Importance of Logging and Auditing in Cybersecurity
Discussing the significance of logging and auditing in cybersecurity, emphasizing the need for both a priori and a posteriori techniques to prevent security violations. Logging helps record events for system analysis, while auditing involves analyzing log records to provide understandable system information. Various logging techniques, including Windows, IIS, and Firewall logging, are explored alongside the importance of determining what information to log. Automated auditing tools are also mentioned for efficient log analysis in cybersecurity.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
JMU GenCyber Boot Camp Summer, 2016
Defense Logging Auditing Response
Logging and Auditing We have discussed many a priori techniques to prevent security violations A posteriori techniques are also important: Logging is the recording of events or statistics to provide information about system use and performance Auditing is the analysis of log records to present information about the system in a clear and understandable manner
Logging Logs provide a mechanism for analyzing the system security state Determine if a requested action will put the system in an insecure state Determine the sequence of events leading to the system being in an insecure state Problem: What information/events to log?
Logging (cont) Logs typically contain entries for successful and/or failed: User logins and logouts Creation of accounts Execution of certain commands Access to files Starting and stopping of services or the system
Windows Logging What to log set in Administrative Tools->Local Security Settings Logs stored in binary format System logs can be viewed using the Event Viewer Demo
IIS Logging Configured in IIS Manager Log file format can be selected, but mostly plain text Logs can be viewed using Notepad (or other text viewers) Demo
Firewall Logging Configured in Firewall GUI Log saved in c:\WINDOWS\pfirewall.log (by default) Can be viewed with Notepad (or other text viewers) Demo
Auditing Analysis of log records to present information about the system in a clear and understandable manner Manually Automated
Automated Auditing Tools Many tools available that process log files or produce real-time audit displays Application logs Web logs Database logs System logs Security logs (but these tend to be intrusion detection systems)
Automated Auditing Tools (cont) Splunk URL: http://www.splunk.com/ Log collection and analysis: Organizes and correlates information from various logs, machines, applications, etc.
Automated Auditing Tools (cont) System iNtrusion Analysis and Reporting Environment (SNARE) URL: http://www.intersectalliance.com/ Log collection and analysis: Collects audit data Transfers it to a central server for analysis
Attacking Logs and Audit Mechanisms Attackers typically alter logs to avoid detection May delete logs entirely May remove particular suspicious events: Failed logins Error conditions Stopped services File access/modification
Defending Log and Audit Data Bare minimum: Enable sensible logging Set proper permissions on log files A little better: Make log files append only (can be circumvented) Encrypt log files Attacker cannot alter logs without the proper encryption key
Defending Log and Audit Data (cont) Best Use a separate log server Hosts can be configured to redirect their logs to a dedicated log server Logs are centralized for easier processing/ analysis Compromise of a host does not allow the attacker to alter its stored logs Transfer logs to write-once media (slow)
Response Passive responses Record and report the problem Active responses Block the attack Repair the damage done by the attack Affect the progress of the attack Be careful!
Passive Responses Provide information to the user Rely on the user to take subsequent action Alarms On screen alert, window, or IDS console Remote notification Send e-mail Dial pagers or cell phones
Passive Responses (cont) SNMP Traps and Plug-ins IDS designed to function in concert with network management tools Utilize the network management infrastructure to send and display alarms Provided by several commercial IDSs
Active Responses Take action based on the detection of an intrusion: Take action against the intruder Amend the environment Collect more information Take action: Automatically (be careful!) User driven
Take Action Against the Intruder Ideally: Trace intrusion back to its source Disable the intruder s machine/network connection Prosecute the person responsible Problems: Network hopping - the source of the attack is probably another victim of the attacker Address spoofing the sources of the attack may just be random IP addresses
Take Action Against the Intruder (cont) Problems (cont): Striking back could provoke escalation Striking back could result in: Criminal charges Attacks (even in in response to an attack) are usually viewed as a violation of computer crime statutes Civil legal action Damages caused to innocent (or even guilty) parties could result in lawsuits Disciplinary action Many government, military, and commercial, and educational institutions have policies prohibiting attacks
Taking (Responsible) Action Against an Intruder Terminate a network session by resetting the TCP connection Configure a firewall or router to block packets coming from the IP address that appears to be the source of the intrusion Send e-mail to the admin of the attacking system For persistent attacks, notify law enforcement so they can investigate
Amend the Environment System environment Identify and fix what enabled the intrusion Disable vulnerable services Configure a firewall or router to block the attack Detection environment Increase sensitivity level of IDS Increase information collected by IDS Insert rules to better distinguish certain types of attacks
Collect Additional Information Especially important if you plan to pursue legal remedies Honeypots or decoy servers (legal grey area) Collect information/evidence Determine intruder s intent Understand threat trends and construct detection signatures Gather vulnerability information without putting sensitive/critical systems at risk
Fail-Safe Considerations Assume that an adversary will target the IDS/response component as part of the attack Monitoring response channels Searching for signs of detection Intercepting/disrupting alarms Determining response policies (and try to use them against a site)
Fail-Safe Measures Utilize encryption, integrity checking, and authentication to protect IDS communications from tampering Use redundant alarms (and multiple communications channels) Logs, audit records, and other evidence should be protected from alteration or destruction
Mapping Response to Policy Response activities should be documented in an organization s security policy Response activities can be categorized as: Immediate Timely Long term (local) Long term (global)
Immediate Response Activities Critical actions required immediately following an attack or intrusion: Initiating incident-handling procedures Performing damage control and containment Notifying law enforcement or other organizations Restoring victim systems to service
Timely Response Activities Actions required within hours or days of an incident: Investigate unusual patterns of system use Investigate and isolate the root causes of the detected problems Correct the problems when possible Apply vendor patches Reconfigure systems Report details of the incident to the proper authorities Pursue legal action against the perpetrator(s) Alter or amend detection signatures in the IDS
Long-Term (Local) Response Activities Less critical, but should be performed regularly: Compiling statistics Performing trend analysis Tracking patterns of intrusion over time Identify areas in need of improvement
Long-Term (Global) Response Activities Notifying vendors of the problems the organization has suffered due to security problems in their products Lobbying lawmakers for additional legal remedies to system security threats Reporting statistics regarding security incidents to law enforcement or other organizations
Defense Logging Information about what is happening on a system Evidence Auditing View and search log files to find important information Response Passive Active
