Using Bro to Secure Your Science DMZ Robin Sommer International - - PowerPoint PPT Presentation

▶
using bro to secure your science dmz
SMART_READER_LITE
LIVE PREVIEW

Using Bro to Secure Your Science DMZ Robin Sommer International - - PowerPoint PPT Presentation

Aug 16, 2022 369 likes •930 views

Using Bro to Secure Your Science DMZ Robin Sommer International Computer Science Institute, & Lawrence Berkeley National Laboratory robin@icsi.berkeley.edu http://www.icir.org/robin Using Bro to Secure Your Science DMZ Securing Your

slide-1
SLIDE 1

Using Bro to Secure Your Science DMZ

Robin Sommer

International Computer Science Institute, & Lawrence Berkeley National Laboratory

robin@icsi.berkeley.edu http://www.icir.org/robin

Using Bro to Secure Your Science DMZ

slide-2
SLIDE 2

Using Bro to Secure Your Science DMZ

Securing Your Science DMZ Network

2

10G 10G 100G

Campus LAN

100G

Transfer/Storage Nodes

100G

Science DMZ Switch

Internet

slide-3
SLIDE 3

Using Bro to Secure Your Science DMZ

Securing Your Science DMZ Network

2

10G 10G 100G

Campus LAN

100G

Transfer/Storage Nodes

100G

Science DMZ Switch

Internet

100G

Bro

slide-4
SLIDE 4

Using Bro to Secure Your Science DMZ

The Bro Platform

3

slide-5
SLIDE 5

Using Bro to Secure Your Science DMZ

The Bro Platform

3

Network

Programming Language Packet Processing Standard Library

Platform

Vulnerabilit. Mgmt Intrusion Detection File Analysis Compliance Monitoring Traffic Measure- ment Traffic Control

Analysis Tap

Open Source BSD License

slide-6
SLIDE 6

Using Bro to Secure Your Science DMZ

The Bro Platform

3

Network

Programming Language Packet Processing Standard Library

Platform

Vulnerabilit. Mgmt Intrusion Detection File Analysis Compliance Monitoring Traffic Measure- ment Traffic Control

Analysis Tap

Open Source BSD License

Protecting open-science networks for 20 years now.

slide-7
SLIDE 7

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

4

Visibility Detection Performance Control Customization

slide-8
SLIDE 8

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

4

Log files Host-level visibility

Visibility Detection Performance Control Customization

slide-9
SLIDE 9

Using Bro to Secure Your Science DMZ

Connections Logs

5

slide-10
SLIDE 10

Using Bro to Secure Your Science DMZ

Connections Logs

5

conn.log

ts 1393099191.817686

Timestamp

uid Cy3S2U2sbarorQgmw6a

Unique ID

id.orig_h 177.22.211.144

Originator IP

id.orig_p 48053

Originator Port

id.resp_h 115.25.19.26

Responder IP

id.resp_p 2811

Responder Port

proto tcp

IP Protocol

service gridftp,ssl

App-layer Protocol

duration 8.405155

Duration

  • rig_bytes

13490

Bytes by Originator

resp_bytes 16127

Bytes by Responder

conn_state SF

TCP state

local_orig F

Local Originator?

history ShAdDaFf

State History

tunnel_parents (empty)

Outer Tunnels

slide-11
SLIDE 11

Using Bro to Secure Your Science DMZ

HTTP

6

http.log

ts 1393099291.589208 uid CKFUW73bIADw0r9pl id.orig_h 2a07:f2c0:90:402:41e:c13:6cb:99c id.orig_p 54352 id.resp_h 2406:fe60:f47::aaeb:98c id.resp_p 80 method POST host com-services.pandonetworks.com uri /soapservices/services/SessionStart referrer

  • user_agent

Mozilla/4.0 (Windows; U) Pando/2.6.0.8 status_code 200 username anonymous password

  • rig_mime_types

application/xml resp_mime_types application/xml

slide-12
SLIDE 12

Using Bro to Secure Your Science DMZ

ts 1443449046.841848 uid CEA05l2D7k0BD9Dda2 id.orig_h 1.2.3.4 id.orig_p 59208 id.resp_h 131.243.231.10 id.resp_p 2811 version TLSv12 cipher TLS_RSA_WITH_AES_256_GCM_SHA384 server_name

  • subject

CN=lrc-xfer.lbl.gov,OU=Services,O=Open Science Grid,DC=DigiCert-Grid,DC=com issuer CN=DigiCert Grid CA-1,O=DigiCert Grid,DC=DigiCert-Grid,DC=com client_subject CN=Foo Bar,O=LBNL HPCS,O=Globus,C=US client_issuer CN=GO HPCS ONLINE,OU=HPCS LBNL,DC=LBL,DC=gov cert_hash 197cab7c6c92a0b9ac5f37cfb0699268 validation_status

  • k

SSL

7

ssl.log

slide-13
SLIDE 13

Using Bro to Secure Your Science DMZ

Bro Analyzers

8

AYIYA BitTorrent DCE_RPC DHCP DNP3 DNS DTLS FTP Finger GTPv1 Gnutella HTTP ICMP IRC Ident Kerberos Login Modbus MySQL NCP NFS NTP NetBIOS PE POP3 Portmapper Radius RDP Rlogin Rsh SIP SMTP SNMP SOCKS SSH SSL Syslog Telnet Teredo X509 ZIP

slide-14
SLIDE 14

Using Bro to Secure Your Science DMZ

Host-level Visibility

9

Leverage control over end hosts.

slide-15
SLIDE 15

Using Bro to Secure Your Science DMZ

Host-level Visibility

9

Source: NERSC

iSSHD Leverage control over end hosts.

slide-16
SLIDE 16

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

10

Log files Host-level visibility

Visibility Detection Performance Control Customization

slide-17
SLIDE 17

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

10

Log files Host-level visibility

Visibility Detection Performance Control Customization

Suspicious activity Intelligence feeds

slide-18
SLIDE 18

Using Bro to Secure Your Science DMZ

Watching for Suspicious Logins

11

slide-19
SLIDE 19

Using Bro to Secure Your Science DMZ

Watching for Suspicious Logins

11

SSH::Watched_Country_Login

Successful login from an unexpected country.

slide-20
SLIDE 20

Using Bro to Secure Your Science DMZ

Watching for Suspicious Logins

11

SSH::Interesting_Hostname_Login

Successful login from an unusual host name.

smtp.big-university.edu

SSH::Watched_Country_Login

Successful login from an unexpected country.

slide-21
SLIDE 21

Using Bro to Secure Your Science DMZ

Intelligence Integration

12

Internal Network Internet

slide-22
SLIDE 22

Using Bro to Secure Your Science DMZ

Intelligence Integration

12

Internal Network

Intelligence

IP addresses DNS names URLs File hashes

Feeds

CIF JC3 Spamhaus Custom/Proprietary

Traffic Monitoring

HTTP , FTP , SSL, SSH, FTP , DNS, SMTP , … Internet

slide-23
SLIDE 23

Using Bro to Secure Your Science DMZ

ts 1258565309.806483 uid CAK677xaOmi66X4Th id.orig_h 192.168.1.103 id.resp_h 192.168.1.1 note Intel::Notice indicator baddomain.com indicator_type Intel::DOMAIN where HTTP::IN_HOST_HEADER source My-Private-Feed

Intelligence Integration

12

Internal Network

Intelligence

IP addresses DNS names URLs File hashes

Feeds

CIF JC3 Spamhaus Custom/Proprietary

Traffic Monitoring

HTTP , FTP , SSL, SSH, FTP , DNS, SMTP , … Internet

notice.log

slide-24
SLIDE 24

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

13

Log files Host-level visibility

Visibility Detection Performance Control Customization

Suspicious activity Intelligence feeds

slide-25
SLIDE 25

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

13

Log files Host-level visibility

Visibility Detection Performance Control Customization

Suspicious activity Intelligence feeds Bro Cluster Shunting

slide-26
SLIDE 26

Using Bro to Secure Your Science DMZ

Scaling Bro to 100G

14

100G 100G 100G

Transfer/Storage Nodes Science DMZ Switch

100G

Bro

slide-27
SLIDE 27

Using Bro to Secure Your Science DMZ

Scaling Bro to 100G

14

100G 100G 100G

Transfer/Storage Nodes Science DMZ Switch

100G

slide-28
SLIDE 28

Using Bro to Secure Your Science DMZ

Scaling Bro to 100G

14

Bro Cluster

100G 100G 100G

Transfer/Storage Nodes Science DMZ Switch

100G

Load-balancer

10G 10G 10G 10G

slide-29
SLIDE 29

Using Bro to Secure Your Science DMZ

Scaling Bro to 100G

14

Bro Cluster

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

100G 100G 100G

Transfer/Storage Nodes Science DMZ Switch

100G

Load-balancer

10G 10G 10G 10G

slide-30
SLIDE 30

Using Bro to Secure Your Science DMZ

Scaling Bro to 100G

14

Shunting

API

Bro Cluster

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

100G 100G 100G

Transfer/Storage Nodes Science DMZ Switch

100G

Load-balancer

10G 10G 10G 10G

slide-31
SLIDE 31

Using Bro to Secure Your Science DMZ

100G Bro at LBNL

15

http://go.lbl.gov/100g

slide-32
SLIDE 32

Using Bro to Secure Your Science DMZ

Shunting at LBNL

16

slide-33
SLIDE 33

Using Bro to Secure Your Science DMZ

Shunting at LBNL

16

slide-34
SLIDE 34

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

17

Log files Host-level visibility

Visibility Detection Performance Control Customization

Suspicious activity Intelligence feeds Bro Cluster Shunting

slide-35
SLIDE 35

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

17

Log files Host-level visibility

Visibility Detection Performance Control Customization

Suspicious activity Intelligence feeds Bro Cluster Shunting Black- and whitelisting Traffic engineering

slide-36
SLIDE 36

Using Bro to Secure Your Science DMZ

Network Control

18

Shunting

API

Bro Cluster

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

100G 100G 100G

Transfer/Storage Nodes Science DMZ Switch

100G

Load-balancer

10G 10G 10G 10G

slide-37
SLIDE 37

Using Bro to Secure Your Science DMZ

Network Control

Network Control

18

API

Bro Cluster

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

100G 100G 100G

Transfer/Storage Nodes Science DMZ Switch

100G

Load-balancer

10G 10G 10G 10G

slide-38
SLIDE 38

Using Bro to Secure Your Science DMZ

Blacklisting: “Catch & Release” Dropping

19

slide-39
SLIDE 39

Using Bro to Secure Your Science DMZ

Blacklisting: “Catch & Release” Dropping

19

Source: Indiana Unversity

slide-40
SLIDE 40

Using Bro to Secure Your Science DMZ

Whitelisting: IU’s SciPass

20

slide-41
SLIDE 41

Using Bro to Secure Your Science DMZ

Whitelisting: IU’s SciPass

20

Source: Indiana University

slide-42
SLIDE 42

Using Bro to Secure Your Science DMZ

Upcoming: Bro’s NetControl Framework

21

slide-43
SLIDE 43

Using Bro to Secure Your Science DMZ

Upcoming: Bro’s NetControl Framework

21

drop_connection (connection, timeout) drop_address (host, timeout) shunt_flow (flow, timeout)

Backends OpenFlow, iptables, acld; Arista planned.

redirect (flow, port, timeout)

slide-44
SLIDE 44

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

22

Log files Host-level visibility

Visibility Detection Performance Control Customization

Suspicious activity Intelligence feeds Bro Cluster Shunting Black- and whitelisting Traffic engineering

slide-45
SLIDE 45

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

22

Log files Host-level visibility

Visibility Detection Performance Control Customization

Suspicious activity Intelligence feeds Bro Cluster Shunting Black- and whitelisting Traffic engineering Write your own scripts!

slide-46
SLIDE 46

Using Bro to Secure Your Science DMZ

Scripts are Bro’s “Magic Ingredient”

Bro comes with >10,000 lines of script code.

Prewritten functionality that’s just loaded.

Scripts generate & do everything we have seen.

Amendable to extensive customization and extension.

User community writing 3rd party scripts.

Mozilla just released >20 scripts.

23

slide-47
SLIDE 47

Using Bro to Secure Your Science DMZ

Script Example: Shunting

24

Task: Shunt all GridFTP data connections.

slide-48
SLIDE 48

Using Bro to Secure Your Science DMZ

Script Example: Shunting

24

Task: Shunt all GridFTP data connections.

event GridFTP::data_channel_detected(c: connection) { NetControl::shunt_flow( [$src_h=c$id$orig_h, $src_p=c$id$orig_p, $dst_h=c$id$resp_h, $resp_p=c$id$resp_p], 1hr); }

slide-49
SLIDE 49

Using Bro to Secure Your Science DMZ

Script Example: Scan Detector

25

Task: Count failed connection attempts per source address.

slide-50
SLIDE 50

Using Bro to Secure Your Science DMZ

Script Example: Scan Detector

25

Task: Count failed connection attempts per source address.

global attempts: table[addr] of count &default=0; event connection_rejected(c: connection) { local source = c$id$orig_h; # Get source address. local n = ++attempts[source]; # Increase counter. if ( n == SOME_THRESHOLD ) # Check for threshold. NetControl::drop_address(source, 1hr); # Drop host. }

slide-51
SLIDE 51

Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro

26

Log files Host-level visibility

Visibility Detection Performance Control Customization

Suspicious activity Intelligence feeds Bro Cluster Shunting Black- and whitelisting Traffic engineering Write your own scripts!

slide-52
SLIDE 52

Using Bro to Secure Your Science DMZ

The NSF Bro Center of Expertise

27 27

slide-53
SLIDE 53

Using Bro to Secure Your Science DMZ

The NSF Bro Center of Expertise

27 27

Individual Advice Training Material, Best Practices Development, Maintenance

http://nsf.bro.org mailto:nsf@bro.org

We are there to help you!

slide-54
SLIDE 54

The Bro Project www.bro.org info@bro.org @Bro_IDS Commercial Support www.broala.com info@broala.com @Broala_

The U.S. National Science Foundation has enabled much of Bro.

Bro is coming out of two decades of academic research, along with extensive transition to practice

  • efforts. NSF has supported much of that, and is

currently funding the Bro Center of Expertise at the International Computer Science Institute and the National Center for Supercomputing Applications.

The Bro Project is a member of Software Freedom Conservancy.

Software Freedom Conservancy, Inc. is a 501(c)(3) not-for-profit organization that helps promote, improve, develop, and defend Free, Libre, and Open Source Software projects.