Chapter 12. Security Monitoring Operational Challenges
This chapter covers the following topics:
Security monitoring and encryption
Security monitoring and network address translation
Security monitoring and event correlation time synchronization
DNS tunneling and other exfiltration methods
Security monitoring and Tor
Security monitoring and peer-to-peer communication
There are several security monitoring operational challenges, including encryption, network address translation (NAT), time synchronization, Tor, and peer-to peer communications. This chapter covers these operational challenges in detail.
“Do I Know This Already?” Quiz
The “Do I Know This Already?” quiz helps you identify your strengths and deficiencies in this chapter’s topics. The ten-question quiz, derived from the major sections in the “Foundation Topics” portion of the chapter, helps you determine how to spend your limited study time. You can find the answers in Appendix A Answers to the “Do I Know This Already?” Quizzes and Q&A Questions.
Table 12-1 outlines the major topics discussed in this chapter and the “Do I Know This Already?” quiz questions that correspond to those topics.
1. Which of the following are benefits of encryption?
a. Malware communication
b. Privacy
c. Malware mitigation
d. Malware identification
2. Why can encryption be challenging to security monitoring?
a. Encryption introduces latency.
b. Encryption introduces additional processing requirements by the CPU.
c. Encryption can be used by threat actors as a method of evasion and obfuscation, and security monitoring tools might not be able to inspect encrypted traffic.
d. Encryption can be used by attackers to monitor VPN tunnels.
3. Network address translation (NAT) introduces challenges in the identification and attribution of endpoints in a security victim. The identification challenge applies to both the victim and the attack source. What tools are available to be able to correlate security monitoring events in environments where NAT is deployed?
a. NetFlow
b. Cisco Lancope Stealthwatch System
c. Intrusion Prevention Systems (IPS)
d. Encryption protocols
4. If the date and time are not synchronized among network and security devices, logs can become almost impossible to correlate. What protocol is recommended as a best practice to deploy to mitigate this issue?
a. Network address translation
b. Port address translation
c. Network Time Protocol (NTP)
d. Native Time Protocol (NTP)
5. What is a DNS tunnel?
a. A type of VPN tunnel that uses DNS.
b. A type of MPLS deployment that uses DNS.
c. DNS was not created for tunneling, but a few tools have used it to encapsulate data in the payload of DNS packets.
d. An encryption tunneling protocol that uses DNS’s UDP port 53.
6. Which of the following are examples of DNS tunneling tools? (Select all that apply.)
a. DeNiSe
b. dns2tcp
c. DNScapy
d. DNStor
7. What is Tor?
a. An encryption protocol.
b. A hashing protocol.
c. A VPN tunnel client.
d. Tor is a free tool that enables its users to surf the Web anonymously.
8. What is a Tor exit node?
a. The encrypted Tor network
b. The last Tor node or the “gateways” where the Tor encrypted traffic “exits” to the Internet
c. The Tor node that performs encryption
d. The Tor browser installed in your system in order to “exit” the Internet
9. What is a SQL injection vulnerability?
a. A type of vulnerability where an attacker can insert or “inject” a SQL query via the input data from the client to the application or database
b. A type of vulnerability where an attacker can “inject” a new password to a SQL server or the client
c. A type of DoS vulnerability that can cause a SQL server to crash
d. A type of privilege escalation vulnerability aimed at SQL servers
10. What are examples of peer-to-peer (P2P) tools?
a. LionShare
b. P2P NetFlow
c. Napster
d. Peercoin
Foundation Topics
Security Monitoring and Encryption
Encryption has great benefits for security and privacy, but the world of incident response and forensics can present several challenges. Even law enforcement agencies have been fascinated with the dual-use nature of encryption. When protecting information and communications, encryption has numerous benefits for everyone from governments and militaries to corporations and individuals. On the other hand, those same mechanisms can be used by threat actors as a method of evasion and obfuscation. Historically, even governments have tried to regulate the use and exportation of encryption technologies. A good example is the Wassenaar Arrangement, which is a multinational agreement with the goal of regulating the export of technologies like encryption.
Other examples include events around law enforcement agencies such as the U.S. Federal Bureau of Investigation (FBI) trying to force vendors to leave certain investigative techniques in their software and devices. Another example is the alleged U. S. National Security Agency (NSA) backdoor in the Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG) that allows cleartext extraction of any algorithm seeded by this pseudorandom number generator.
Some folks have bought into the idea of “encrypt everything.” However, encrypting everything would have very serious consequences, not only for law enforcement agencies, but also for incident response professionals. Something to remember about the concept of “encrypt everything” is that the deployment of end-to-end encryption is difficult and can leave unencrypted data at risk of attack.
Many security products (including next-generation IPSs and next-generation firewalls) can intercept, decrypt, inspect, and re-encrypt or even ignore encrypted traffic payloads. Some people consider this a man-in-the-middle (MITM) matter and have many privacy concerns. On the other hand, you can still use metadata from network traffic and other security event sources to investigate and solve security issues. You can obtain a lot of good information by leveraging NetFlow, firewall logs, web proxy logs, user authentication information, and even passive DNS (pDNS) data. In some cases, the combination of these logs can make the encrypted contents of malware payloads and other traffic irrelevant. Of course, this is as long as you can detect their traffic patterns to be able to remediate an incident.
It is a fact that you need to deal with encrypted data, but in transit or “at rest” on an endpoint or server. If you deploy web proxies, you’ll need to assess the feasibility in your environment of MITM secure HTTP connections.
TIP
It is important to recognize that from a security monitoring perspective, it’s technically possible to monitor some encrypted communications. However, from a policy perspective, it’s an especially different task depending on your geographical location and local laws around privacy.
Security Monitoring and Network Address Translation
In Chapter 2, “Network Security Devices and Cloud Services,” you learned that Layer 3 devices, such as routers and firewalls, can perform network address translation (NAT). The router or firewall “translates” the “internal” host’s private (or real) IP addresses to a publicly routable (or mapped) address. By using NAT, the firewall hides the internal private addresses from the unprotected network and exposes only its own address or public range. This enables a network professional to use any IP address space as the internal network. A best practice is to use the address spaces that are reserved for private use (see RFC 1918, “Address Allocation for Private Internets”).
NOTE
Cisco uses the terminology of real and mapped IP addresses when describing NAT. The real IP address is the address that is configured on the host, before it is translated. The mapped IP address is the address that the real address is translated to.
Static NAT allows connections to be initiated bidirectionally, meaning both to the host and from the host.
NAT can present a challenge when you’re performing security monitoring and analyzing logs, NetFlow, and other data, because device IP addresses can be seen in the logs as the “translated” IP address versus the “real” IP address. In the case of port address translation (PAT), this could become even more problematic because many different hosts can be translated to a single address, making the correlation almost impossible to achieve.
Security products, such as the Cisco Lancope Stealthwatch system, provide features that can be used to correlate and “map” translated IP addresses with NetFlow. This feature in the Cisco Lancope Stealthwatch system is called NAT stitching. This accelerates incident response tasks and eases continuous security monitoring operations.
Security Monitoring and Event Correlation Time Synchronization
In Chapter 11, “Network and Host Telemetry,” you learned that server and endpoint logs, NetFlow, syslog data, and any other security monitoring data is useless if it shows the wrong date and time. This is why as a best practice you should configure all network devices to use Network Time Protocol (NTP). Using NTP ensures that the correct time is set and all devices within the network are synchronized. Also, another best practice is to try to reduce the amount of duplicate logs. This is why you have to think and plan ahead as to where exactly you will deploy NetFlow, how you will correlate it with other events (like syslog), and so on.
DNS Tunneling and Other Exfiltration Methods
Threat actors have been using many different nontraditional techniques to steal data from corporate networks without being detected. For example, they have been sending stolen credit card data, intellectual property, and confidential documents over DNS using tunneling. As you probably know, DNS is a protocol that enables systems to resolve domain names (for example, cisco.com) into IP addresses (for example, 72.163.4.161). DNS is not intended for a command channel or even tunneling. However, attackers have developed software that enables tunneling over DNS. These threat actors like to use protocols that traditionally are not designed for data transfer, because they are less inspected in terms of security monitoring. Undetected DNS tunneling (otherwise known as DNS exfiltration) represents a significant risk to any organization.
In many cases, malware can use Base64 encoding to put sensitive data (such as credit card numbers, PII, and so on) in the payload of DNS packets to cyber criminals. The following are some examples of encoding methods that could be used by attackers:
Base64 encoding
Binary (8-bit) encoding
NetBIOS encoding
Hex encoding
Several utilities have been created to perform DNS tunneling (for the good and also for the bad). The following are a few examples:
DeNiSe: A Python tool for tunneling TCP over DNS.
dns2tcp: Written by Olivier Dembour and Nicolas Collignon in C, dns2tcp supports KEY and TXT request types.
DNScapy: Created by Pierre Bienaimé, this Python-based Scapy tool for packet generation even supports SSH tunneling over DNS, including a SOCKS proxy.
DNScat or DNScat-P: This Java-based tool created by Tadeusz Pietraszek supports bidirectional communication through DNS.
DNScat (DNScat-B): Written by Ron Bowes, this tool runs on Linux, Mac OS X, and Windows. DNScat encodes DNS requests in NetBIOS encoding or hex encoding.
Heyoka: This tool, written in C, supports bidirectional tunneling for data exfiltration.
Iodine: Written by Bjorn Andersson and Erik Ekman in C, Iodine runs on Linux, Mac OS X, and Windows, and can even be ported to Android.
Nameserver Transfer Protocol (NSTX): Creates IP tunnels using DNS.
OzymanDNS: Written in Perl by Dan Kaminsky, this tool is used to set up an SSH tunnel over DNS or for file transfer. The requests are Base32 encoded, and responses are Base64-encoded TXT records.
psudp: Developed by Kenton Born, this tool injects data into existing DNS requests by modifying the IP/UDP lengths.
Feederbot and Moto: Attackers have used this malware using DNS to steal sensitive information from many organizations.
Some of these tools were not created with the intent of stealing data, but cyber criminals have used them for their own purposes.
Security Monitoring and Tor
Many people use tools such as Tor for privacy. Tor is a free tool that enables its users to surf the Web anonymously. Tor works by “routing” IP traffic through a free, worldwide network consisting of thousands of Tor relays. Then it constantly changes the way it routes traffic in order to obscure a user’s location from anyone monitoring the network.
NOTE
Tor’s name is an acronym of the original software project’s name, “The Onion Router.”
The use of Tor also makes security monitoring and incident response more difficult, because it’s hard to attribute and trace back the traffic to the user. Different types of malware are known to use Tor to cover their tracks.
This “onion routing” is accomplished by encrypting the application layer of a communication protocol stack that’s “nested” just like the layers of an onion. The Tor client encrypts the data multiple times and sends it through a “network or circuit” that includes randomly selected Tor relays. Each of the relays decrypts “a layer of the onion” to reveal only the next relay so that the remaining encrypted data can be routed on to it.
Figure 12-1 shows a screenshot of the Tor browser. You can see the Tor circuit when the user accessed cisco.com from the Tor browser. It first went to a host in the Netherlands, then to hosts in Sweden and France, and finally to cisco.com.
A Tor exit node is basically the last Tor node or the “gateway” where the Tor encrypted traffic “exits” to the Internet. A Tor exit node can be targeted to monitor Tor traffic. Many organizations block Tor exit nodes in their environment. The Tor project has a dynamic list of Tor exit nodes that makes this task a bit easier. This Tor exit node list can be downloaded from https://check.torproject.org/exit-addresses.
Security products such as the Cisco Next-Generation Firepower software provide the capability to dynamically learn and block Tor exit nodes.
Security Monitoring and Peer-to-Peer Communication
Peer-to-peer (P2P) communication involves a distributed architecture that “divides tasks” between participant computing peers. In a P2P network, the peers are equally privileged, which is why it’s called a “peer-to-peer” network of nodes.
P2P participant computers or nodes reserve a chunk of their resources (such as CPU, memory, disk storage, and network bandwidth) so that other “peers” or participants can access those resources. This is all done without the need of a centralized server. In P2P networks, each peer can be both a supplier as well as a consumer of resources or data. A good example was the music-sharing application Napster back in the 1990s.
P2P networks have been used to share music, videos, stolen books, and other data; even legitimate multimedia applications such as Spotify use a peer-to-peer network along with streaming servers to stream audio and video to their clients. There’s even an application called Peercoin (also known as PPCoin) that’s a P2P crypto currency that utilizes both proof-of-stake and proof-of-work systems.
Universities such as MIT and Penn State have even created a project called LionShare, which is designed to share files among educational institutions globally.
From a security perspective, P2P systems introduce unique challenges. Malware has used P2P networks to communicate and also spread to victims. Many “free” or stolen music and movie files usually come with the surprise of malware. Additionally, like any other form of software, P2P applications are not immune to security vulnerabilities. This, of course, introduces risks for P2P software because it is more susceptible to remote exploits, due to the nature of the P2P network architecture.
Exam Preparation Tasks
Review All Key Topics
Review the most important topics in the chapter, noted with the Key Topic icon in the outer margin of the page. Table 12-2 lists these key topics and the page numbers on which each is found.
Define Key Terms
Define the following key terms from this chapter, and check your answers in the glossary:
Tor
Tor exit node
peer-to-peer (P2P) communication
Q&A
The answers to these questions appear in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Q&A Questions.” For more practice with exam format questions, use the exam engine on the website.
1. What is Tor?
a. Tor is The Onion Router and is a free tool that enables its users to surf the Web anonymously.
b. Tor is The Onion Router and is a free tool that enables its users to send email in an encrypted way using PGP.
c. Tor is The Onion Router and is a free tool that enables its users to route packets anonymously by leveraging the EIGRP or OSPF routing protocol.
d. Tor is The Onion Router and is a free tool that enables its users to route packets anonymously by using BGP.
2. Why does NAT present a challenge to security monitoring?
a. NAT can present a challenge when performing security monitoring and analyzing logs because data can be encrypted as a result of the network address translation.
b. NAT can present a challenge when performing security monitoring and analyzing logs because data can be dropped as a result of the network address translation.
c. NAT can present a challenge when performing security monitoring and analyzing logs, NetFlow, and other data because device IP addresses can be seen in the logs as the “translated” IP address versus the “real” IP address.
d. NAT can present a challenge when performing security monitoring and analyzing logs because data can be fragmented as a result of the network address translation.
3. What is a Tor exit node?
a. A Tor exit node is the first Tor node or the “gateway” where the Tor encrypted traffic “exits” to the Internet.
b. A Tor exit node is the last Tor node or the “gateway” where the Tor encrypted traffic “exits” to the Internet.
c. A Tor exit node is the Tor node or the “gateway” where the Tor browser connects first.
d. A Tor exit node is an Internet routing entity that can define how the Tor browser exits the common Internet and connects to the darknet.
4. Which of the following is an example of a DNS tunneling tool?
a. dig
b. nslookup
c. DNScapy
d. DNSSEC
5. Which of the following is an example of an encoding mechanism used by threat actors?
a. Base24 encoding
b. GRE tunnels
c. Hex tunnels
d. Base64 encoding
6. Why should NTP be enabled in infrastructure devices and for security monitoring?
a. Using NTP ensures that the correct time is set and that all devices within the network are synchronized. Also, it helps to reduce the amount of duplicate logs.
b. Using NTP ensures that the network tunneling protocol is implemented with the correct encryption algorithms.
c. Using NTP ensures that the network tunneling protocol is implemented with the correct hashing algorithms.
d. Using NTP ensures that the network tunneling protocol is implemented with the correct DNS names and NetFlow records.