http://xkcd.com/325 1 Building Useful Security Infrastructure for - - PowerPoint PPT Presentation

▶
http xkcd com 325
SMART_READER_LITE
LIVE PREVIEW

http://xkcd.com/325 1 Building Useful Security Infrastructure for - - PowerPoint PPT Presentation

Apr 12, 2023 34 likes •355 views

http://xkcd.com/325 1 Building Useful Security Infrastructure for Free Now with more Madness!! 2 Who am I? Brad Lhotsky, Recovering Perl Programmer Information Security Manager System Administrator Database Administrator

slide-1
SLIDE 1

http://xkcd.com/325

1

slide-2
SLIDE 2

Building Useful Security Infrastructure for Free

Now with more Madness!!

2

slide-3
SLIDE 3

Who am I?

  • Brad Lhotsky, Recovering Perl Programmer
  • “Information Security Manager”
  • System Administrator
  • Database Administrator
  • Keeper of the Codes
  • Raptor Herder

3

slide-4
SLIDE 4

Who are YOU?

4

slide-5
SLIDE 5

Disclaimer: The views presented here are almost certainly do not reflect the views of my Employer.

Where I work ..

5

slide-6
SLIDE 6

6

slide-7
SLIDE 7

“I don’t care about security and never will. So do whatever you want, but make sure I know I’m better off with you employed”

7

slide-8
SLIDE 8

What is “Useful Security” ?

  • Not security for the sake of security
  • Solves Operations problems
  • Makes business more efficient
  • Meets requirements for Compliance to

legislation:

  • PCI-DSS, SOX, HIPAA, FISMA

8

slide-9
SLIDE 9

Why “Build” It?

9

slide-10
SLIDE 10

Invest in Your Team

  • Open Source encourages you to get into

the nuts and bolts

  • You learn more than just the software
  • Networking
  • Protocols
  • Operating Systems
  • Promotes Cross Training

10

slide-11
SLIDE 11

(Comic: Bill Hood)

CEO & CFO want ROI

11

slide-12
SLIDE 12

Part Duex; Duexing It!

12

slide-13
SLIDE 13

Complying, like a boss.

  • Systems and Network

Inventory

  • Systems and Network

Monitoring

  • Accountability
  • Who is where, when,

why, and how?

13

slide-14
SLIDE 14

Paying Attention

  • Already have a great deal
  • f information
  • Just need to get into one

Place

  • Central Logging

14

slide-15
SLIDE 15

syslog-ng

  • Program destination
  • Started with syslog-ng daemon
  • Messages passed in to that program’s

STDIN

  • Allows Dynamic Programming Languages

with high startup costs to be really quick

  • Configuration syntax makes sense
  • Caveat: Some features are not free

15

slide-16
SLIDE 16

rsyslog

  • All Open Source
  • Supports Native Encryption via TLS
  • Supports on-disk queueing for remote

destinations

  • Caveat: Configuration syntax is ugly

16

slide-17
SLIDE 17

Long Term Memory

  • Store our relational data with PostgreSQL
  • ACID Compliant for Standards Compliance
  • Support for Stored Procedures, Triggers,

and Views

  • Extensible via pgFoundry and PGXN
  • PL/R, PostGIS, ltree, etc ..

17

slide-18
SLIDE 18

PostgreSQL : inet

SELECT * FROM node_history WHERE ip_address << inet ‘192.168.1.0/24’

Allows us to ask if an IP address in a certain range

18

slide-19
SLIDE 19

Information Flow

Perl Based Web Front End Servers Log Via Syslog Central Syslog Server PostgreSQL Central Data Store Open Source NMS Tools Custom Data Correlators

19

slide-20
SLIDE 20

Getting Useful Data

  • DHCP logs to syslog
  • MAC, IP

, and Hostname

  • Arpwatch logs to syslog
  • MAC, IP

, and Hostname

  • Netdisco stores data in PgSQL
  • MAC, Switch, and Port

20

slide-21
SLIDE 21

Getting Useful Data

  • Samba logs via syslog
  • IP and Username
  • ActiveDirectory and LDAP for users
  • Username, Email, Phone #
  • Custom Built App track Employee Data
  • Supervisor, Manager, Contractor POC

21

slide-22
SLIDE 22

Data Relationships

22

slide-23
SLIDE 23

Now it’s easy to solve Operations Problems

23

slide-24
SLIDE 24

Security Under the Veil of Utility

Identify and Locate Users

24

slide-25
SLIDE 25

Get useful information

  • n our users

25

slide-26
SLIDE 26

26

slide-27
SLIDE 27

27

slide-28
SLIDE 28

a few other tricks ..

28

slide-29
SLIDE 29

do something cool w/ metrics

29

slide-30
SLIDE 30

cool deploy macros via Puppet

subversion::deploy { ‘project’:

  • wner => apache, group => apache,

svnurl => ‘svn+ssh://svn/repo/project’, target => ‘/var/www/project’, notify => Service[‘httpd’] }

https://github.com/reyjrar/svnutils

This satisfies “Change Management” Requirements

30

slide-31
SLIDE 31
  • Policy Compliance
  • Exceeds current logging recommendations
  • Open Source Software
  • #ossec on irc.freenode.net
  • Great functionality
  • Distributed Active Response
  • WebUI

“OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS). It has a powerful correlation and analysis engine, integrating log analysis, file integrity checking, Windows registry monitoring, centralized policy enforcement, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows.”

http://ossec.net

31

slide-32
SLIDE 32

Thank you!

brad.lhotsky@gmail.com https://twitter.com/reyjrar https://github.com/reyjrar

32