CAIS Sensor: Distributed Sensors Network in Brazilian NREN LACSEC - - PowerPoint PPT Presentation

▶

Dec 17, 2023 242 likes •472 views

CAIS Sensor: Distributed Sensors Network in Brazilian NREN LACSEC LACNIC27 Regarding RNP Brazilian National Research and Education Network (RNP). Created in 1989. Implementing the first Latin American fiber network in 2005.

SLIDE 1

CAIS Sensor: Distributed Sensors Network in Brazilian NREN

LACSEC

LACNIC27

SLIDE 2

Regarding RNP

Brazilian National Research

and Education Network (RNP).

Created in 1989.
Implementing the first Latin

American fiber network in 2005.

SLIDE 3

Regarding CAIS

Coordination CSIRT of Brazilian

research and education network since 1997.

CAIS works in detection, resolution and

prevention of network security incidents.

Security Vulnerability Management Security Incident Handling

CSIRT Development

Security Awareness

SLIDE 4

Rede Ipê, Brazilian academic network

backbone. Built-in capacity of 347 Gbps

* dados de 2015

Interconnects 1.911 units of RNP's Customers (Universities, Federal Institutes, Research Organizations). Highly diversified environment, regarding networks, technologies and maturity of customers’ security teams. Difficulties for efficient detection.

Motivations to create a CAIS Sensor network

SLIDE 5

CAIS Sensor Requirements

SLIDE 6

What is the CAIS Sensor?

SLIDE 7

How does CAIS Sensor analyze traffic?

SLIDE 8

How does CAIS Sensor work?

Sensor (Suricata)

Master Server Engine (Suricata) Engine (Suricata) Engine (Suricata) + + Query

SLIDE 9

What does Master Server do?

Sensor’s system updates

management

Sensor management
Statistics of malicious

activities detected

Information about sensor’s

“health”

System general

administration Master

Engines(Suricata)

SLIDE 10

Regarding Engines(Suricata)

Friendly user interface
Plug and play
Less technical knowledge required
Low maintenance and support
Send detections by email
Send statistics and status data
Update requests

Engines(Suricata)

SLIDE 11

The CAIS Sensor(Screenshots)

Main menu Quick access tasks Quick Information dashboard

SLIDE 12

The CAIS Sensor(Screenshots)

SLIDE 13

Engine(Screenshots) – Installation Menu

Restart Services.
Network interface configuration.
Select network pickup interface.
Use license configuration.

SLIDE 14

27 RNP Points of Presence 17 Customers 44 Sensors Installed

CAIS Sensor Implementation

SLIDE 15

Statistics – Average Analyzed Traffic

SLIDE 16

Statistics

91% 9% Incoming Outgoing

Malicious activity flow Most attacked ports

SLIDE 17

Statistics - Main types of malicious activity detected

DDoS Attempts(protocol xdmcp) 702.345 DDoS Attack (protocol NTP) 535.204 Malwares 236.985 DDoS Attack (protocol SNMP) 102.478

SLIDE 18

Statistics – Types of detected events

SLIDE 19

Statistics - Botnets

nicaze.net Zeus XcodeGhost Feodo DealPly PCRat/Gh0st Palevo Bladabindi/njrat Beacon Kelihos

SLIDE 20

Next Steps

Optimize reports
Integrate with other sources (URLs blacklist,

IPs blacklist, others)

Increase number of sensors in educational institutions

and RNP customers

Finalize and expand the partnership model

SLIDE 21

Questions ?

SLIDE 22

Thanks!

RNP – Brazilian Educational and Research Network

CAIS – RNP Incident Security Response Team

Yuri Alexandro

Security Analyst yuri.ferreira@rnp.br

Rildo Souza

Security Analyst rildo.souza@rnp.br