Post on 13-Apr-2017
transcript
Do you really need more shiny security toys? Reduce your attack surface by getting back to basics
Avishai WoolCTO
AGENDA
1. Structure of an APT attack
2. Back to Basics: Reducing the Attack Surface
3. Network Segmentation and Security Zones
4. Managing Zoned Networks with AlgoSec
2 | Confidential
3 | Confidential
1. STRUCTURE OF AN APT ATTACK
4 | Confidential
5 | Confidential
HOW?
1. Repeat until desired data reached:
• Recon • Deliver exploits • Explore the network• Be persistent
2. Exfiltrate data
“Advanced Persistent Threat”, Wikipedia
INFORMATION GATHERING
1. OSINT (Open Source Intelligence)• Port scans, vulnerability scanning externally open services
2. On-site gathering
3. HUMINT (Key employees, social engineering)
4. Foot-printing • Banner grabbing, SNMP Sweeps, DNS zone transfers, etc
6 | Confidential
http://www.pentest-standard.org/index.php/Intelligence_Gathering
INFORMATION GATHERING: REQUIRES NETWORK TRAFFIC
1. OSINT (Open Source Intelligence)• Port scans, vulnerability scanning externally open services
2. On-site gathering
3. HUMINT (Key employees, social engineering)
4. Foot-printing • Banner grabbing, SNMP Sweeps, DNS zone transfers, etc.
7 | Confidential
ATTACK TECHNIQUES (PARTIAL LIST)
• Email attachment• Send a malicious email attachment
• Browser Drive-By-Download• Host the malicious content on a website
• “Water-hole” technique• Compromise a website the victim likely to visit
• Social Engineering• Fool someone to do it for you
• Mobile malware• Spread a malicious mobile application
8 | Confidential
EXPLORE THE COMPROMISED NETWORK
• Move Laterally• Find more devices
• Gain more access
• Find interesting data
Lateral movement relies on (unusual) network traffic
9 | Confidential
ATTACK PERSISTENCY
• Attacker needs to stay for the long term
• Users tend to: • Reboot, patch their systems, update signature detection
• Solution: Deploy software on victim’s machine
• Remote Administrator Tools (RAT) are the most popular• Poison Ivy , Dark Comet, Net Wire, ….
Attack persistency relies on (unusual) network traffic
10 | Confidential
EXFILTRATION
• Attacker needs to exfiltrate data from the network• Encrypted over SSL
• Blend in normal traffic over HTTP
• Picture, Social media posts, pastebin, HTML tags
• VoIP
• Unusual (outbound) traffic
11 | Confidential
STEPPING STONES
12 | Confidential
1
2
Financial
Database
HVAC
Control
Partner
Network
Procurement
Department
InternetStep 0
STEPPING STONES
13 | Confidential
1
3
Financial
Database
HVAC
Control
Partner
Network
Procurement
Department
InternetStep 0
Step 1
STEPPING STONES
14 | Confidential
1
4
Financial
Database
HVAC
Control
Partner
Network
Procurement
Department
InternetStep 0
Step 1 Step 2 Step 3
STEPPING STONES
15 | Confidential
1
5
Financial
Database
HVAC
Control
Partner
Network
Procurement
Department
InternetStep 0
Step 1 Step 2 Step 3
Step 4 – exfiltrationGame Over
16 | Confidential
2. BACK TO BASICS: REDUCING THE ATTACK SURFACE
THE FIRST STEP IS THE HARDEST
17 | Confidential
Financial
Database
HVAC
Control
Partner
Network
Procurement
Department
Internet
• Most ingenious step (social engineering, clever technical exploit delivery, …)• Much of the attack is happening outside of your control• Requires fancy defense technologies to mitigate
MAKE LATERAL STEPS HARDER FOR ATTACKER!
18 | Confidential
Financial
Database
HVAC
Control
Partner
Network
Procurement
Department
Internet
Step 1 Step 2 Step 3
Step 4 – exfiltrationGame Over
LATERAL STEPS
• The attacker is now on your turf
• Use your advantages:• Control your network• Know what traffic is usual and what is not
19 | Confidential
UNUSUAL – IN USUAL WAYS
• Lateral traffic is unusual – in usual ways
• Communicating parties that never communicate
• Protocols & ports that are never used
• Firewalls are really good at blocking such traffic
… as long as:• There are firewalls in the traffic path• The firewalls are properly configured
20 | Confidential
21 | Confidential
3. NETWORK SEGMENTATION AND SECURITY ZONES
RECOMMENDATION #1: SEGMENTATION
• Define network zones
• Place firewalls to filter traffic between zones
• Write restrictive policies for traffic between zones
22 | Confidential
USE TECHNOLOGY YOU KNOW WELL
23 | Confidential
2
3
Financial
Database
HVAC
Control
Partner
Network
Procurement
Department
Internet
USE TECHNOLOGY YOU KNOW WELL
24 | Confidential
Financial
Database
HVAC
Control
Partner
Network
Procurement
Department
Internet
SEGMENT THE NETWORK: INTERNAL FIREWALLS
25 | Confidential
Financial
Database
HVAC
Control
Partner
Network
Procurement
Department
Internet
• Place internal firewalls between network zones• Use SDN virtualization technologies to filter traffic inside data center
ZONES FOR HUMANS
• Humans are the weakest link
• Systems they touch directly are at risk
• Usual communication patterns:• Desktop/Laptop Server• Server Server
• Desktops don’t communicate with other desktops
• Servers don’t initiate connections to desktops
26 | Confidential
RECOMMENDATION #2: HUMAN-ACCESS ZONES
• Desktops in separate zones from servers• Firewalls between human-access zones and server zones
• Keep different departments in separate zones
27 | Confidential
RECOMMENDATION #3: SENSITIVE DATA ZONES
• Some types of data are more sensitive• Credit card data (PCI regulation)
• Personally Identifiable Information (GLBA, privacy laws)
• Medical data (HIPAA)
• Financial data (SOX, etc)
• Servers with sensitive data in separate zones
28 | Confidential
POLICY IN A SEGMENTED NETWORK
• Define the segmentation policy as a matrix:
29 | Confidential
Internal
Network
DMZ Peer’s
DMZ
ZOOM IN: FROM/TO THE PEER DMZ
30 | Confidential
Internal
Network
DMZ Peer’s
DMZ
31 | Confidential
4. MANAGING ZONED NETWORKS WITH ALGOSEC
WORKING WITH A SEGMENTED NETWORK
• Preparation:• Identify the network segments
• Create a segmentation policy matrix (spreadsheet)
• Place internal firewalls / virtualized filters between zones
• Continuous Compliance • Ensure that firewalls enforce the segmentation policy
• Change Requests• Identify all the firewalls that need to be modified• What-if proactive risk check against segmentation policy
32 | Confidential
IMPORT SEGMENTATION POLICY SPREADSHEET
33 | Confidential
CONTINUOUS COMPLIANCE
• Daily analysis of all firewalls
34 | Confidential
CONTINUOUS COMPLIANCE
• Automatically check segmentation policy
35 | Confidential
CONTINUOUS COMPLIANCE
… and best-practices knowledge base
36 | Confidential
MAKING A CHANGE REQUEST
37 | Confidential
AUTOMATICALLY IDENTIFY DEVICES TO MODIFY
38 | Confidential
2 traditional firewalls separate network into zones
AUTOMATICALLY IDENTIFY DEVICES TO MODIFY
39 | Confidential
VMware NSX firewall filters all traffic inside the datacenter
EXPLORE PATH DETAILS
40 | Confidential
WHAT-IF RISK CHECK
• How were the risks checked?
41 | Confidential
WHAT-IF RISK CHECK
• How were the risks checked?
• Network segmentation matrix!
42 | Confidential
IMPLEMENT…
• Automatically creates ‘Work Order’ per device
• Implements new rules
… Details in another webinar!43 | Confidential
SUMMARY
• Attacks requires persistency. Keep an eye out for unusual internal and outbound traffic
• Take control your turf: Make lateral steps within your network harder for attackers• Segment the network• Segment the users
• Segment sensitive data
• Maintain control• Intelligent, structured process for change requests
• Proactively assess risk
• Ensure continuous compliance
44 | Confidential