dinosaur. By leveraging wire data with existing workflows, you can drastically reduce your TTWTF (time to WTF!??) and be better positioned to trade punches with tomorrow’s threats.Thanks so much for reading, <a href="https://www.youtube.com/watch?v=9M58XieQjeo" target="_blank">please watch the video</a>.John M. Smith