CIPSEC Framework components: XL-SIEM CIPSEC workshop Frankfurt 16/10/2018 Rodrigo Díaz Rodríguez, ATOS Antonio Álvarez Romero, ATOS Co-funded by the Horizon 2020 Framework Programme of the European Union

The anomaly detection process Security monitoring sensors XL-SIEM Outline The anomaly detection process Security monitoring sensors XL-SIEM

The anomaly detection process SENSORS XL-SIEM

Security monitoring sensors A sensor is a software entity capable of processing and analysing information, eventually producing a useful output. Depending on where the information is collected: There are sensors collecting information about the network activity (network layer sensors). They work at the IP level, with data in transit. There are sensors collecting information from the applications installed in a certain machine (application layer sensors). They work with data prior to transmission of after reception. Sensors do not perform highly complex processes over the information they collect, they are based on rather simple calculations that permit to obtain a first level of aggregation.

Security monitoring sensors (II) Sensors send their logs to an entity called Cyber Agent. This entity can be compatible to a wide range of sensors. The agents have modules called plugins making posible to “understand” the data coming from the different sensor types. Plugins interpret the logs related to certain types of events. There are as many plugins as number of sensors types to use. Plugins produce events which are normalized prior to be sent to the XL-SIEM.

Security monitoring sensors (III)

Security monitoring sensors (IV) Some types of sensors: Suricata: Network Intrusion Detection System. OSSEC: Host Intrusion Detection System. DNS Traffic Sensors: detect anomalies in the DNS Traffic. Cowrie honeypot: attract attackers so as to detect their presence. Nagios: Network / systems status monitoring Daemon. Netflow: network Flow information.

Security monitoring sensors (V) Some attacks detected Denial of Service. Distributed Denial of Service (botnets). Port Scanning. Brute Force Attack. SQL injection. Suspicious files (trojan). USB detection. Rootkits. Fastflux attacks. Other events High number of network connections. High/low network speeds. Port connections.

XL-SIEM Security Information Event Management (SIEM) solution with added high-performance correlation engine to deal with large volumes of security information. Built on top of the Open Source SIEM OSSIM. The objective of this asset is the detection of security threats. It plays the role of anomaly detection reasoner. It normalizes, filters and correlates information coming from heterogeneous sources. It obtains valuable insights about the cyber climate of the monitored infrastructure. Starting with huge amounts of data, this asset produces meaningful events and then raises alarms following complex event correlation rules.

XL-SIEM (II)

XL-SIEM (III)

Sophisticated real-time security analysis technology. XL-SIEM (IV) Main features: Sophisticated real-time security analysis technology. Highly interoperable, scalable and elastic, security events processing through a cluster of nodes. Cross-layer: convergence of physical and cybersecurity. Capacity to raise security alerts. Detection capabilities at the Edge: possibility of deploying agents on Raspberry Pi platforms. Smart detection capabilities such as behavioral analysis of IoT devices.

Sharing of threat intelligence XL-SIEM (V) Innovation lines Sharing of threat intelligence Having previously anonymized the information, sharing information among organizations by means of common formats. STIX(Security Threat Information eXchange). TAXII (Trusted Automated eXchange of Indicator Information). CYBOX (CYBer Observable eXpression). Helps solve the lack of cooperation / Coordination when managing incidents.

Innovation lines Legacy systems XL-SIEM (VI) Innovation lines Legacy systems Closer monitoring of outdated, old-fashioned systems, difficult to evolve and very vulnerable, but very common in critical infrastructures. Patching these assets lead to issues related to loss of certification and compliance. Detect critical events affecting legacy systems and leveraging a selected group of sensors and rules to watch over outdated systems.

Avoid excess of information about alerts. Avoid false positives. XL-SIEM (VII) Innovation lines Behavioural analysis Avoid excess of information about alerts. Avoid false positives. Make reports and analysis simpler. Identify normal behaviour patterns to confront with abnormal ones. Use of machine learning techniques to achieve this. Ease of deployment Automated incorporation of new clients / infrastructures Automated deployment of sensors / agents and connection to the XL-SIEM server side

High number of network connections Malware event MySQL connection XL-SIEM (VIII) Some events examples Port scanning TCP connection WiFi connection High number of network connections Malware event MySQL connection High network load detected Slow network speed Some alarms examples Man in the Middle attack Brute Force attack DoS attack Phishing attack Malware detected Malicious site blocked Connection attempt against SQL services

Fitting in the architecture

Thanks for your attention! Questions? Contact: Antonio Álvarez ATOS antonio.alvarez@atos.net Rodrigo Díaz ATOS rodrigo.diaz@atos.net Rubén Trapero ATOS ruben.trapero@atos.net www.cipsec.eu @CIPSECproject https://www.linkedin.com/in/cipsec-project/ https://www.youtube.com/channel/UCekxicSFAwZdIPAV3iLHttg CIPSEC Technical Review Meeting Barcelona 22/11/2017