1
Q
Network Analyst
A
Cyber operator whose main focus is infrastructure devices & netflow. Responsible for handling cyber incidents, network security
2
Q
What are the benefits of a network analyst?
A
In depth knowledge of common network protocols, packet formats, & infrastructure security vulnerabilities
3
Q
Network Baseline
A
Defines what is normal for enterprise netflow and ports, protocols & services used at a predetermined level
4
Q
What are the benefits of a network baseline?
A
- Allows for anomalous or abnormal condition detection through comparison (compares current baseline to original)
- Allows for rapid deployment of new networks
5
Q
Cyber Threat Intelligence (CTI)
A
Knowledge about adversaries
6
Q
What are the benefits of Cyber Threat Intelligence (CTI)?
A
- Framework for indicators of compromise (IoC) for actionable hunting
- Enables organizations to deploy measures to detect, mitigate, & possibly prevent attacks as they occur
7
Q
Network Artifacts
A
Piece of network traffic data that may be relevant to an investigated response
8
Q
What are the benefits of network artifacts?
A
- Helps with developing network and host signatures
- Feeds CTI to triage incidents sooner
9
Q
What are some things that could be network artifacts?
A
Logs (router, switch, firewall, DNS, web proxy, etc), files/directories (names, timestamps, sizes, hashes), registry keys
10
Q
Network Triage
A
A process for sorting network violations into groups based on need for or likely benefit from immediate attention
11
Q
What is the benefit of network triage?
A
Helps the network analyst & the unit prioritize important systems to prevent mission failure
12
Q
Sandbox
A
Highly controlled environment used to test unverified programs or malicious software
13
Q
What are the benefits of sandboxes?
A
Safely examine suspicious files
14
Q
Intrusion Detection System
A
Device or software application that passively monitors a network or systems for malicious activity or policy violations; “Man-on-the-Side”
15
Q
What are the benefits of intrusion detection systems?
A
- Easier to deploy because it doesn’t affect existing system or infrastructure
- Detects network based attacks by checking packet headers
- Retains evidence for network analysts when set up to log data
16
Q
Intrusion Prevention System
A
Preemptive network security approach that uses techniques to detect and block possible intrusion attempts into a network
17
Q
What are the benefits of intrusion prevention systems?
A
- Able to take defensive actions rather than just alerting on a possible attack
- Retains evidence for network analysts when set up to log data
18
Q
Security Info & Event Management (SIEM)
A
A group of technologies that together provide a bird’s eye view of the network
19
Q
What are the benefits of SIEMs?
A
- Aggregates relevant data from multiple data sources to identify deviations from the norm & and allow an analyst to take appropriate actions
- Able to ingest data from virtually any product vendor
20
Q
What is the difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?
A
An IDS passively monitors while an IPS actively tries to prevent possible intrusions
21
Q
Full Packet Capture
A
File containing original packet data as seen at collection point (*.pcap, *.pcapng, *.cap, *.dmp)
22
Q
What are the benefits of Full Packet Capture?
A
- Holy grail of network data collection
- Countless tools give the analyst many approaches to examine them
23
Q
What are the drawbacks of Full Packet Capture?
A
- Files can grow extremely large
- Legal constraints often limit availability of this data
- Encrypted communications are increasingly used
24
Q
NetFlow
A
- Record containing a summary of network communication as seen at the collection point
- Contains no content
- Extremely helpful for quick network triage
25
What are the benefits of NetFlow?
- Requires less storage than full packet capture
- Analysis processes are much faster
- Generally fewer privacy concerns
- Analysis processes apply equally to all protocols (encrypted/plain text, custom or standard)
26
What are the drawbacks of NetFlow?
- Without content low level analysis & analysis may not be possible
- Many collection platforms are unique and require training and/or license to use
27
Log Files
- Most widely used source data for network & endpoint investigations
- Contains application or platform centric items of use to characterize activities handled or observed by the log creator
28
What are the benefits of log files?
- Collected & retained for industry operation purposes, logs are widely available and processes often in place to analyze them
- Raw log data can be aggregated for centralized analysis
29
What are the drawbacks of log files?
- Log data contains varying levels of detail in numerous formats
- Often requires parsing & enrichment to add context or additional data to corroborate findings
- If log data is not already aggregated finding it can involve significant time & effort before analysis can begin
30
What is a port mirror?
It's a software tap that duplicates packets sent to or from a designated switch port to another switch port (sometimes called a SPAN (Switch Port Analyzer) port)
31
What are the benefits of port mirroring?
- Activating a port mirror usually just requires a configuration change, usually avoiding downtime
- Switches are everywhere so it maximizes flexibility of capture/observation platform placement
32
What are some drawbacks of port mirroring?
- Data loss is possible with high traffic networks
- Bandwidth is limited by half duplex speed
33
What are the benefits of collecting network traffic from a router?
- Provides Netflow export functionality
- Just requires a configuration change with limited downtime
- Netflow is normally already collected so adding additional exporters is usually not hard
34
What are some drawbacks of collecting from a router?
Generally does not provide the ability to perform full packet capture
35
What layer 7 devices can perform data collection for network analysis?
Any platform with control of or purview over a network link can provide valuable logging data regarding the communications that pass through it
36
What can layer 7 endpoints be configured to capture?
Generate full-packet capture data or export Netflow
37
What are the benefits of collecting from a layer 7 device?
Many perspectives on the same incident may yield multiple useful data points about an incident
38
What are the drawbacks of collecting from a layer 7 device?
- Log data may include numerous formats & varying level of details in their content
- May require labor intensive parsing & analysis to ID the useful details
- Platforms that create the logs are often scattered
- Requires sound log aggregation plan & platform
39
Tap
Hardware device that provides duplicated packet data streams that can be sent to a capture or observation platform
40
What is an aggregating tap?
It merges both directions of network traffic to a single stream of data on a single port
41
What is a regenerating tap?
It provides the duplicated data streams to multiple physical ports
42
What are the benefits of a network tap?
- Hardware device designed specifically for network traffic capture, engineered for performance and reliability
- Most taps will continue to pass monitored traffic even without power
43
What are the drawbacks of a network tap?
- Expensive
- Downtime during installation
44
Workflows
- Most common and beneficial tasks can generally be placed in a workflow
- Categories are not generally iterative
- Dynamic process that adapts to adversaries actions (no single workflow can be used to address every scenario)
45
Establish Baselines
A workflow with the goal of identifying normal patterns of behavior to help identify abnormal behavior
- Ideally the first step (can be made before, during or after)
- Determine cycles based on time and date
- Determine typical cycles of traffic (top talking hosts, ports/protocols, GET vs POST activity for http)
46
Ingest & Distill
A workflow with the goal of preparing for analysis & deriving data that will more easily facilitate the rest of the analytic workflow
- Log source data according to local procedures
- If pcap files are available distill to other data sources types
- Considering splitting data into time-based chunks
- Load source data to large scale analytic platforms
47
Reduce and Filter
A workflow with the goal of reducing large amounts of input data down to a smaller volume allowing analysis with a wider range of tools
- Reduce using known indicators and data points (IP addresses, ports/protocols, time frames, volume calculation, domain names, hostname, etc)
- For large scale analytic platforms, build filters to reduce visible data to traffic involving known indicators
48
Analyze & Explore
A workflow with the goal of identifying traffic and artifacts that support investigative goals and hypothesis
- Look into reduced data set for suspicious traffic (may include evaluating traffic contents , context, anomalies, consistencies, anything that helps
- Use any baselines for identifying deviations
49
Extract Indicators & Objects
A workflow with the goal of finding artifacts that help identify malicious activity, including field values, byte sequences, files or other objects
- As additional artifacts are ID'd, maintain on ongoing collection of these data points for further use during and after the investigation (includes direct observations or ancillary observations)
- Protect data according to local policies and share in accordance with operational security constraints
50
Scope and Scale
A workflow with the goal of searching more broadly within source data for behavior that matches known indicators
- After IDing useful artifacts that define activity of interest, scale up the search using large scale analytic platforms & tools
- ID additional endpoints that exhibit the suspicious behavior, aiming to fully scope the incident within the environment
- Pass appropriate indicators to security operations for live ID of suspicious activity
51
What are the network based processing workflows?
- Establish baselines
- Ingest & distill
- Reduce & filter
- Analyze & explore
- Extract indicators & objects
- Scope & scale
52
Wireshark
Deep, protocol aware packet exploration & analysis tool (open source)
53
TCPDump
Logs and/or parses network traffic (used to dump live network traffic to pcap files)
54
How does TCPDump work?
It reduces data by reading from existing pcap files, applying a targeted filter, and writing the reduced data to a new pcap file
55
Bro NSM
Creates log files as needed to document observed network traffic, uses "bro-cut" utility to extract specific fields from Bro logs
56
Snort/Suricata
Capable of performing real time traffic analysis and packet logging on IP networks
- Performs protocol analysis, content searching and matching, and detects a variety of attacks and probes using signatures
- May be used as an Intrusion Detection System or an Intrusion Prevention System
57
NetworkMiner
Protocol aware object extraction tool that writes files to disk
- Performs tedious object extraction
- May trigger host based defenses when files written to disk (use in isolated system)
- Network data fields can be exported to CSV
58
How are TCP connections initialized?
A three way handshake (SYN, SYN/ACK, ACK)
59
Port Scanning
Sending transmissions to end nodes, and analyzing the responses, in order to identify information about the communication system
60
How difficult to detect is port scanning?
It's easy. The technique is an expected voluminous activity on the internet. Active scanning typically generates benign traffic with no defense to execute (high volume makes it burdensome for defenders to chase so often ignored)
61
What is the standard TTL for IP messages generated on a *nix system?
64
62
What is the standard TTL for IP messages generated on a Windows system?
128
63
What is the standard TTL for IP messages generated on a Solaris/AIX system?
254
64
What is the standard TTL for IP messages generated on a network?
255
65
User-Agent String
Part of network traffic that contains information about a browser's identity, provided by client, may include platform token
66
Platform Token
Describes the client operating system
67
In Wireshark what types of data streams are you able to follow?
UDP, TCP, SSL, HTTP
CWO
flashcards
Decks in class (3)
# Cards
