SIEM (Security Information and Event Management)

What is SIEM?

Security information and event management (SIEM) is an approach to security management that combines SIM (security information management) and SEM (security event management) functions into one security management system.

§  A SIEM system collects logs and other security-related documentation for analysis. Most SIEM systems work by deploying multiple collection agents in a hierarchical manner to gather security-related events from end-user devices, servers, network equipment -- and even specialized security equipment like firewalls, antivirus or intrusion prevention systems.

Why is SIEM Necessary?

Ø  Rise in data breaches due to internal and external threats.

Ø  Attackers are smart and traditional security tools just are not enough.

Ø  Mitigate sophisticated cyber-attacks.

Ø  Manages large volumes of logs from multiple sources.

Ø  Meets exact compliance requirements

Why do organizations use it?

Threat Management:

The ability to detect risky scenarios and common attacks, as well as attack paths defined by the organization itself.

Compliancy:

                Joining the logs and reports of multiple systems within the organization, enabling an easy access and analysis by a built-in framework in each system.

Forensic Support:

Ø  The information available within SIEM is very valuable from a forensic perspective and can greatly aid a forensic analyst in his or her investigation.

Ø  SIEM allows forensic analysts to search within logs of many systems in a centralized way, without the need of re-collecting the log files of compromised systems.

Protection (What and How):

Implementation of SIEM:

Requirements:

  Ø  All Unix systems need a centralized logging system to be developed for the SIEM. Databases require a great many configuration steps

  Ø  Each web server needs a new process installed to monitor the web logs. Taking logs from cloud resources on AWS involves another complex series of configuration procedure.

  Ø  SIEM requires highly skilled IT personnel resources.

  Ø  Patching, hardware refreshes and overall change management have to be coordinated with SIEM

Use Cases:

SIEM Tools:

•       Hewlett Packard Enterprise (HPE) ArcSight

•       Splunk Enterprise Security (ES)

•       IBM Security QRadar

•       AlienVault Unified Security Management (USM)

•       LogRhythm SIEM

•       McAfee Enterprise Security Manager (ESM)

•       Micro Focus Sentinel Enterprise

•       SolarWinds Log & Event Manager

•       Trustwave SIEM Enterprise and Log Management Enterprise

•       RSA NetWitness Suite

"It takes time and effort to get things set up, and this is going to be a manpower initiative proportional to the complexity of organization"

Basic Networking topics

Footprinting: Footprinting is the most convenient way to gather the system information or data. It helps to give the information about all the system regarding remote accessibility, port activity etc. It helps the intruder to take the complete control over the system. It not only helps the intruder but also to the security provider, it gives information of the loopholes in the system.

Google Hacking: Google Hacking is one of the computer hacking technique which involves with Google search engine and Google applications to find out the configuration and security codes. That configuration gives intruder a chance to employ a scanner, which scans massive amount of information of system.

Scanning: Scanning is nothing but looking all over in order to detect some part. In networking scanning is a process to identify the active host, even it might not be serious threat host scanning takes plays in security basis. Scanner will consider ports, active host, network and many. It helps for monitoring and analysis of a system.

Enumeration: Enumeration is a computing activity which retrieves the services of networked computers. It is used to identify the host or devices in network. It usually runs with the protocol ICMP and SNMP to gather information. For the services it also scans the port and remote hosts, to know the functionality performed by the host. Some scanners also perform the enumeration operation.

System Hacking: It is a process to manipulate the normal behavior of a system by some technical effort. Basically hacking takes place with a skilled programmer which changes the behavior of the system, sometimes total control of the system.

Trojan: Trojan is a malicious software which attracts the user with routine, interesting, appears useful to install. Trojan generally spread by social engineering or by download.

Back Doors: Backdoor is mostly used in security purpose while unauthorized user get access to a computer remotely.

Virus: Virus is a programming code which is a self-replicate, which induce into the another program and effects the executable code. Virus may attack from the email, by downloads or by CD drives. Some viruses show their effect immediately to the system where some goes when had made initiate to move on.

Worms: Worm is also a self-replicating malicious code and penetrates into the operating system. It makes harmful to the system functionality. Worms basically effects through an existed file were virus don’t. Many worms are created just spread over the system not to change over the system credibility.

Sniffers: Sniffers is a program or a device which is used to monitor the data traveling of a system. Sniffers can be used for the functionality management of a legitimate network and also for the stealing of the information. It is very difficult to detect the unauthorized sniffers they are extremely dangerous. Hackers use sniffer as a weapon in this account.

Social Engineering: It is a non-technical method used by the intruders where heavy human interaction takes place. By breaking normal security procedure this is a trick usually plays by the intruder.

Denial of Service: In networking denial of service is to make unavailable to user/users. It is happened due to source attack with thousands of IP addresses. This attack is to make the service suspend for temporarily. DOS attack will be mostly effected highly used websites, banks etc.

Session Hijacking: The Session Hijacking attack consists of the exploitation of the web session control mechanism, which is normally managed for a session token. Because http communication uses many different TCP connections, the web server needs a method to recognize every user’s connections. The most useful method depends on a token that the Web Server sends to the client browser after a successful client authentication. The Session Hijacking attack compromises the session token by stealing or predicting a valid session token to gain unauthorized access to the Web Server.

Hacking Web Servers: A web server is program that stores files and makes them accessible via network or internet. A web server requires both hardware and software. Attackers usually target to exploits in the software and gains the authorization and enters into the server.

Password Cracking: Password cracking is the process of recovering data that have been stored in a computer system. By repeating this process, the cryptographic hash can be found by the attacker. There are different techniques for password cracking which is called as password cracking techniques like phishing, brute force attack etc.

SQL Injection: SQL injection is a code injection technique, which involves some malicious SQL statements for execution to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution. SQL injection must exploit a security vulnerability in an application's software.

Vulnerability:

In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw.

Web Application Vulnerabilities: The loopholes obtained in the web applications is nothing but called as Web Application Vulnerabilities. The vulnerability which is not patched by the user or organization, by taking that advantage attacker can change the code in the web application. Sometimes new vulnerabilities can be created by the attacker and attacks the organization.

Phishing: Phishing is an attempt made by the intruder to acquire sensitive data from the user. Basically it goes through communication sites(mails) which helps for an intruder to attract user by interaction. Once user get attracted with the phishing mails he used to accept the malware unknowingly which spread into the system and also breaks credentials of the user authentication.

Hacking E-mail Accounts: It is an illegal way to manipulate the account, Accounts will be hack on by stealing the password. Emails get hack with weak passwords, by key logger activity, social engineering.

OWASP top 10 Vulnerabilities-2016

OWASP Top Ten Proactive Controls 2016

The OWASP Top Ten Proactive Controls 2016 is a list of security concepts that should be
included in every software development project. They are ordered by order of importance, with
control number 1 being the most important.

1. Verify for Security Early and Often
2. Parameterize Queries
3. Encode Data
4. Validate All Inputs
5. Implement Identity and Authentication Controls
6. Implement Appropriate Access Controls
7. Protect Data
8. Implement Logging and Intrusion Detection
9. Leverage Security Frameworks and Libraries
10. Error and Exception Handling

OSI

The OSI Model:

Seven Layers of Computer Networks

Introduction:

The Open Systems Interconnection (OSI) model is a reference tool for understanding data communications between any two networked systems. It divides the communications processes into seven layers. Each layer both performs specific functions to support the layers above it and offers services to the layers below it. The three lowest layers focus on passing traffic through the network to an end system. The top four layers come into play in the end system to complete the process. This white paper will provide you with an understanding of each of the seven layers, including their functions
and their relationships to each other. This will provide you with an overview of the network process, which can then act as a framework for understanding the details of computer networking.
Since the discussion of networking often includes talk of “extra layers”, this paper will address these unofficial layers as well.

Although TCP/IP has been used for network communications before the adoption of the OSI model, it supports the same functions and features in a differently layered arrangement.

Layer 1 – The Physical Layer

The physical layer of the OSI model defines connector and interface specifications, as well as the medium
(cable) requirements. Electrical, mechanical, functional, and procedural specifications are provided for sending a bit stream on a computer network.


Components of the physical layer include:

• Cabling system components
• Adapters that connect media to physical interfaces
• Connector design and pin assignments
• Hub, repeater, and patch panel specifications
• Wireless system components
• Parallel SCSI (Small Computer System Interface)
• Network Interface Card (NIC)
In a LAN environment, Category 5e UTP (Unshielded Twisted Pair) cable is generally used for the physical layer for individual device connections. Fiber optic cabling is often used for the physical layer in a vertical or riser backbone link. The IEEE, EIA/TIA, ANSI, and other similar standards bodies developed standards for this layer.

Note: The Physical Layer of the OSI model is only part of a LAN (Local Area Network).


Layer 2 – The Data Link Layer

Layer 2 of the OSI model provides the following functions:

• Allows a device to access the network to send and receive messages
• Offers a physical address so a device’s data can be sent on the network
• Works with a device’s networking software when sending and receiving messages
• Provides error-detection capability
Common networking components that function at layer 2 include:
• Network interface cards
• Ethernet and Token Ring switches
• Bridges
NICs have a layer 2 or MAC address. A switch uses this address to filter and forward traffic, helping relieve congestion and collisions on a network segment.

Bridges and switches function in a similar fashion; however, bridging is normally a software program on a CPU, while switches use Application-Specific Integrated Circuits (ASICs) to perform the task in dedicated hardware, which is much faster.

Layer 3 – The Network Layer

Layer 3, the network layer of the OSI model, provides an end-to-end logical addressing system so that a packet of data can be routed across several layer 2 networks (Ethernet, Token Ring, Frame Relay, etc.).

Initially, software manufacturers, such as Novell, developed proprietary layer 3 addressing. However, the networking industry has evolved to the point that it requires a common layer 3 addressing system. The Internet Protocol (IP) addresses make networks easier to both set up and connect with one another. The Internet uses IP addressing to provide connectivity to millions of networks around the world.
To make it easier to manage the network and control the flow of packets, many organizations separate their network layer addressing into smaller parts known as subnets. Routers use the network or subnet portion of the IP addressing to route traffic between different networks. Each router must be configured specifically for the networks or subnets that will be connected to its interfaces.

Routers communicate with one another using routing protocols, such as Routing Information Protocol (RIP) and Open version of Shortest Path First (OSPF), to learn of other networks that are present and to calculate the best way to reach each network based on a variety of criteria (such as the path with the fewest routers). Routers and other networked systems make these routing decisions at the network layer.
When passing packets between different networks, it may become necessary to adjust their outbound size to one that is compatible with the layer 2 protocol that is being used. The network layer accomplishes this via a process known as fragmentation. A router’s network layer is usually responsible for doing the fragmentation. All reassembly of fragmented packets happens at the network layer of the final destination system.

Two of the additional functions of the network layer are diagnostics and the reporting of logical variations in normal network operation. While the network layer diagnostics may be initiated by any networked system, the system discovering the variation reports it to the original sender of the packet that is found to be outside normal network operation. The variation reporting exception is content validation calculations. If the calculation done by the receiving system does not match the value sent by the originating system, the receiver discards the related packet with no report to the sender. Retransmission is left to a higher layer’s protocol. Some basic security functionality can also be set up by filtering traffic using layer 3 addressing on routers or other similar devices.

Layer 4 – The Transport Layer

Layer 4, the transport layer of the OSI model, offers end-to-end communication between end devices through a network. Depending on the application, the transport layer either offers reliable, connection-oriented or connectionless, best-effort communications.
Some of the functions offered by the transport layer include:
• Application identification
• Client-side entity identification
• Confirmation that the entire message arrived intact
• Segmentation of data for network transport
• Control of data flow to prevent memory overruns
• Establishment and maintenance of both ends of virtual circuits
• Transmission-error detection
• Realignment of segmented data in the correct order on the receiving side
• Multiplexing or sharing of multiple sessions over a single physical link
The most common transport layer protocols are the connection-oriented TCP Transmission Control Protocol (TCP) and the connectionless UDP User Datagram Protocol (UDP).


Layer 5 – The Session Layer

Layer 5, the session layer, provides various services, including tracking the number of bytes that each end of the session has acknowledged receiving from the other end of the session. This session layer allows applications functioning on devices to establish, manage, and terminate a dialog through a network. Session layer functionality includes:
• Virtual connection between application entities
• Synchronization of data flow
• Creation of dialog units
• Connection parameter negotiations
• Partitioning of services into functional groups
• Acknowledgements of data received during a session
• Retransmission of data if it is not received by a device

Layer 6 – The Presentation Layer


Layer 6, the presentation layer, is responsible for how an application formats the data to be sent out onto the network. The presentation layer basically allows an application to read (or understand) the message.
Examples of presentation layer functionality include:
• Encryption and decryption of a message for security
• Compression and expansion of a message so that it travels efficiently
• Graphics formatting
• Content translation
• System-specific translation

Layer 7 – The Application Layer

Layer 7, the application layer, provides an interface for the end user operating a device connected to a network. This layer is what the user sees, in terms of loading an application (such as Web browser or e-mail); that
is, this application layer is the data the user views while using these applications.
Examples of application layer functionality include:
• Support for file transfers
• Ability to print on a network
• Electronic mail
• Electronic messaging
• Browsing the World Wide Web

Layers 8, 9, and 10

Whether a designed to be a humorous extension or a secret technician code, layers 8, 9, and 10 are not officially part of the OSI model. They refer to the non-technical aspects of computer networking that often interfere with the smooth design and operation of the network.

Layer 8 is usually considered the “office politics” layer. In most organizations, there is at least one group who is favored, at least temporarily, by management and receives “special” treatment. When it comes to networking, this may mean that this group always has the latest and/or fastest equipment and highest speed network links.

Layer 9 is generally referred to as the “blinders” layer. This layer applies to organizational managers who have already decided, usually with little or no current information, to dictate a previously successful network plan. They may say things such as:
“It worked in my last company, so we will use it here.”
“Everybody says this is the right solution.”
“I read in an airline magazine that this was the best way to do it so that is what we will do.”
What these managers seem to forget is that they are paying a highly qualified staff to provide them with useful information. These managers bypass planning in order to make a quick decision.

Layer 10, the “user” layer, is in every organization. But users are much more than a layer. While they are one of the reasons the network exists, users can also be a big part of the need for troubleshooting. This is especially true when the users have computers at home and have decided to “help” the network administrator or manager by making changes to the network without consulting the network staff. Equally challenging is the user who “didn’t do anything” when the network segment in his/her immediate vicinity suddenly stopped working. In these cases, the layer 10 identification coincides with layer 10 troubles (and the “ID10T” label some technicians have used).

TCP/IP Model Overview

The OSI model describes computer networking in seven layers. While there have been implementations of networking protocol that use those seven layers, most networks today use TCP/IP. But, networking professionals continue to describe networking functions in relation to the OSI layer that performs those tasks.

The TCP/IP model uses four layers to perform the functions of the seven-layer OSI model.
The network access layer is functionally equal to a combination of OSI physical and data link layers (1 and 2). The Internet layer performs the same functions as the OSI network layer (3).
Things get a bit more complicated at the host-to-host layer of the TCP/IP model. If the host-to-host protocol is TCP, the matching functionality is found in the OSI transport and session layers (4 and 5). Using UDP equates to the functions of only the transport layer of the OSI model.
The TCP/IP process layer, when used with TCP, provides the functions of the OSI model’s presentation and application layers (6 and 7). When the TCP/IP transport layer protocol is UDP, the process layer’s functions are equivalent to OSI session, presentation, and application layers (5, 6, and 7).

Equipment at the Layers

Some of the layers use equipment to support the identified functions. Hub related activity is “Layer One”.
The naming of some devices designates the functional layer such as “Layer Two Switch” or “Layer Three
Switch”. Router functions focus on “Layer Three”. User workstations and servers are often identified with
“Layer Seven”.