Speaker 1: Hey everyone, and welcome back for another deep dive. Today.
Speaker 1: We're going to be tackling a topic that you all
Speaker 1: flagged as super important, network security monitoring, and to guide us,
Speaker 1: we are going to be taking a deep dive into
Speaker 1: the book Network Security Monitoring by Chris Fry and Martin Eistrom.
Speaker 2: Oh A classic choice. Yeah, that book provides a great
Speaker 2: foundation for anyone who wants to understand this complex and
Speaker 2: always evolving field.
Speaker 1: Exactly. So, think of this deep dive as like us
Speaker 1: building a security monitoring fortress together.
Speaker 2: I like it.
Speaker 1: Brick by brick. We're going to explore why monitoring is
Speaker 1: so vital these days, how to pinpoint the critical areas
Speaker 1: you absolutely need to watch, and the best place is
Speaker 1: to gather that intel.
Speaker 2: Sounds good to me. Let's lay down that foundation.
Speaker 1: Okay, So, you know, we used to think anti virus
Speaker 1: software was like this impenetrable shield, right, but the book
Speaker 1: starts with this really chilling story and it just bursts
Speaker 1: that whole bubble. Remember that trojan horse disguised as a
Speaker 1: UPS tracking email over ninety percent Oh yeah, of anti
Speaker 1: virus programs just missed it completely.
Speaker 2: That's a good point. Yes, it's a stark reminder that
Speaker 2: the threat landscape has become something much more sophisticated. We
Speaker 2: are now up against organized cybercrime, and these attackers are
Speaker 2: constantly evolving.
Speaker 1: It's like they're always testing our defenses, you know, probing
Speaker 1: for weaknesses.
Speaker 2: Absolutely, and it's.
Speaker 1: Not even just the external threats that we have to
Speaker 1: worry about, right, No, oh, of course not.
Speaker 2: Insider threats can be just as devastating, whether they're intentional
Speaker 2: or accidental. Even small oversights by trusted employees can have
Speaker 2: huge security implications.
Speaker 1: Huge. So if our old methods are just crumbling around us,
Speaker 1: how do we build a more resilient defense?
Speaker 2: That's the question, isn't it. Yeah, Well, the book highlights
Speaker 2: a really powerful approach called policy based monitoring.
Speaker 1: Okay, can you break that down for us?
Speaker 2: Yeah? Have you ever noticed how after you spot one
Speaker 2: cockroach in your kitchen, don't remind me, you suddenly see
Speaker 2: them everywhere. You start to think that every little scurrying
Speaker 2: shadow is a threat. Policy based monitoring is all about
Speaker 2: setting clear security policies like blueprints for our fortress, and
Speaker 2: then focusing our attention on the activity that violates those policies.
Speaker 1: So instead of trying to swat at every fly. We're
Speaker 1: setting traps exactly for the specific pests that pose the
Speaker 1: greatest danger.
Speaker 2: That's a great way to put it. This approach is
Speaker 2: often contrasted with blacklist monitoring, where you try to block
Speaker 2: all known bad traffic. Okay, blacklisting can be effective for
Speaker 2: certain threats, but it's kind of like trying to stop
Speaker 2: a flood with a single sandbag.
Speaker 1: Right, because the bad guys are always finding new ways
Speaker 1: to seep through the cracks exactly.
Speaker 2: And that's where anomaly monitoring comes in, Okay, looking for
Speaker 2: deviations from the norm. Gotcha, you know, those unusual ripples
Speaker 2: in the network pond. But as you can imagine, this
Speaker 2: can sometimes lead to a lot of false alarms.
Speaker 1: I can see that.
Speaker 2: Like mistaking a harmless fish for a shark.
Speaker 1: Right.
Speaker 2: So finding the right balance between those different approach is
Speaker 2: key to building a robust monitoring system.
Speaker 1: So it seems like we need a strong understanding.
Speaker 2: Of our network, absolutely like a.
Speaker 1: Detailed map of our digital terrain.
Speaker 2: We call this creating a network taxonomy.
Speaker 1: Okay, network taxonomy. It sounds kind of intimidating.
Speaker 2: Oh it's not that bad. Think of it more like
Speaker 2: a blueprint classifying and documenting different areas of your network. Gotcha,
Speaker 2: So you might have a heavily codified data center, Yeah,
Speaker 2: a more exposed DMZ, a network for your partners and
Speaker 2: vendors and so on. Makes sense. Each area has its
Speaker 2: own level of risk and will require a tailored approach
Speaker 2: to monitoring.
Speaker 1: So we're not just building a single wall. We're constructing
Speaker 1: multiple layers of defense based on the sensitivity of the
Speaker 1: information and systems.
Speaker 2: Now you're getting it, and this map, this network taxonomy
Speaker 2: is going to help you prioritize your monitoring efforts. It's
Speaker 2: about focusing on the crown jewels of your network. Okay,
Speaker 2: the areas that would cause the most damage if they
Speaker 2: were compromised.
Speaker 1: That makes sense. So we've got the blueprints, we've got
Speaker 1: the app. How do we actually choose which systems and
Speaker 1: data are those crown jewels that need that extra vigilance.
Speaker 2: There are two key analyses that can really help us here,
Speaker 2: business impact analysis and revenue impact analysis. They help us
Speaker 2: identify the systems that are absolutely essential for keeping the
Speaker 2: lights on and the cash flowing.
Speaker 1: So if these systems go down, it's not just a
Speaker 1: minor inconvenience. Yeah, it's a potential disaster exactly.
Speaker 2: And we also need to consider any regulatory requirements. So
Speaker 2: systems that handle financial data might fall under SOX, and
Speaker 2: those with personal information may need to comply with GLBA.
Speaker 2: Failing to protect these systems could lead to some pretty
Speaker 2: hefty fines and reputational damage.
Speaker 1: It's like having extra layers of security for the vault
Speaker 1: where we keep the most valuable asset exactly.
Speaker 2: Remember the example of Blanco Wireless in the book. They
Speaker 2: prioritize monitoring the systems that store sensitive customer data because
Speaker 2: that information is both valuable to attackers and heavily regulated.
Speaker 1: So we've laid the groundwork, we've defined our policies, mapped
Speaker 1: our network, and identified our crown jewels. How do we
Speaker 1: actually go about monitoring these areas? Where do we get
Speaker 1: that intel?
Speaker 2: That's where event sources come in. Okay, think of them
Speaker 2: like our surveillance cameras, the systems and devices that generate
Speaker 2: logs and alerts, providing those crucial breadcrumbs of activity.
Speaker 1: Like the story in the book about that hacker who
Speaker 1: tried to cover his tracks by disabling the audit trail.
Speaker 2: Oh yeah, classic tactic. Yeah, But thankfully we have ways
Speaker 2: to outsmart them. These event sources provide the footprints, the
Speaker 2: digital fingerprints, okay, that help us reconstruct events and track
Speaker 2: down suspicious activity.
Speaker 1: So what are some of the most valuable event sources
Speaker 1: that we should be tapping into.
Speaker 2: Network intrusion detection systems or nids are essential, okay. They
Speaker 2: act is our first line of defense, analyzing network traffic
Speaker 2: for any suspicious patterns.
Speaker 1: So they're constantly scanning the perimeter looking for signs of.
Speaker 2: A breach exactly. But they're not perfect, okay. An IDs
Speaker 2: can be tricky to tune, and they often generate false positives,
Speaker 2: like a.
Speaker 1: Motion detector that's triggered by a gust.
Speaker 2: Of wind exactly. So it's not just about deploying the tools,
Speaker 2: it's about knowing how to calibrate them and interpret the signals.
Speaker 1: And beyond the NIDS, what else is there?
Speaker 2: We have system logs, especially from servers running Unix or Linux.
Speaker 2: These logs provide a detailed record of user activity, log
Speaker 2: in attempts, file changes, and more.
Speaker 1: So we can see who's entering which rooms in our
Speaker 1: digital fortress and what they're doing there exactly.
Speaker 2: Windows servers can also be configured to provide valuable security
Speaker 2: logs and database logs can be incredibly revealing as well.
Speaker 2: How So, they can show us who access specific data,
Speaker 2: which is essential for detecting any potential breaches.
Speaker 1: So it's like having a separate set of logs for
Speaker 1: the vault, precise tracking who's handling the crown jewels.
Speaker 2: And then we have network devices like riders and firewalls.
Speaker 2: They give us a broader view of traffic patterns, showing
Speaker 2: the paths attackers might take to reach our most sensitive areas.
Speaker 1: So we're not just watching the doors, we're also monitoring
Speaker 1: the roads leading to our fortress exactly.
Speaker 2: But it's important to choose our event sources strategically. Trying
Speaker 2: to monitor everything is like trying to drink from a
Speaker 2: fire hose.
Speaker 1: You'll just drown.
Speaker 2: You'll drown in data and you'll miss those crucial signals.
Speaker 1: So we need to prioritize focusing on the sources that
Speaker 1: provide the most relevant information for our specific needs.
Speaker 2: Absolutely, it's all about finding the right balance between coverage
Speaker 2: and clarity. Now that we know what to monitor, let's
Speaker 2: talk about how to make sure that the data we
Speaker 2: receive is reliable.
Speaker 1: Right, we wouldn't want our surveillance cameras to be malfunctioning.
Speaker 2: Exactly. We'll delve into that next.
Speaker 1: It's like having this state of the art security system. Yeah,
Speaker 1: but the cameras are glitching and the motion detectors are faulty,
Speaker 1: we're not really getting the full picture.
Speaker 2: That's a great point. So how do we make sure
Speaker 2: our event feeds are reliable and our monitoring systems are
Speaker 2: running smoothly. What's all about maintenance and vigilance, okay, you know,
Speaker 2: ensuring that our fortress walls are always strong. One crucial
Speaker 2: step is establishing those clear service level agreements or slas,
Speaker 2: right with the teams that are responsible for maintaining those
Speaker 2: systems that feed us our data.
Speaker 1: So it's about having clear lines of communication and accountability, absolutely,
Speaker 1: making sure everyone's on the same page when it comes
Speaker 1: to keeping that data flowing exactly.
Speaker 2: Yeah, and we can't forget about monitoring the monitors.
Speaker 1: Oh right.
Speaker 2: It's like having a backup generator for our security system, okay,
Speaker 2: you know, making sure everything stays operational even if there's
Speaker 2: a power adage.
Speaker 1: The book mentions tools like naggios for this. It's like
Speaker 1: giving our security system its own health checkup.
Speaker 2: Christly, we can monitor CPU usage, memory, consumption, disc space,
Speaker 2: all those vital signs that tell us if our monitoring
Speaker 2: systems are working at peak performance.
Speaker 1: And there are other tools out there as well, of course.
Speaker 2: Each with its own strengths and weaknesses.
Speaker 1: So it's about finding the fit exact for your specific environment.
Speaker 2: That's a great way to put it. And speaking of
Speaker 2: real world applications, the book provides some fascinating case studies
Speaker 2: that really illustrate how all of this comes together.
Speaker 1: Yeah, those stories really bring the concepts to life, I agree,
Speaker 1: showing us those potential pitfalls in the triumphs of security
Speaker 1: monitoring and action.
Speaker 2: Absolutely. One that really sticks out to me is the
Speaker 2: story of Ryan and and Sullia Networks. They were piloting
Speaker 2: a new technology with a kind of risky setup, a
Speaker 2: proxy server connecting to their VoIP infrastructure over the public Internet,
Speaker 2: and Ryan was tasked with monitoring this, but they hadn't
Speaker 2: established those clear security policies beforehand.
Speaker 1: So even though his team was diligently monitoring event sources,
Speaker 1: yes they were essentially flying blind.
Speaker 2: They had all this data pouring in, but they didn't
Speaker 2: know what to look for.
Speaker 1: It's like having a security camera point at the wrong area.
Speaker 2: Exactly.
Speaker 1: You might capture a crime happening in the background, but
Speaker 1: you're going to miss the main event.
Speaker 2: And as a result, they weren't able to effectively mitigate
Speaker 2: those potential.
Speaker 1: Risks during the pilot. That highlights just how crucial it
Speaker 1: is to define those policies up front. Absolutely like creating
Speaker 1: a security checklist for our monitoring team.
Speaker 2: We need to know what normal looks like right before
Speaker 2: we can identify abnormal.
Speaker 1: Okay. Another case study that I found really insightful was
Speaker 1: Pam's experience at Special Electric. They had granted direct Internet
Speaker 1: access to an extra net partner, which, as you can imagine,
Speaker 1: is a little bit like leaving a side door to
Speaker 1: your fortress wide open.
Speaker 2: It is a little risky, and as Pam was.
Speaker 1: Monitoring that extrat environment, she started noticing some red flags
Speaker 1: like what things like peer to peer file sharing and
Speaker 1: traffic obfuscation using tor.
Speaker 2: Those are definitely signs that something's amiss, right.
Speaker 1: It's like seeing footprints leading into your fortress, but no
Speaker 1: record of anyone entering through the main gate. That does
Speaker 1: make you wonder, suggests that the partner might be up
Speaker 1: to no good, putting Special Electrics network at risk.
Speaker 2: This underscores the importance of not just monitoring your own network, right,
Speaker 2: but also the activities of your partners and vendors.
Speaker 1: Yeah, it's all interconnected these days.
Speaker 2: It is. It's like having security patrols not just inside
Speaker 2: your fortress, but also monitoring the surrounding areas for potential threats.
Speaker 1: Okay. Then there's Michael's work at Donata Okay, where he
Speaker 1: faced a different challenge.
Speaker 2: Oh what was that?
Speaker 1: A lack of network documentation. So it's like trying to
Speaker 1: defend a fortress without a map. Yeah, not knowing where
Speaker 1: the weak points are or how to navigate the defenses.
Speaker 2: You're just shooting in the dark.
Speaker 1: Exactly when it came to prioritizing and responding to those
Speaker 1: security events. But Michael, he took the initiative to actually
Speaker 1: document Danada's network. Good for him, creating a detailed map
Speaker 1: of all their subnets and systems.
Speaker 2: So he finally gave them the blueprints they needed.
Speaker 1: To effectively defend their fortress.
Speaker 2: And once they had that network context, they were able
Speaker 2: to fine tune their monitoring and improve their incident response significantly.
Speaker 1: It's a testament to the importance of knowing your terrain.
Speaker 2: It really is Another interesting example is Helen's work at
Speaker 2: Cisco Okay. She was bombarded with false positives from their
Speaker 2: NIDS because the alerts lacked network context.
Speaker 1: Imagine a motion detector going off every time a leaf
Speaker 1: blows by. Oh yeah, you'd quickly start ignoring it.
Speaker 2: You'd become desensitized to the alarms and miss the real threats.
Speaker 1: So what does she do? Well?
Speaker 2: Helen spearheaded a project to add that network context to
Speaker 2: those alerts. She integrated their NIDS with their IP address
Speaker 2: management system, which gave them a much clearer picture of
Speaker 2: what was happening.
Speaker 1: So now they could see not just that there was movement,
Speaker 1: but who or what was moving and where they were
Speaker 1: coming from precisely.
Speaker 2: And that dramatically reduced the number of false positives, which
Speaker 2: allowed them to focus on the alerts that truly mattered.
Speaker 1: It's like filtering out the noise so you can hear
Speaker 1: the whisper of an intruder exactly.
Speaker 2: These case studies really drive home the point that security
Speaker 2: monitoring is a dynamic process, one that requires constant adaptation
Speaker 2: and refinement.
Speaker 1: That's a set it and forget it solution.
Speaker 2: It's an ongoing cycle of planning, implementation, monitoring, analysis.
Speaker 1: And improvement and speaking of real world examples, the book
Speaker 1: also highlights some organizations that are doing security monitoring exceptionally well.
Speaker 2: They are, and one is kpnsert okay, the Computer Emergency
Speaker 2: Response Team for KPN, a Dutch telecommunications company. They face
Speaker 2: unique challenges because they need to comply with both Dutch
Speaker 2: and European Union laws which can limit certain types of monitoring.
Speaker 1: So they have to be extra creative and strategic in
Speaker 1: their approach exactly.
Speaker 2: But they've managed to build a robust security monitoring program
Speaker 2: that leverages a variety of event sources like what including
Speaker 2: an IDs, NetFlow and system logs. And they also place
Speaker 2: a strong emphasis on proactive red hunting.
Speaker 1: So it's not just about manning the walls, it's about
Speaker 1: sending out reconnaissance patrols to identify potential threats before they
Speaker 1: even reach the fortress.
Speaker 2: Another great example is Northrop Grummin Global Aerospace and Defense
Speaker 2: Technology Company.
Speaker 1: Given the sensitive nature of their work, they have a
Speaker 1: single dashboard that shows them the big.
Speaker 2: Picture exactly, and they go beyond simply reacting to events.
Speaker 2: They actually use the data to drive those proactive security improvements.
Speaker 1: Can you give you an example.
Speaker 2: Yeah, So they analyze trends in those security events to
Speaker 2: identify potential weaknesses in their systems and then prioritize patch deployments.
Speaker 1: So they're not just patching holes, they're reinforcing the weakest
Speaker 1: points in their fortress walls.
Speaker 2: Based on real time intelligence. And they don't stop there.
Speaker 2: They use the data to inform their risk assessments and
Speaker 2: develop that targeted security awareness training for their employees.
Speaker 1: So it's about building a culture of security, yes, from
Speaker 1: the ground up.
Speaker 2: These examples really show how security monitoring can be much
Speaker 2: more than just a defensive measure. It can be a
Speaker 2: powerful tool for driving continuous improvement and strengthening your overall
Speaker 2: security posture.
Speaker 1: It's like turning data into those actionable insights, exactly, transforming
Speaker 1: that raw information into a shield that protects your organization
Speaker 1: from harm. It's like having a crystal ball that shows
Speaker 1: us not just what's happening, but also what might happen
Speaker 1: in the future, Yeah, allowing us to anticipate and mitigate
Speaker 1: those threats before they even strike.
Speaker 2: And the best part is you don't need a massive
Speaker 2: budget or a huge team of security experts to get started.
Speaker 2: The book emphasizes that even small steps can make a
Speaker 2: big difference.
Speaker 1: So it's about building that security monitoring fortress, one brick
Speaker 1: at a time.
Speaker 2: Absolutely, start by defining some basic security policies, even if
Speaker 2: they're just a few pages long. Identify your most critical assets,
Speaker 2: those crown jewels you absolutely can't afford to lose, and
Speaker 2: then select a few key event sources to monitor, focusing
Speaker 2: on the areas where you're most vulnerable.
Speaker 1: So prioritize, focus on the most impactful actions rather than
Speaker 1: trying to do everything at once.
Speaker 2: And don't be afraid to seek out help and guidance
Speaker 2: from experts. Yeah, there are tons of resources available, like
Speaker 2: what you Know, books like the one we've been discussing,
Speaker 2: online forums, security conferences.
Speaker 1: It's like having a security consultant on call exactly ready
Speaker 1: to answer your questions and guide you through the process.
Speaker 2: And don't underestimate the power of community.
Speaker 1: Oh right, you know.
Speaker 2: Connect with other security professionals. Yeah, share your experiences and
Speaker 2: learn from their mistakes and their successes.
Speaker 1: It's like having this network of allies all working together
Speaker 1: to strengthen their defenses against a common enemy.
Speaker 2: So as we wrap up this deep dive, okay, I'd
Speaker 2: like to leave our listener with this thought, hit me
Speaker 2: with it. You've now had a glimpse into the world
Speaker 2: of network security monitoring. You've learned about the essential elements,
Speaker 2: the strategies, the tools. Now the question is how will
Speaker 2: you apply this knowledge to your own organization. What are
Speaker 2: some of the unique challenges you might face, and how
Speaker 2: will you overcome them?
Speaker 1: That is a fantastic question for listeners to ponder. It
Speaker 1: is it's like we've given them the building blocks for
Speaker 1: their security monitoring fortress, and now it's up to them
Speaker 1: to assemble those blocks into a structure that meets their
Speaker 1: specific needs.
Speaker 2: Security is not a destination, it's a journey. It's an
Speaker 2: ongoing process, yes, of learning, adapting, and evolving to stay
Speaker 2: one step ahead of the attackers.
Speaker 1: Well said, thanks for joining me on this deep dive.
Speaker 2: Of course, it's been a fascinating exploration of a really
Speaker 2: critical topic has and to our listener, we hope this
Speaker 2: deep dive has given you a solid foundation in network
Speaker 2: security monitoring. Keep learning, keep experimenting, and keep building those defenses.