Using Bro to Secure Your Science DMZ Robin Sommer International - PowerPoint PPT Presentation

Using Bro to Secure Your Science DMZ Robin Sommer International Computer Science Institute, & Lawrence Berkeley National Laboratory robin@icsi.berkeley.edu http://www.icir.org/robin Using Bro to Secure Your Science DMZ

Securing Your Science DMZ Network 100G 10G 10G Internet 100G Science DMZ Switch Campus LAN 100G Transfer/Storage Nodes 2 Using Bro to Secure Your Science DMZ

Securing Your Science DMZ Network 100G 10G 10G Internet 100G Science DMZ 100G Switch Campus LAN 100G Bro Transfer/Storage Nodes 2 Using Bro to Secure Your Science DMZ

The Bro Platform 3 Using Bro to Secure Your Science DMZ

The Bro Platform Open Source BSD License Analysis Traffic Intrusion Vulnerabilit. Traffic Compliance File Analysis Measure- Detection Mgmt Control Monitoring ment Programming Language Standard Library Platform Packet Processing Tap Network 3 Using Bro to Secure Your Science DMZ

Protecting open-science The Bro Platform Open Source networks for 20 years now. BSD License Analysis Traffic Intrusion Vulnerabilit. Traffic Compliance File Analysis Measure- Detection Mgmt Control Monitoring ment Programming Language Standard Library Platform Packet Processing Tap Network 3 Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro Visibility Detection Performance Control Customization 4 Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro Log files Visibility Host-level visibility Detection Performance Control Customization 4 Using Bro to Secure Your Science DMZ

Connections Logs 5 Using Bro to Secure Your Science DMZ

Connections Logs conn.log Timestamp ts 1393099191.817686 Unique ID uid Cy3S2U2sbarorQgmw6a Originator IP id.orig_h 177.22.211.144 Originator Port id.orig_p 48053 Responder IP id.resp_h 115.25.19.26 Responder Port id.resp_p 2811 IP Protocol proto tcp App-layer Protocol service gridftp,ssl Duration duration 8.405155 Bytes by Originator orig_bytes 13490 Bytes by Responder resp_bytes 16127 TCP state conn_state SF Local Originator? local_orig F State History history ShAdDaFf Outer Tunnels tunnel_parents (empty) 5 Using Bro to Secure Your Science DMZ

HTTP http.log ts 1393099291.589208 uid CKFUW73bIADw0r9pl id.orig_h 2a07:f2c0:90:402:41e:c13:6cb:99c id.orig_p 54352 id.resp_h 2406:fe60:f47::aaeb:98c id.resp_p 80 method POST host com-services.pandonetworks.com uri /soapservices/services/SessionStart referrer - user_agent Mozilla/4.0 (Windows; U) Pando/2.6.0.8 status_code 200 username anonymous password - orig_mime_types application/xml resp_mime_types application/xml 6 Using Bro to Secure Your Science DMZ

SSL ts 1443449046.841848 ssl.log uid CEA05l2D7k0BD9Dda2 id.orig_h 1.2.3.4 id.orig_p 59208 id.resp_h 131.243.231.10 id.resp_p 2811 version TLSv12 cipher TLS_RSA_WITH_AES_256_GCM_SHA384 server_name - CN=lrc-xfer.lbl.gov,OU=Services,O=Open subject Science Grid,DC=DigiCert-Grid,DC=com CN=DigiCert Grid CA-1,O=DigiCert issuer Grid,DC=DigiCert-Grid,DC=com client_subject CN=Foo Bar,O=LBNL HPCS,O=Globus,C=US CN=GO HPCS ONLINE,OU=HPCS client_issuer LBNL,DC=LBL,DC=gov cert_hash 197cab7c6c92a0b9ac5f37cfb0699268 validation_status ok 7 Using Bro to Secure Your Science DMZ

Bro Analyzers AYIYA Ident Rlogin BitTorrent Kerberos Rsh DCE_RPC Login SIP DHCP Modbus SMTP DNP3 MySQL SNMP DNS NCP SOCKS DTLS NFS SSH FTP NTP SSL Finger NetBIOS Syslog GTPv1 PE Telnet Gnutella POP3 Teredo HTTP Portmapper X509 ICMP Radius ZIP IRC RDP 8 Using Bro to Secure Your Science DMZ

Host-level Visibility Leverage control over end hosts. 9 Using Bro to Secure Your Science DMZ

Host-level Visibility Leverage control over end hosts. iSSHD Source: NERSC 9 Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro Log files Visibility Host-level visibility Detection Performance Control Customization 10 Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro Log files Visibility Host-level visibility Suspicious activity Detection Intelligence feeds Performance Control Customization 10 Using Bro to Secure Your Science DMZ

Watching for Suspicious Logins 11 Using Bro to Secure Your Science DMZ

Watching for Suspicious Logins SSH::Watched_Country_Login Successful login from an unexpected country. 11 Using Bro to Secure Your Science DMZ

Watching for Suspicious Logins SSH::Watched_Country_Login Successful login from an unexpected country. SSH::Interesting_Hostname_Login Successful login from an unusual host name. smtp.big-university.edu 11 Using Bro to Secure Your Science DMZ

Intelligence Integration Internal Internet Network 12 Using Bro to Secure Your Science DMZ

Intelligence Integration Internal Internet Network Intelligence Traffic Monitoring IP addresses HTTP , FTP , SSL, SSH, FTP , DNS names DNS, SMTP , … URLs File hashes Feeds CIF JC3 Spamhaus Custom/Proprietary 12 Using Bro to Secure Your Science DMZ

Intelligence Integration Internal Internet Network Intelligence Traffic Monitoring IP addresses HTTP , FTP , SSL, SSH, FTP , DNS names DNS, SMTP , … URLs ts 1258565309.806483 File hashes uid CAK677xaOmi66X4Th Feeds id.orig_h 192.168.1.103 id.resp_h 192.168.1.1 CIF note Intel::Notice JC3 indicator baddomain.com Spamhaus indicator_type Intel::DOMAIN Custom/Proprietary where HTTP::IN_HOST_HEADER source My-Private-Feed notice.log 12 Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro Log files Visibility Host-level visibility Suspicious activity Detection Intelligence feeds Performance Control Customization 13 Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro Log files Visibility Host-level visibility Suspicious activity Detection Intelligence feeds Bro Cluster Performance Shunting Control Customization 13 Using Bro to Secure Your Science DMZ

Scaling Bro to 100G Science DMZ 100G Switch 100G Bro 100G 100G Transfer/Storage Nodes 14 Using Bro to Secure Your Science DMZ

Scaling Bro to 100G Science DMZ 100G Switch 100G 100G 100G Transfer/Storage Nodes 14 Using Bro to Secure Your Science DMZ

Scaling Bro to 100G Science DMZ 100G Switch Load-balancer 100G 100G 10G 10G 10G 10G 100G Transfer/Storage Nodes Bro Cluster 14 Using Bro to Secure Your Science DMZ

Scaling Bro to 100G Science DMZ 100G Switch Load-balancer 100G 100G 10G 10G 10G 10G 100G NIC NIC NIC NIC Transfer/Storage Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Nodes Bro Bro Bro Bro Bro Bro Bro Bro Node Node Node Node Bro Cluster 14 Using Bro to Secure Your Science DMZ

Scaling Bro to 100G Science DMZ 100G Switch Load-balancer API 100G Shunting 100G 10G 10G 10G 10G 100G NIC NIC NIC NIC Transfer/Storage Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Nodes Bro Bro Bro Bro Bro Bro Bro Bro Node Node Node Node Bro Cluster 14 Using Bro to Secure Your Science DMZ

100G Bro at LBNL http://go.lbl.gov/100g 15 Using Bro to Secure Your Science DMZ

Shunting at LBNL 16 Using Bro to Secure Your Science DMZ

Shunting at LBNL 16 Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro Log files Visibility Host-level visibility Suspicious activity Detection Intelligence feeds Bro Cluster Performance Shunting Control Customization 17 Using Bro to Secure Your Science DMZ

Science DMZ Monitoring with Bro Log files Visibility Host-level visibility Suspicious activity Detection Intelligence feeds Bro Cluster Performance Shunting Black- and whitelisting Control Traffic engineering Customization 17 Using Bro to Secure Your Science DMZ

Network Control Science DMZ 100G Switch Load-balancer API 100G Shunting 100G 10G 10G 10G 10G 100G NIC NIC NIC NIC Transfer/Storage Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Nodes Bro Bro Bro Bro Bro Bro Bro Bro Node Node Node Node Bro Cluster 18 Using Bro to Secure Your Science DMZ

Network Control Science DMZ 100G Switch Network Control Load-balancer API 100G 100G 10G 10G 10G 10G 100G NIC NIC NIC NIC Transfer/Storage Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Bro Nodes Bro Bro Bro Bro Bro Bro Bro Bro Node Node Node Node Bro Cluster 18 Using Bro to Secure Your Science DMZ

Blacklisting: “Catch & Release” Dropping 19 Using Bro to Secure Your Science DMZ

Blacklisting: “Catch & Release” Dropping Source: Indiana Unversity 19 Using Bro to Secure Your Science DMZ

Whitelisting: IU’s SciPass 20 Using Bro to Secure Your Science DMZ

Whitelisting: IU’s SciPass Source: Indiana University 20 Using Bro to Secure Your Science DMZ

Upcoming: Bro’s NetControl Framework 21 Using Bro to Secure Your Science DMZ

Upcoming: Bro’s NetControl Framework drop_connection ( connection , timeout ) drop_address ( host , timeout ) shunt_flow ( flow , timeout ) redirect (flow, port, timeout) Backends OpenFlow, iptables, acld; Arista planned. 21 Using Bro to Secure Your Science DMZ