Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 1 Managing Network Threat Information  Giri Raichur, Network Services Team  Jim Clifford, TL, Network Services Team  Current implementation, future directions and opportunities for inter- laboratory collaboration.

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 2 Managing Network Threat Information  Network threats - viruses, phishing attacks, malware etc.  Availability of alert information  Incorporating information into network control points

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 3 How CSIRT manages threat information Uses mySQL database with a web front end. Host IP addresses and domains names of attack sites are propagated to DNS servers, firewalls and proxies and blocked within minutes. The central repository and automatic updates allow CSIRT staff to manage blocking information without relying on system and network administration experts Web requests to blocked sites are redirected to an informative web page. The database helps support staff troubleshoot connectivity problems.

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 4 Sources of threat information US-CERT, DOE-CIRC Local intelligence

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 5 Current Implementation

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 6 Black Hole Interface Uses a python API written to be shared by several different blocking mechanisms. The API tracks the change history. History Reads of the rule list can be done without the API. Blocks automatically expire.

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 7

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 8 DNS BlackHole Interface

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 9 Firewall Interface

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 10

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 11 Advantages of using LANL’s approach The authoritative data resides in one central database The access control lists are pushed/pulled into various control points Access information is “standardized” Easy to use user interface Authorized user can add/delete without knowing formats for specific applications like DNS and IPtables Changes are near real time New control points can be added easily to use existing access information Access information is available to help desks and other support staff Access information can be audited and tested

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 12 Future direction Federated access policies using "TNC IF-MAP protocol"

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 13 What is IF-MAP? IF-MAP describes a database that contains metadata about systems and users currently connected to a network. Uses a publish/subscribe model, where all the network and security applications can participate in updating and querying the IF-MAP server XML-based protocol that uses SOAP (Simple Object Access Protocol) specification as defined ty the W3C Published in May 2008 by the Trusted Computing Group Freely available for anyone to implement Growing base of vendor and product support Aggregates real-time information from various sources. Uses both standard data types and vendor-specific extensions

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 14 IF-MAP Makes it Easy for Devices and Systems to Share Data

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 15 Further discussions Fast response to immediate threats is not unique to LANL What do other sites do? How can we minimize redundant access lists based on inter-site intelligence instead of each site maintaining that list? How can we share data that is useful and timely? Any interest in a collaborative effort?