Speaker 1: Welcome back. Everyone, ready to dive into some serious network security.
Speaker 2: Absolutely, let's get practical.
Speaker 1: Today's deep dive is all about intrusion analysis, and we're
Speaker 1: using practical intrusion analysis by doctor Stevenol as our guide.
Speaker 2: Great choice. Doctor Nol really gets into the nitty gritty before.
Speaker 1: We get to the fund stuff, the intrusions. We need
Speaker 1: to make sure everyone's on the same page about how
Speaker 1: networks work. The fundamentals.
Speaker 2: Yeah, the foundation. I think the most crucial network fundamental
Speaker 2: is understanding how data actually travels across networks. Think about
Speaker 2: it like this, Okay, I'm listening. Imagine each little piece
Speaker 2: of data is like a digital envelope, right, Each packet
Speaker 2: needs a clear address to get where it needs to go, like.
Speaker 1: A digital postal service. So that's where IP addressing comes in.
Speaker 2: Exactly. Each device has its own unique address, either IPv
Speaker 2: four or that newer.
Speaker 1: IPv six ray I've heard of those.
Speaker 2: And then these IP addresses are all structured and organized
Speaker 2: through subnetting. Subnetting, Yeah, think of it like dividing a
Speaker 2: city into neighborhoods makes things easier to manage in more secure.
Speaker 1: Makes sense, But how do we actually see this data
Speaker 1: moving around.
Speaker 2: We use tools called packet sniffers. They're like little windows
Speaker 2: into the network traffic, so.
Speaker 1: We can peek inside those digital envelopes exactly.
Speaker 2: But we can't just plug in anywhere. We need to
Speaker 2: use special techniques to access those packets.
Speaker 1: What kind of techniques, Well.
Speaker 2: There's SPAN and tappeece. Span is kind of like making
Speaker 2: a copy of the data stream, and tapps are like
Speaker 2: a dedicated connection to that traffic.
Speaker 1: So SPAN copies tfps connect directly. Got it. I see
Speaker 1: how knowing this is crucial for intrusion analysis onto the intrusions.
Speaker 2: Intrusion detection systems or idss are the next step. They
Speaker 2: are always on the lookout for anything suspicious on your network, like.
Speaker 1: Two hundred and forty seven security guards, but for our
Speaker 1: data exactly.
Speaker 2: And there are two main types of idss, signature based
Speaker 2: and anomaly based.
Speaker 1: That's the difference.
Speaker 2: Signature based IDs are like fingerprint scanners. They compare the
Speaker 2: network traffic against a huge database of known attacks.
Speaker 1: Looking for those telltale signs.
Speaker 2: Yeah, and then anomaly based IDs are more like behavioral analysts.
Speaker 2: They look for anything that deviates from normal network activity.
Speaker 1: So if something is acting out of character, they notice
Speaker 1: it right.
Speaker 2: It's super useful for detecting brand new attacks, ones we've
Speaker 2: never seen before.
Speaker 1: That's amazing. But attackers are always trying to stay one
Speaker 1: step ahead, aren't they.
Speaker 2: They are, and they have all sorts of tricky techniques
Speaker 2: to evade detection by those idss like what Well. One
Speaker 2: clever tactic is TCP stream reassembly manipulation TCP bracedown data
Speaker 2: into smaller segments for transmission.
Speaker 1: OK.
Speaker 2: Attackers can mess with those segments, making it hard for
Speaker 2: the IDs to put the pieces back together and see
Speaker 2: what's really going on.
Speaker 1: Tricky, So how do we deal with that?
Speaker 2: That's where target based ressembly comes in. It tries to
Speaker 2: reconstruct the network traffic as seen by the target system itself,
Speaker 2: even with all the attackers' manipulation.
Speaker 1: Like solving a puzzle, but you can still see the
Speaker 1: picture on the box exactly.
Speaker 2: It helps us see the true nature of the attack.
Speaker 1: So are there any ideas that use this target based reassembly?
Speaker 2: Oh? Yeah, Snort and bro are two great examples. They
Speaker 2: are both open source too.
Speaker 1: I think I've heard of snort. It's signature based, right
Speaker 1: it is.
Speaker 2: Snort is super flexible and it is a huge rule
Speaker 2: set that can be customized to fit your specific needs.
Speaker 1: Wow, a customizable security card. So how do you write
Speaker 1: these Snort signatures?
Speaker 2: Well, there are a few different techniques. One is called
Speaker 2: unique string matching, where you look for a really specific
Speaker 2: pattern in the network traffic.
Speaker 1: So like a secret phrase exactly.
Speaker 2: Another technique is know the vulnerability. The signature focuses on
Speaker 2: the exact conditions that allow a certain exploit to work.
Speaker 2: You have to know how the attacker does it to
Speaker 2: write it.
Speaker 1: I see. So it's about understanding the attackers' methods and
Speaker 1: then targeting those weaknesses.
Speaker 2: You got it. And Snort even has a special feature
Speaker 2: called flow bits to track the state of a session,
Speaker 2: so you can get really granular with your detection.
Speaker 1: Pretty neat. So what about BRO? What's its specialty?
Speaker 2: Bro is anomaly based. Instead of just looking for patterns,
Speaker 2: it tries to understand the bigger picture of network behavior.
Speaker 1: So it's more like a detective piecing together clues.
Speaker 2: Yeah, more like Schrolock Holmes. Plus it has amazing scripting capabilities.
Speaker 2: You can set it up to take specific actions based
Speaker 2: on certain events.
Speaker 1: So Bro is the detective and Snore is the security guard.
Speaker 2: I like that, but to really fight back. We need
Speaker 2: to understand how these attackers find their targets.
Speaker 1: Let's get into their heads.
Speaker 2: Knowing the vulnerability life cycle is key. Every vulnerability goes
Speaker 2: through a whole process, you know, from discovery to disclosure
Speaker 2: and then will attackers start creating exploits.
Speaker 1: So it's a race against time to fix those vulnerabilities
Speaker 1: before the bad guys exploit them.
Speaker 2: Exactly. It's like a constant cat and mouse game. Doctor
Speaker 2: Noel has a really good example of the book. He
Speaker 2: walks us through a vulnerability in a file download application.
Speaker 2: What's the application, It's called flashcat. He uses tools like
Speaker 2: TCP dump and wire shark to break down the exploit.
Speaker 2: They're like digital Mega to find glasses.
Speaker 1: I like that.
Speaker 2: What happens He shows you how to create a snort
Speaker 2: signature that could actually catch this specific attack. And it's
Speaker 2: not just about detecting it, it's about understanding exactly how
Speaker 2: the vulnerability works.
Speaker 1: To create a targeted defense.
Speaker 2: You got it. And this brings us to a huge
Speaker 2: part of network security these days, Web application firewalls were WEFs.
Speaker 1: Oh yeah, doubles. I've been wanting to learn more about
Speaker 1: those Web applications are.
Speaker 2: Everywhere they are and weefs are like having security guards
Speaker 2: specifically for your web applications. They filter out all that
Speaker 2: malicious traffic.
Speaker 1: So they protect those vulnerabilities and web apps that we
Speaker 1: hear so much about.
Speaker 2: Exactly. You know about the oas top ten right.
Speaker 1: Yeah, the top ten web app vulnerability.
Speaker 2: Oh right, cross site scripting, squel injection, file injection, all
Speaker 2: those nasty things WEFs help protect against them.
Speaker 1: Makes sense, But why can't regular ideas do that.
Speaker 2: They are designed to understand web application protocols and traffic
Speaker 2: the same way WEFs are.
Speaker 1: Ah, they need that specialized knowledge exactly.
Speaker 2: WEFs can actually look at the age TTP requests and
Speaker 2: responses and spot suspicious patterns or known attack signatures.
Speaker 1: And then block them, right yep.
Speaker 2: They can also enforce different security policies. There's the positive
Speaker 2: security model, which only allows known good.
Speaker 1: Traffic, so only the good guys get in, exactly.
Speaker 2: Yeah. Then there's the negative security model, blocking known bad traffic.
Speaker 2: And there's even a learning mode where the wife observes
Speaker 2: normal behavior and learns to flag anything unusual.
Speaker 1: So it learns what normal looks like.
Speaker 2: Exactly, a lot of people use mod security. It's a
Speaker 2: pretty popular open source whaff waves.
Speaker 1: Are really interesting, so much to learn. But web aaps
Speaker 1: aren't the only thing we need to worry about, right, Nope.
Speaker 2: Wireless networks have their own set of challenges. They can
Speaker 2: be way more vulnerable.
Speaker 1: I can see that no wires to tap into exactly.
Speaker 2: That's where wireless intrusion detection and prevention solutions come in.
Speaker 2: Wireless idsps, so.
Speaker 1: Like a special security system just for wireless nets.
Speaker 2: We've got it. There are two main types, access point
Speaker 2: based and dedicated sensors.
Speaker 1: That's a difference.
Speaker 2: Access Point based solutions monitor traffic from the access points perspective.
Speaker 2: Dedicated sensors passively listen for wireless activity like little spies.
Speaker 1: Sounds sneaky. So what kind of wireless threats are out
Speaker 1: there or what should we watch out for?
Speaker 2: Rogue access points are a big one. Someone could set
Speaker 2: up a fake access point to trick people into.
Speaker 1: Connecting and then steal their data.
Speaker 2: You got it. Then there's reconnaissance and cracking tools. Attackers
Speaker 2: use them to gather information about your network and try
Speaker 2: to break your encryption.
Speaker 1: And then there's man in the middle attacks.
Speaker 2: You know it. Someone secretly positions themselves between two devices
Speaker 2: to intercept and potentially manipulate the communication.
Speaker 1: So it's like they're eavesdropping and changing the messages exactly.
Speaker 2: But there are ways to fight back. Hike isolation techniques
Speaker 2: can restrict access for unauthorized devices, and location detection methods
Speaker 2: can use signal strength to pinpoint where threats are coming
Speaker 2: from so.
Speaker 1: We can find them and stop them.
Speaker 2: You got it. It's all about being proactive.
Speaker 1: So I've talked about digital security, but what about physical security?
Speaker 1: That old school stuff.
Speaker 2: Ah, great point, It's easy to overlook, but it's still
Speaker 2: so important. And you know what, physical and cybersecurity are
Speaker 2: kind of blending together these days. How So, take physical
Speaker 2: access control systems or paycs. They use things like RFID,
Speaker 2: smart cards, and IP enabled video surveillance to control who
Speaker 2: can physically access certain areas.
Speaker 1: So it's not just about locks and keys anymore.
Speaker 2: Nope, we're using technology to manage access in both the
Speaker 2: physical and digital worlds.
Speaker 1: That's really interesting.
Speaker 2: Imagine someone tries to get into a secure area using
Speaker 2: a stolen ID card. An integrated system could instantly trigger
Speaker 2: an alert in the network security system.
Speaker 1: The security guards could stop them right away.
Speaker 2: Exactly. Physical and digital security working together.
Speaker 1: It's like a security dream team.
Speaker 2: Okay, I think I'm started to see how those two
Speaker 2: worlds are blurring.
Speaker 1: They are. And there's one more area I want to
Speaker 1: talk about. One I find really fascinating. Geographic intrusion detection
Speaker 1: or GID.
Speaker 2: Okay, GID, I don't think I've heard of that before.
Speaker 1: The ID takes geographic information systems or GIS and combines
Speaker 1: it with security data, so now we can understand and
Speaker 1: track attacks geographically, so like.
Speaker 2: We can actually see where the attacks are coming from
Speaker 2: on a map exactly.
Speaker 1: It gives you a whole new perspective. It's like having
Speaker 1: a bird's eye view of the digital battlefield.
Speaker 2: I love that analogy. Okay, tell me more about GID.
Speaker 1: Well, there's this key concept in GID called the cornerstone theory.
Speaker 2: Cornerstone theory, it's the idea that attackers leave geographic footprints.
Speaker 2: You can track their scanning and attack patterns, and it
Speaker 2: all ties back to certain locations.
Speaker 1: So like a trail of digital breadcrumbs, but on a
Speaker 1: map exactly.
Speaker 2: And we use the different geolocation techniques to track those attackers.
Speaker 1: Okay, Like what.
Speaker 2: There are IP based geolocation databases that try to connect
Speaker 2: IP addresses to physical locations. Then there are DNSLC records
Speaker 2: which try to add location information to the dome name system.
Speaker 1: So we know where those domains are based.
Speaker 2: Yeah. And then there's trace root analysis. We can map
Speaker 2: out the path of data packets as they hop across
Speaker 2: the network, and that can often lead us back to
Speaker 2: a physical.
Speaker 1: Location, so it's like following the data trail exactly.
Speaker 2: And finally there's multilateration. It uses network latency to estimate
Speaker 2: an attacker's geographic location.
Speaker 1: So we're using the speed of the Internet to track
Speaker 1: them down.
Speaker 2: Pretty much. It's all very sophisticated.
Speaker 1: Stuff I can imagine, but if you can master these techniques,
Speaker 1: they can be incredibly powerful tools.
Speaker 2: They can. Doctor Noel has a really interesting case study
Speaker 2: in the book. He shows how GID can be used
Speaker 2: to uncover a really complex attack, one that traditional security
Speaker 2: tools might have completely missed.
Speaker 1: That's incredible. So it's like having a secret weapon.
Speaker 2: It can be, yeah, but like any weapon, you need
Speaker 2: to know how to use it right.
Speaker 1: Knowledge is power. Well, I think we've covered a ton
Speaker 1: of ground in this first part of our deep dive.
Speaker 2: We have networking fundamentals, intrusion detection, web application firewalls, even
Speaker 2: geographic intrusion detection.
Speaker 1: The world of network security is.
Speaker 2: Vast, it is and it's always changing, but I think
Speaker 2: we gave our listeners a good overview of the basics.
Speaker 2: You know, sometimes I think we security folks get so
Speaker 2: focused on all the technical stuff that we forget something
Speaker 2: really important. That's a communicating our findings, Like we understand
Speaker 2: all these complex concepts. Yeah, but explaining it to someone
Speaker 2: who's not a security expert, well.
Speaker 1: Yeah, that can be tough, especially when you're dealing with
Speaker 1: mountains of data and technical jargon.
Speaker 2: Right. That's why I love data visualization. It's like taking
Speaker 2: all those messy logs and security events and turning them
Speaker 2: into something anyone can understand.
Speaker 1: So instead of staring at spreadsheets, we can actually see
Speaker 1: what's happening, spot patterns, trends, things like that.
Speaker 2: Exactly. It's like having a map that guides you through
Speaker 2: a complex landscape. You can see the big picture and
Speaker 2: also zoom in on specific details.
Speaker 1: Okay, I like that analogy. So what kinds of visualizations
Speaker 1: are particularly helpful in the security world, Well, it.
Speaker 2: Really depends on the data and what we're trying to show.
Speaker 2: Line charts are great for showing trends over time, like
Speaker 2: how many attacks you've seen.
Speaker 1: In the past month, right, easy to see if things
Speaker 1: are getting better or worse exactly.
Speaker 2: And bar charts are really good for comparing different things,
Speaker 2: like different types of attacks.
Speaker 1: Okay, so different charts for different purposes. What if you
Speaker 1: want to see the relationship between two things.
Speaker 2: Scatterplots are perfect for that. They can show you if
Speaker 2: there's a correlation, like if a certain type of attack
Speaker 2: is more common on certain days of the week. And
Speaker 2: then you have heat maps. They're amazing for visualizing things
Speaker 2: like density or.
Speaker 1: Distribution, so we could see where the attacks are concentrated,
Speaker 1: like a heat map of the network exactly.
Speaker 2: It helps you quickly identify the hotspots.
Speaker 1: So many cool visualizations. Are there any tools or frameworks
Speaker 1: that are particularly helpful for creating these?
Speaker 2: Yeah? Tons, there's SVIs, this Secure Visual Information system. It's
Speaker 2: great for visualizing security data in a way that's easy
Speaker 2: to understand.
Speaker 1: What else?
Speaker 2: Vizmet developed Etri is another good one. It's really good
Speaker 2: for visualizing network traffic in real time.
Speaker 1: Real time.
Speaker 2: Yeah, and then there's Splunk, which is probably the most popular.
Speaker 2: It can handle huge amounts of data from all sorts
Speaker 2: of sources.
Speaker 1: I've heard a splunk. So many great options, but I'm
Speaker 1: curious how would we use these visualizations in a real
Speaker 1: world scenario.
Speaker 2: Let's say you're doing a security audit for a big company.
Speaker 2: You've got tons of data from firewalls, intrusion detection systems,
Speaker 2: vulnerability scans, everything.
Speaker 1: Mountains of data.
Speaker 2: Exactly, and you have to present your findings to a
Speaker 2: bunch of people, some technical, some not trying to explain
Speaker 2: it all with words and spreadsheets.
Speaker 1: YEI yeah, that would be a nightmare.
Speaker 2: But with data visualization, it's a whole different story. You
Speaker 2: can create these compelling visuals that show the company's security
Speaker 2: posture in a way that everyone can understand.
Speaker 1: So you're not just giving them data, You're telling them
Speaker 1: a story exactly.
Speaker 2: You could use a heat map to show them where
Speaker 2: the most suspicious activity is happening on their network. You
Speaker 2: could use bar charts to compare their security to industry standards.
Speaker 1: Ah, so they can see where they need to improve.
Speaker 2: You got it. It's way more effective than just giving
Speaker 2: them a dry technical report. Plus it makes it easier
Speaker 2: to get buy in for security improvements, right.
Speaker 1: Because they can actually see.
Speaker 2: The risks exactly. Speaking of which, let's talk about the
Speaker 2: business side of security.
Speaker 1: Oh yeah, the money. How do we justify investing in
Speaker 1: all the security stuff?
Speaker 2: That's a great question. In today's world, you have to
Speaker 2: show the value of every investment. Security is no different.
Speaker 1: So how do we do that?
Speaker 2: Well, first, we need to understand the cost of a
Speaker 2: security breach, and there's more to a thing you might think,
Speaker 2: like what. There are the direct costs, of course, things
Speaker 2: like losing data, having to recover your systems, legal fees,
Speaker 2: and maybe even findes if you didn't follow regulations.
Speaker 1: That adds up quickly, it does.
Speaker 2: But then there are the indirect costs. Those are harder
Speaker 2: to measure but can be just as bad. Give me
Speaker 2: an exampletation. Think about what happens when a company has
Speaker 2: a big data breach. People lose trust, they might not
Speaker 2: want to do business with you anymore.
Speaker 1: Right, You lose customers and maybe even potential investors.
Speaker 2: Exactly so, the cost of a breach goes way beyond
Speaker 2: just the immediate financial hit. You have to factor in
Speaker 2: the long term impact on your brand and your relationship
Speaker 2: with customers.
Speaker 1: It's about the big picture, it is, and.
Speaker 2: That's why it's so important to make a strong business
Speaker 2: case for security. Investments. We need to move away from
Speaker 2: the fear tactics and focus on the data. Show them
Speaker 2: the numbers.
Speaker 1: Okay, so how do we present a good business case?
Speaker 2: Well, there are a few financial tools we can use.
Speaker 2: ROI is a common.
Speaker 1: One, Return on investment. I've heard of that one.
Speaker 2: It's about measuring how profitable an investment is. And then
Speaker 2: there's net present value or MPV, which takes into account
Speaker 2: the time value of money.
Speaker 1: Okay, I'm following. What else?
Speaker 2: And then there's the internal rate of return or IRR.
Speaker 2: It calculates how profitable an investment is over time.
Speaker 1: So it can show them how investing in security will
Speaker 1: pay off in the long run exactly.
Speaker 2: And as we see more and more cyber attacks, there's
Speaker 2: another tool that's becoming really important. Cyber liability insurance.
Speaker 1: Cyber liability insurance, what's that.
Speaker 2: It's like a safety net for businesses. Yeah, if you
Speaker 2: get hit with a cyber attack, this insurance can help
Speaker 2: cover the costs things like those legal fees we talked about,
Speaker 2: notification expenses, credit monitoring for your customers, maybe even some
Speaker 2: of those fines.
Speaker 1: So it helps you recover financially from an attack.
Speaker 2: You got it. It's becoming a must have for any
Speaker 2: business that's serious about security.
Speaker 1: This whole discussion about the business side of security has
Speaker 1: been really eye opening.
Speaker 2: I'm glad to hear that it's not just about the technology,
Speaker 2: it's about the business impact.
Speaker 1: And I see how data visualization can really help bridge
Speaker 1: that gap between the technical folks and the business folks,
Speaker 1: help everyone understand the risks and the opportunities exactly.
Speaker 2: When you can visualize the data, it becomes a lot
Speaker 2: more real and a lot easier to grasp.
Speaker 1: Well, I think we've covered a lot of ground in
Speaker 1: the second part of our deep dive datuation the financial
Speaker 1: side of security, cyberliability, insurance, it's all connected.
Speaker 2: It is. Doctor Noel really makes you think about security
Speaker 2: from a different perspective.
Speaker 1: It does security is an investment, not just an expense.
Speaker 1: But let's take a break for now and absorb all
Speaker 1: this information. We'll be back soon to wrap up our
Speaker 1: deep dive into practical intrusion analysis. Welcome back. So we've
Speaker 1: talked about all these great tools and techniques, but how
Speaker 1: do we actually put all of this into practice. How
Speaker 1: do we create a solid security plan?
Speaker 2: Well, that's where security standards and frameworks come in. Think
Speaker 2: of them like blueprints for building a secure network.
Speaker 1: Blueprints okay, yeah.
Speaker 2: They give you a structured approach, a roadmap for implementing
Speaker 2: all the security measures. One of the most well known
Speaker 2: is the ISO twenty seven zero zero one two seven
Speaker 2: zero zero series. It covers a ton of.
Speaker 1: Ground, so it's like a comprehensive guide to information security.
Speaker 2: You got it. And then there are industry specific frameworks
Speaker 2: like the PCIDSS, the Payment Card into Street Data Security Standards.
Speaker 1: Oh yeah, pci DSS, I've heard of that one. It's
Speaker 1: all about protecting credit card data, right.
Speaker 2: That's the one. If you handle credit card information, you
Speaker 2: got to follow those rules. It's all about preventing data
Speaker 2: breaches and fraud.
Speaker 1: Makes sense. So these frameworks that are like essential tools
Speaker 1: for any organization that wants to take security seriously.
Speaker 2: Absolutely, But there's a catch. They're not one size fits all.
Speaker 2: Every organization is different with its own unique needs. You
Speaker 2: got to find the right framework or adapt it to
Speaker 2: fit your specific circumstances.
Speaker 1: So it's not just about following the rules blindly. You
Speaker 1: got to be smart about it.
Speaker 2: That's where security experts can really help. They can guide
Speaker 2: you through the process, make sure you're doing everything right
Speaker 2: and create a custom security program that actually works for you.
Speaker 1: It's like having a security coach.
Speaker 2: Exactly, someone who's been there, done that. And remember, security
Speaker 2: is not a one time thing. It's a journey.
Speaker 1: Right. Technology keeps changing, New threats pop up all the time.
Speaker 1: We have to be ready to adapt, you got it.
Speaker 2: We have to stay informed about new vulnerabilities, new tack techniques,
Speaker 2: new best practices. It never stops.
Speaker 1: And that's why resources like doctor Newell's book are so valuable.
Speaker 1: It gives you a solid foundation in security and practical
Speaker 1: advice you can actually use even as things change.
Speaker 2: I agree, whether you're a seasoned pro or just starting out,
Speaker 2: practical intrusion analysis is a great place to start.
Speaker 1: I know some people are intimidated by cybersecurity. It seems
Speaker 1: so complex and technical. Where do you even begin?
Speaker 2: I know what you mean. It can definitely seem overwhelming
Speaker 2: at first, but honestly, there are so many resources out
Speaker 2: there to help you. Online courses, certifications, conferences, and don't
Speaker 2: forget about books like the one we've been talking about right.
Speaker 1: So many ways to learn, and don't underestimate the power
Speaker 1: of community. There are amazing online forums and groups where
Speaker 1: security people share their knowledge and support each other.
Speaker 2: You learn so much from other people's experiences. Cybersecurity is
Speaker 2: a team sport.
Speaker 1: Well said, we've come to the end of our deep
Speaker 1: dive into practical intrusion analys It's been a fascinating journey,
Speaker 1: hasn't it.
Speaker 2: It really has. We've covered so much ground, from the
Speaker 2: basics of networking to all those advanced techniques like GID,
Speaker 2: and we even talked about the business side of security.
Speaker 1: I hope our listeners feel empowered to take control of
Speaker 1: their own security.
Speaker 2: I hope so too.
Speaker 1: Remember knowledge is power, Stay curious, stay informed, and stay vigilant.
Speaker 1: The world of cybersecurity is waiting for you.
Speaker 2: And keep tuning in to the Deep Dive for more
Speaker 2: deep dives into the world of technology.
Speaker 1: Until next time.