Scribd Logo
Upload

Welcome to Scribd!

  • JWP Presentation Slides Davis Horwath Zabiuk

    Uploaded by

    Yassou Insat
    67 views13 pages
    The document discusses logging infrastructure, sources, and security information event management (SIEM). It describes how SIEM products aggregate logs from various systems and applications, correlate related events to detect threats, and provide advantages like comprehensive views, anomaly detection, and prioritized alerts. Several vendors that provide SIEM solutions are profiled, including their approaches to log collection, correlation, reporting, and unique features. A table compares the capabilities and attributes of LogRhythm, QRadar, PrismMicro, and Nitro security platforms.

    Original Description:

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses logging infrastructure, sources, and security information event management (SIEM). It describes how SIEM products aggregate logs from various systems and applications, correlate related events to detect threats, and provide advantages like comprehensive views, anomaly detection, and prioritized alerts. Several vendors that provide SIEM solutions are profiled, including their approaches to log collection, correlation, reporting, and unique features. A table compares the capabilities and attributes of LogRhythm, QRadar, PrismMicro, and Nitro security platforms.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pptx, pdf, or txt
    67 views13 pages

    JWP Presentation Slides Davis Horwath Zabiuk

    Uploaded by

    Yassou Insat
    The document discusses logging infrastructure, sources, and security information event management (SIEM). It describes how SIEM products aggregate logs from various systems and applications, correlate related events to detect threats, and provide advantages like comprehensive views, anomaly detection, and prioritized alerts. Several vendors that provide SIEM solutions are profiled, including their approaches to log collection, correlation, reporting, and unique features. A table compares the capabilities and attributes of LogRhythm, QRadar, PrismMicro, and Nitro security platforms.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pptx, pdf, or txt
    of 13

    What's in the data bucket?

     
    Event Correlation and SIEM Vendor Approaches

    Brough Davis, Jim Horwath, John Zabiuk


    April 2010

    SANS Technology Institute - Candidate for Master of Science Degree


    Objective

    • Logging Infrastructure
    • Logging Sources & Servers
    • What is a SIEM? 
    • Advantages of a SIEM?
    • Using SIEM
    • Vendor Approaches

    SANS Technology Institute - Candidate for Master of Science Degree


    Logging Infrastructure
    What is logging to where?

    SANS Technology Institute - Candidate for Master of Science Degree


    Logging Sources / Services
    Logging Sources Logging Services
    • Syslog and SNMP Trap • SYSLOG
    • Network o SYSLOGD
    o Cisco IOS o SYSLOG-NG
    o Snort IDS/IPS o RSYSLOG
    • Servers/Workstations • SNMP TRAP
    o Enterprise Linux 3/4/5
    o Microsoft Windows
    • Applications
    o BIND (DNS)
    o Exchange
    o MS SQL
    o Host Intrustion Detection

    SANS Technology Institute - Candidate for Master of Science Degree


    What is a SIEM?

    • SIEM - Security Information Event Management


    • Logging and Event Aggregation
    o Network (router,switch,firewall,etc)
    o System (Server,workstation,etc)
    o Application (Web, DB )
    • Correlation Engine
    o 2+ related events = higher alarm (1+1=3)

    SANS Technology Institute - Candidate for Master of Science Degree


    Using SIEM

    How do SIEM Products help the following Security concerns?

    • Countermeasures to detect attempts to infect internal system


    • Identification of infected systems trying to exfiltrate information
    • Mitigation of the impact of infected systems
    • Detection of outbound sensitive information ( DLP) 

    SANS Technology Institute - Candidate for Master of Science Degree


    SIEM Advantages
    • Correlation of data from multiple systems and from different events detecting security and
    operational conditions
    •  Anomaly detection by using a baseline of events over time to find deviations from expected
    or normal behavior
    • Comprehensive view into an environment based on event types, protocols, log sources, etc
    • APT (advanced persistent threat) protection through detection of protocol and application
    anomalies
    • Prioritization based on risk of threat to assets, staff can triage the most vulnerable targets
    • Alerting and monitoring on events of interest to escalate priority
    • Ability to filter events and create custom views to meet business needs
    • Allows organizations to demonstrate adherence to polices and controls  
    • Monitor and log the access and use of sensitive data
    • Limits exposure to breach disclosure costs by knowing the number or customer records
    affected
    • Helps reduce risk to business partners and customers by detecting data loss and fraud
    • Reduce costs by replacing redundant functions and technologies

    SANS Technology Institute - Candidate for Master of Science Degree


    Vendor Approaches

    • Log Rhythm  (http://logrhythm.com/)


    • Qradar  (http://www.q1labs.com/)
    • Prismmicrosystems  (http://www.prismmicrosys.com/)
    • Nitro Security (http://nitrosecurity.com/)

    SANS Technology Institute - Candidate for Master of Science Degree


    Log Rhythm
    • Audit privileged user activity such as new account creation for greater operational
    transparency
    • Correlate privileged user behavior with specific network activity
    • View real-time activity and drill down based on relevant criteria
    • Map global relationships to identify communication involving suspicious sources and/or
    destinations
    • Visualize network communication to identify anomalous patterns and data transfers
    • Deliver real-time alerts on unauthorized access of sensitive data and information transfers
    to unapproved recipients
    • Independently audit and log data transfer to removable media such as USB drives and
    memory cards
    • Correlate access of sensitive data with printer logs and user activity
    • Independently monitor processes for increased awareness of potential malware and
    spyware

    SANS Technology Institute - Candidate for Master of Science Degree


    QRadar
    • Hardened, Linux-based appliance solution
    • Integrated flow collection enables passive profiling of network asset applying context rules to discovered assets
    • Integration of external VA scanner results applies further context to rules, and weights to incidents.
    • Trend analysis and anomaly detection for detecting statistical anomalies and threshold violations
    • Ability to spot problems based on historical trends and current activity
    • Increased forensics by combining fully integrated network activity with log data
    • Agentless collection for most log sources, including Windows; Q1 Labs provided Windows agent option, ALE,
    reads event data and has plug-ins for sources such as IIS, SQL Server, etc
    • Geo-location ability, find traffic location based on IP address
    • Product ships with 120 standard correlation rules, 1600 out-of-the-box report templates. Adding site/industry-
    specific rules is easy
    • Company autoupdates rules with every major release of QRadar
    • Correlation rule editor is simple to use -- it resembles Microsoft Outlook's rules wizard
    • Appliance has a distributed database (ARIEL) that  excels at write-once read many times and grow incrementally
    as you add QRadar appliances. Eliminates backend database, enables efficient High Availability
    • Segregation of duties based on job responsibility and business need
    • Reports are single-pane view containing all relevant information for reporting and investigation

    SANS Technology Institute - Candidate for Master of Science Degree


    Prism Microsystems 
    • Software only solution running on Windows O/S
    • No database, log data stored in compressed CAB files, SHA-1 and 92% raw log
    compression
    • Integration into current Active Directory environment, monitors log from major vendors
    • Indexed search with custom keywords
    • Allows central management and deployment, monitors business critical components
    • Database Monitoring MS SQL, Oracle, and others via ODBC
    • Point and click design of reports
    • Provides high-level dashboards to low-level detail
    • Optional Agents for Windows, Solaris BSM, IBM iSeries and AS 400
    • Windows Agent features 
    o central management / deployment capability
    o monitors USB drives, application logs, network connections, processes, change audits
    and config assessments

    SANS Technology Institute - Candidate for Master of Science Degree


    Nitro Security
    • Fast Database - High-level to packet level 
    • No DBA management
    • "Single pane of glass" GUI 
    • Regular expression rules engine
    • Multiple filtering options 
    • Passive database monitoring 
    • Auto discover feature to find "rogue" database instances
    • Resolves "pooled" connections for applications 
    • Geo-location tracking 
    • Linux-based appliance - FIPS 140-2/CC EAL Level 3 certified

    SANS Technology Institute - Candidate for Master of Science Degree


    (A - Automatically, M - Manually, N - Not Available) Log Rythm Qradar Prismmicro Nitro

    Summary
    Identify common attacks and what logs entries they produce

    Detection of in-bound attacks (both external/internal)


    A

    A
    A

    A
    A

    A
    A

    Detection of out-outbound data loss (DLP) A A A A

    Identifying Infected systems A A A A

    Mitigating against infected systems A A A A

    Use and misuse of privileged accounts A A A A

    Access to sensitive information (db info, eg. payroll) A A A A

    Geo location A A A A

    Learning Curve (*-***/slower - faster) * NA * ***

    Setup Time (* - ***/slower - faster) * *** * **

    Unique Features Powerful agent Auto discover Data stored in Fastest DB -


    collectors and context flat files EDB
    rule applying

    Business Openness  (* - ***/ Difficult - Open) ** *** *** ***

    SANS Technology Institute - Candidate for Master of Science Degree

    You might also like