Practical Reflection

Chapter08_Lecture_Collection.pdf

Home >Computer Science homework help >Practical Reflection

Chapter 8

Collection

Cyber Attacks Protecting National Infrastructure, 1st ed.

• Diligent and ongoing observation of computing and networking behavior can highlight malicious activity – The processing and analysis required for this must be done

within a program of data collection

• A national collection process that combines local, regional, and aggregated data does not exist in an organized manner

C h a p te

r 8 –

C o lle

c tio

Introduction

Fig. 8.1 – Local, regional, and national data collection with aggregation

C h a p te

r 8 –

C o lle

c tio

• At local and national levels data collection decisions for national infrastructure should be based on the following security goals – Preventing an attack

– Mitigating an attack

– Analyzing an attack

• Data collection must be justified (who is collecting and why)

• The quality of data is more important than the quantity

C h a p te

r 8 –

C o lle

c tio

Introduction

C h a p te

r 8 –

C o lle

c tio

Fig. 8.2 – Justification-based decision analysis template for data collection

• Metadata is perhaps the most useful type of data for collection in national infrastructure – Metadata is information about data, not what the data is

about

• Data collection systems need to keep pace with growth of carrier backbones

• Sampling data takes less time, but unsampled data may be reveal more

C h a p te

r 8 –

C o lle

c tio

Collecting Network Data

C h a p te

r 8 –

C o lle

c tio

Fig. 8.3 – Generic data collection schematic

C h a p te

r 8 –

C o lle

c tio

Fig. 8.4 – Collection detects evidence of vulnerability in advance of notification

• National initiatives have not traditionally collected data from mainframes, servers, and PCs

• The ultimate goal should be to collect data from all relevant computers, even if that goal is beyond current capacity

• System monitoring may reveal troubling patterns

• Two techniques useful for embedding system management data – Inventory process needed to identify critical systems

– Process of instrumenting or reusing data collection facilities must be identified

C h a p te

r 8 –

C o lle

c tio

Collecting System Data

C h a p te

r 8 –

C o lle

c tio

Fig. 8.5 – Collecting data from mainframes, servers, and PCs

Security Information and Event Management

• Security information and event management (SIEM) is the process of aggregating system data from multiple sources for purpose of protection

• Each SIEM system (in a national system of data collection) would collect, filter, and process data

• Objections to this approach include both the cost of setting up the architecture and the fact that embedded SIEM functionality might introduce problems locally

C h a p te

r 8 –

C o lle

c tio

C h a p te

r 8 –

C o lle

c tio

Fig. 8.6 – Generic SIEM architecture

C h a p te

r 8 –

C o lle

c tio

Fig. 8.7 – Generic national SIEM architecture

• Identifying trends is the most fundamental processing technique for data collected across the infrastructure

• Simplest terms – Some quantities go up (growth)

– Some quantities go down (reduction)

– Some quantities stay the same (leveling)

– Some quantities doing none of the above (unpredictability)

C h a p te

r 8 –

C o lle

c tio

Large-Scale Trending

C h a p te

r 8 –

C o lle

c tio

Fig. 8.8 – Growth trend in botnet behavior over 9-month period (2006–

2007)

• Some basic practical considerations that must be made by security analysts before a trend can be trusted – Underlying collection

– Volunteered data

– Relevant coverage

C h a p te

r 8 –

C o lle

c tio

Large-Scale Trending

• Collecting network metadata allows security analysts track a worm’s progress and predict its course

• Consensus holds that worms work too fast for data collection to be an effective defense – There’s actually some evidence that a closer look at the

data might provide early warning of worm threats

• After collecting and analyzing, the next step is acting on the data in a timely manner

C h a p te

r 8 –

C o lle

c tio

Tracking a Worm

C h a p te

r 8 –

C o lle

c tio

Fig. 8.9 – Coarse view of UDP traffic spike from SQL/Slammer worm

(Figure courtesy of Dave Gross and Brian Rexroad)

C h a p te

r 8 –

C o lle

c tio

Fig. 8.10 – Fine view of UDP traffic spike from SQL/Slammer worm (Figure courtesy of Dave Gross and Brian Rexroad)

• Once the idea for a national data collection program is accepted, the following need to be addressed – Data sources

– Protected transit

– Storage considerations

– Data reduction emphasis

C h a p te

r 8 –

C o lle

c tio

National Collection Program