>> We can't talk about network operations
>> in the day-to-day
>> without talking about the importance of
scanning and monitoring your network,
as well as patching.
We'll talk a bit about log reviews and
scanning for ports and other vulnerabilities.
We'll talk about managing patches,
distributing them, and being
able to roll back patches as necessary.
We'll look at the significance of baselines
then talk about packet and traffic analysis.
One of the processes that we're always considering is
the possibility of events and
incidents and materializing on the network.
We talk about an event,
it's really just a measurable change in state.
DNS service started, DNS service stopped.
It's neither here nor there.
When we have events that are negative
or have a negative event on our network,
we consider that to be an incident.
A lot of times we can associate that
and say that a third has materialized.
We want to make sure that we use
our due diligence and stay knowledgeable on
the various types of attacks that are
current and on the horizon.
We also want to make sure that we have tools and
police so that way we can detect those events.
When we talk about being knowledgeable
and doing our research,
we usually consider that to be threat intelligence,
making sure we have the tools and
expertise in place so that
way we can make good decisions
based on threats is important.
They're obviously going to be
other sources of information,
like lots of databases that
indicate common threats and vulnerabilities.
We can sign up for notifications from
these third-party resources and can also
configure notifications and alerts for
our network to indicate that something has happened,
like percentage of network utilization
increasing or certain types
of traffic detected on the network.
It's all about detecting at any sort of
event that might have a negative impact.
We often think of SIEMs systems in this case.
That security incident and event manager
or a security information and event manager.
These are the systems I put it all together.
We have agents running on various firewalls,
routers and honeypots, all these different systems.
Ultimately, those agents report
to a central management console where we can
look at the big picture of what's happening on
the network and try to correlate the details.
Activity on one server may seem very benign.
But when you see that same activity on
>> multiple servers, that might be an indication
>> that there's a greater threat.
Simple Network Management Protocol.
SNMP [NOISE] is a protocol and a service that
devices or information is
tracked within our organization.
Specifically, configuration and security-related issues.
Now, there's an SNMP manager tool that I
something called a MIB, management information base.
That's just a formatted text file
that is designed to collect
information on certain types of
thoughts or activities that I can scan for.
The SNMP manager takes on information and is able to
translate it to more helpful information
that will be useful to a network manager.
You can see over on the right that might not be
particularly meaningful but ultimately,
with good reporting software,
it could pull out issues,
drop packets, different types of traffic on
the network and different devices on the network.
SNMP provides a lot of
information for managing the network.
SNMP version 3 is the latest and is also the only type
that transmits this information
across the network in encrypted fashion.
Everything else census information
that's been captured across the network,
unencrypted and SNMP could be compromised and help
an attacker figure out what's on
your network and what vulnerabilities exist.
In addition to monitoring,
we have to know what we're looking for.
You can't just look, you have to look with a purpose.
What we've got to look at is
the various controls and systems that we have in place
>> and determine what our expectations are.
>> What amount of error rate is acceptable?
How much utilization is too much?
What about packets being dropped?
At what point in time does that become an issue?
None of those questions are ones that I can answer.
It really varies on your network
and the type of traffic that you transmit.
The bottom line is, these are
some things that we need to consider and
these metrics are frequently things that we
monitor along with a slew of other metrics.
The purpose here is knowing what we're
looking for and what
our network performance expectations are. Log review.
Many times we think we go to our logs after the fact.
We've had some negative event happen,
so let's go check the logs.
If we're proactive in monitoring our logs,
many times we can see an event as it begins to
materialize and we don't
have to wait until after the fact.
Most devices have some logging feature.
Again, these help us look at the big picture and
>> spot any anomaly or thing that is
>> indicative for it's something
on to the normal is happening.
We want to make sure that our
logs are stored in such a way
that they can't be tampered with or modified.
That would involve using hashes that to
make sure that there's no modification.
We really want to be able to review
those logs and see if we can preemptively determinant
that hack is happening or
at least the diaphysis and suspicious activity.
We want to be able to correlate this fox across
multiple systems and we do that with SIEMs.
Port scanning goes hand in
hand with vulnerability scanning.
What we're looking for is known weaknesses.
When we're scanning for open ports,
those are points that have services installed.
We have to remember that a port is
really just access into our system.
If my system is listening on port 80,
it's allowing web-based traffic to come in.
If we have too many ports or unexpected ports,
then we have unexpected pathways into our system.
The way you close the ports is to
remove the software that opens the port.
Port scans are usually
the first step in an attempted compromise.