Security Threat Mitigation and Response Understanding Cisco Security MARS

by Tesch, Dale; Abelar, Greg

• ISBN13: 9781587052606
• ISBN10: 1587052601
• Edition: 1st
• Format: Paperback
• Copyright: 2006-09-28
• Publisher: Cisco Press

Summary

Identify, manage, and counter security threats with the Cisco Security Monitoring, Analysis, and Response System Dale Tesch Greg Abelar While it is commonly understood that deploying network security devices is critical to the well-being of an organizationrs"s systems and data, all too often companies assume that simply having these devices is enough to maintain the integrity of network resources. To really provide effective protection for their networks, organizations need to take the next step by closely examining network infrastructure, host, application, and security events to determine if an attack has exploited devices on their networks. Ciscoreg; Security Monitoring, Analysis, and Response System (Cisco Security MARS) complements network and security infrastructure investment by delivering a security command and control solution that is easy to deploy, easy to use, and cost-effective. Cisco Security MARS fortifies deployed network devices and security countermeasures, empowering you to readily identify, manage, and eliminate network attacks and maintain compliance. Security Threat Mitigation and Response helps you understand this powerful new security paradigm that reduces your security risks and helps you comply with new data privacy standards. This book clearly presents the advantages of moving from a security reporting system to an all-inclusive security and network threat recognition and mitigation system. You will learn how Cisco Security MARS works, what the potential return on investment is for deploying Cisco Security MARS, and how to set up and configure Cisco Security MARS in your network. "Dealing with gigantic amounts of disparate data is the next big challenge in computer security; if yours"re a Cisco Security MARS user, this book is what yours"ve been looking for." Marcus J. Ranum, Chief of Security, Tenable Security, Inc. Dale Tesch is a product sales specialist for the Cisco Security MARS product line for the Cisco Systemsreg; United States AT Security team. Dale came to Cisco Systems through the acquisition of Protego Networks in February 2005. Since then, he has had the primary responsibilities of training the Cisco sales and engineering team on SIM systems and Cisco Security MARS and for providing advanced sales support to Cisco customers. Greg Abelar has been an employee of Cisco Systems since December 1996. He was an original member of the Cisco Technical Assistance Security team, helping to hire and train many of the teamrs"s engineers. He has held various positions in both the Security Architecture and Security Technical Marketing Engineering teams at Cisco. bull; bull;Understand how to protect your network with a defense-in-depth strategy bull;Examine real-world examples of cost savings realized by Cisco Security MARS deployments bull;Evaluate the technology that underpins the Cisco Security MARS appliance bull;Set up and configure Cisco Security MARS devices and customize them for your environment bull;Configure Cisco Security MARS to communicate with your existing hosts, servers, network devices, security appliances, and other devices in your network bull;Investigate reported threats and use predefined reports and queries to get additional information about events and devices in your network bull;Use custom reports and custom queries to generate device and event information about your network and security events bull;Learn firsthand from real-world customer stories how Cisco Security MARS has thwarted network attacks This security book is part of the Cisco Pressreg; Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate

Author Biography

Greg Abelar has been an employee of Cisco Systems, Inc., since December 1996. He was an original member of the Cisco Technical Assistance Security Team, helping to hire and train many of the engineers. He has held various positions in both the Security Architecture and Security Technical Marketing Engineering teams at Cisco. Greg is the primary founder and project manager of Cisco’s Written CCIE Security exam. Before his employment at Cisco, Greg worked at Apple Computer, Inc., for eight years as a TCP/IP, IPX, and AppleTalk cross-platform escalation engineer. At Apple, he also served as a project leader in the technical platform deployment for the Apple worldwide network. From 1991 to 1996, Greg worked as both a systems programmer and an IT manager for Plantronics, Inc. From 1985 to 1991, Greg was employed by the County Bank of Santa Cruz, where he worked as an applications programmer. This book is Greg’s second authorship of a technical publication; the first was a very successful and uniquely presented publication, also from Cisco Press, titled Securing Your Business with Cisco ASA and PIX Firewalls (2005). Besides authoring Cisco Press publications, he was a co-author of Version 2 of the premier Internet security architecture whitepaper, “SAFE: A Security Blueprint for Enterprise and Networks.” His credentials also include technical editing of five security publications by Cisco Press. Greg lives with his wife, Ellen, and three children, Jesse, Ethan, and Ryan, in Aptos, California.

 

Visit Greg's blog at http://security1a.blogspot.com/.

 

Dale Tesch is a product sales specialist for the CS-MARS product line for Cisco Systems’ US AT Security Team. Dale came to Cisco Systems through the acquisition of Protego Networks in February 2005 and has held the primary responsibilities of training Cisco’s Sales and Engineering team on SIMS and CS-MARS and providing advanced sales support to Cisco customers. While at Protego Networks, he was responsible for sales and engineering in parts of the United States, Canada, and Europe. Before Protego Networks, he was an AT security engineer for Cisco Systems’ U.S. Channels Organization. Dale was the founding team leader of the U.S. Channels Security Technical Advisory Team and came to Cisco originally in 2000. Before Cisco, he was the senior systems engineer at Vitts Networks, a New England–based DSL provider. Previously, Dale spent ten years in the U.S. Navy Submarine Force and is a veteran of Desert Storm. He lives in Madbury, New Hampshire, with his fiancée, Janet, and their six children, Scott, Alex, Isabella, Douglas, Andrew, and Kristyn. Dale has published several articles on SIMs, security policy, and wireless security and has been a technical editor for Cisco Press. Dale also speaks as an industry expert and trainer for various technical seminars. He holds CCNP and CISSP certifications and is a graduate of Southern New Hampshire University.

Table of Contents

Foreword	xviii
Introduction	xxi
Part I The Security Threat Identification and Response Challenge	3	(66)
Understanding SIM and STM	5	(20)
Understanding Security Information Management Legacy Threat Response	5	(5)
Understanding Security Information Management	6	(2)
Meeting the Needs of Industry Regulations	8	(1)
The Sarbanes-Oxley Act	9	(1)
Gramm-Leach-Bliley Act	10	(1)
Health Insurance Portability and Accountability Act	10	(1)
Understanding the Unified Security Platform	10	(12)
Introduction to Security Threat Mitigation	11	(1)
Benefits of Moving from SIM to STM	12	(1)
Understanding a Mitigation, Analysis, and Response System	13	(1)
Advantages of a Proactive Security Framework	14	(3)
Leveraging Your Existing Environment	17	(1)
Small-to-Medium Business Networks	17	(2)
Enterprise Networks	19	(2)
The Multivendor Approach and Associated Challenges	21	(1)
Summary	22	(3)
Role of CS-MARS in Your Network	25	(24)
The Self-Defending Network and the Expanding Role of CS-MARS	25	(16)
Understanding the Self-Defending Network	26	(1)
Defense-in-Depth and the Self-Defending Network	26	(8)
Enhancing the Self-Defending Network	34	(1)
Automated Log Correlation	34	(1)
Automated Threat Response	35	(1)
Automated Mitigation	35	(1)
CS-MARS: Filling the Gaps in the Self-Defending Network	35	(1)
CS-MARS Log Integration	36	(3)
CS-MARS Automated Threat Response	39	(1)
CS-MARS Automated Mitigation	40	(1)
CS-MARS as an STM Solution	41	(4)
Reasons for an STM	41	(1)
Day-Zero Attacks, Viruses, and Worms	41	(1)
Monitoring and Enforcing Security Policy	42	(1)
Insight, Integration, and Control of Your Network	42	(1)
Auditing Controls	43	(1)
Monitoring Access Control	43	(1)
Using CS-MARS to Justify Security Investment	43	(1)
The STM Deployment	44	(1)
Summary	45	(4)
Deriving TCO and ROI	49	(20)
Fact, FUD, and Fiction	49	(2)
FUD vs. Reality	50	(1)
Example 1: The 2005 FBI Cybercrime Reports	50	(1)
Example 2: The U.S. Critical Infrastructure Is Vulnerable	50	(1)
Real Threats to Enterprises	51	(3)
Attack Impact	54	(9)
Tangible Costs	54	(4)
Intangible Costs	58	(1)
Emerging Threats	59	(1)
Extortion	60	(1)
Zero-Day Exploits for Sale	61	(1)
Botnets and Botnet Rental	61	(1)
Impact of Attacks and Probability of Reoccurrence	62	(1)
Total Cost of Ownership	63	(1)
Using CS-MARS to Ensure ROI and Protect Your Assets	64	(2)
Cost of Recovery Without CS-MARS	64	(1)
Cost of Recovery Using CS-MARS	65	(1)
Summary	66	(3)
Part II CS-MARS Theory and Configuration	69	(136)
CS-MARS Technologies and Theory	71	(30)
Technical Introduction to the CS-MARS Appliance	71	(7)
CS-MARS at a Glance	72	(1)
CS-MARS Product Portfolio and Hardware Specifications	73	(2)
CS-MARS Terminology	75	(2)
CS-MARS Technologies	77	(1)
Database Storage and Utilization	78	(3)
CS-MARS Database Structure	79	(1)
CS-MARS Data Archiving	80	(1)
Network Topology Used for Forensic Analysis	81	(7)
CS-MARS Topology Information	82	(1)
Understanding Attack Diagrams and Attack Vectors	83	(3)
CS-MARS Network Discovery	86	(2)
NetFlow in CS-MARS	88	(2)
Understanding NetFlow	88	(1)
Using NetFlow in CS-MARS	89	(1)
Conducting Behavioral Profiling Using CS-MARS	89	(1)
Positive Alert Verification and Dynamic Vulnerability Scanning	90	(3)
Understanding False Positives	91	(1)
Understanding Vulnerability Analysis	92	(1)
Methodology of Communication	93	(6)
Communication Methods	94	(1)
Use of Agents	95	(1)
Incident Reporting and Notification Methods	96	(3)
Summary	99	(2)
CS-MARS Appliance Setup and Configuration	101	(30)
Deploying CS-MARS in Your Network	101	(7)
Network Placement	102	(2)
CS-MARS Security Hardening	104	(3)
Protocol Security Hardening	107	(1)
CS-MARS Initial Setup and Quick Install	108	(6)
Complete the Initial CS-MARS Configuration	108	(3)
Enter System Parameters Using the CS-MARS Web Interface	111	(1)
Enter System Parameters to Activate Your CS-MARS Appliance	112	(2)
CS-MARS Reporting Device Setup	114	(7)
Adding Devices	114	(1)
Manual Device Entry	114	(6)
CSV File Import	120	(1)
Creating Users and Groups	121	(1)
Configuring NetFlow and Vulnerability Scanning	122	(4)
NetFlow Configuration	123	(1)
Dynamic Vulnerability Scanning Configuration	124	(2)
Configuring CS-MARS System Maintenance	126	(1)
Configuring System Parameters	127	(1)
Summary	128	(3)
Reporting and Mitigative Device Configuration	131	(74)
Identifying CS-MARS-Supported Devices	131	(14)
Types of Devices and the Information They Provide	132	(5)
The Difference Between Reporting and Mitigation Devices	137	(1)
Reporting Devices	137	(1)
Mitigation Devices	138	(1)
Table of CS-MARS-Supported Devices	138	(7)
Configuring Devices to Communicate with CS-MARS	145	(58)
Configuring Routers	145	(1)
Configuring SNMP on Cisco IOS Routers	146	(1)
Configuring NetFlow on Cisco IOS Routers	146	(1)
Configuring Syslog on Cisco IOS Routers	147	(1)
Configuring NAC-Specific Reporting	148	(1)
Generic Router Support	149	(2)
Configuring Switches	151	(1)
Configuring Switches to Enable L2 Discovery	151	(4)
Configuring Switches to Enable Syslog	155	(1)
Configuring Switches to Enable NAC-Specific Messages	156	(2)
Configuring Switches to Enable NetFlow	158	(1)
Configuring Extreme Network Switches	159	(1)
Configuring Firewalls	160	(1)
Cisco PIX, ASA, and Firewall Service Module	161	(3)
Configuring a Juniper NetScreen Firewall	164	(2)
Check Point Firewall and Check Point Nokia Firewall Appliances	166	(1)
Configuring Web Caches to Work with CS-MARS	167	(3)
Enabling IDS and IPS in a CS-MARS Environment	170	(1)
Cisco IPS Appliance Configuration	171	(5)
Cisco IPS Catalyst Switch Modules	176	(1)
Cisco IPS Enable Routers (Integrated Security Routers)	176	(1)
Cisco Security Service Modules (IPS Modules) for ASA (ASA/SSM)	177	(1)
IntruVert IntruShield V1.8	177	(3)
Juniper NetScreen IDP	180	(1)
Symantec ManHunt	181	(2)
ISS RealSecure Sensor	183	(4)
Snort IPS Sensor	187	(1)
Enterasys Dragon	188	(1)
Operating Systems and Web Servers	188	(1)
Microsoft Windows Operating Systems	189	(4)
Sun Solaris and Generic Linux Operating Systems	193	(1)
Microsoft Internet Information Web Server	194	(2)
iPlanet Web Server	196	(1)
Apache Web Server	196	(3)
VPN Concentrators	199	(1)
Configure VPN 3000 Series Concentrators to Communicate with CS-MARS	199	(1)
Add VPN 3000 Series Concentrators to the CS-MARS Device Database	200	(1)
Antivirus Hosts and Servers	200	(1)
Database Servers	201	(1)
Oracle	201	(2)
Summary	203	(2)
Part III CS-MARS Operation	205	(76)
CS-MARS Basic Operation	207	(38)
Using the Summary Dashboard, Network Status Graphs, and My Reports Tab	207	(16)
Reading Incidents and Viewing Path Information	208	(3)
Path Information	211	(1)
Incident Vector Information	212	(1)
Using the HotSpot Graph and Attack Diagram	213	(1)
HotSpot Graph	213	(1)
Attack Diagram	214	(1)
Interpreting Events and NetFlow Graphs and False Positive Graphs	214	(2)
Understanding Data on the Information Summary Column	216	(3)
Interpreting the X, Y Axis Graphs	219	(1)
Using the Network Status Tab	220	(2)
Using My Reports	222	(1)
Using the Incidents Page	223	(9)
Using the Incidents Page	223	(1)
Incidents Tab	224	(1)
False Positives Tab	225	(2)
Cases Tab	227	(2)
Using the Incident ID to View Data	229	(3)
Simple Queries	232	(11)
Setting the Query Type	233	(2)
Instant Queries	235	(2)
On-Demand Queries and Manual Queries	237	(1)
On-Demand Queries	237	(1)
Manual Queries	238	(5)
Summary	243	(2)
Advanced Operation and Security Analysis	245	(36)
Creating Reports	245	(10)
Report Formats	246	(1)
Using Predefined Reports	247	(1)
Using the Report Tab	248	(1)
Loading Reports as an On-Demand Query	249	(2)
Creating Custom Reports	251	(2)
Methods of Report Delivery	253	(2)
Creating Rules	255	(23)
The Two Types of Rules	256	(1)
Inspection Rules	256	(1)
Drop Rules	257	(8)
Active vs. Inactive Rules	265	(1)
Creating Custom System Inspection Rules	266	(7)
Custom Rule Creation---Additional Considerations	273	(1)
Using the Query Tool to Create a Rule	274	(2)
Complex and Behavioral Rule Creation	276	(2)
Summary	278	(3)
Part IV CS-MARS in Action	281	(12)
CS-MARS Uncovered	283	(10)
State Government	283	(1)
Detection	284	(1)
Action	284	(1)
Resolution	284	(1)
Large University	284	(2)
Detection	285	(1)
Action	285	(1)
Resolution	286	(1)
Hospital	286	(2)
Detection	287	(1)
Action	287	(1)
Resolution	287	(1)
Enterprise Financial Company	288	(1)
Detection	288	(1)
Action	288	(1)
Resolution	289	(1)
Small Business	289	(2)
Detection	290	(1)
Action	290	(1)
Resolution	290	(1)
Summary	291	(2)
Part V Appendixes	293	(2)
Appendix A Useful Security Websites	295	(6)
Security Links and Descriptions	295	(6)
General Security	295	(1)
Governmental Security Controls and Information	296	(2)
Tools and Testing	298	(1)
Cisco Security Sites	298	(3)
Appendix B CS-MARS Quick Data Sheets	301	(14)
Quick Hardware and Protocol Specifications for CS-MARS	301	(4)
CS-MARS Technology Facts	304	(1)
NetFlow Platform Guide	305	(2)
NetFlow Performance Information	306	(1)
NetFlow Memory Allocation Information	307	(1)
V4.1 Product Support List	307	(8)
Appendix C CS-MARS Supplements	315	(12)
CS-MARS Evaluation Worksheet	315	(1)
Security Threat Mitigation	315	(4)
Technical Evaluation Worksheet	315	(4)
Sample Seed File	319	(1)
ISS Configuration Scripts	320	(3)
ISS Network Sensor	321	(1)
ISS Server Sensor	322	(1)
IOS and CATOS NetFlow Quick Configuration Guide	323	(4)
Configuring NetFlow Export on a Cisco IOS Device	323	(1)
Configuring NetFlow on a Cisco CATOS Switch	324	(3)
Appendix D Command-Line Interface	327	(8)
Complete Command Summary	327	(3)
CS-MARS Maintenance Commands	330	(5)
Appendix E CS-MARS Reporting	335	(14)
CS-MARS V4.1 Reports	335	(14)
Appendix F CS-MARS Console Access	349	(4)
Using Serial Console Access	349	(4)
Appendix G CS-MARS Check Point Configuration	353	(8)
Configuring Check Point NG FP3/AI and CS-MARS	353	(6)
Check Point-Side Configuration	353	(1)
CS-MARS Configuration	354	(4)
Modifying the Communications to the SmartDashboard/CMA	358	(1)
Known Open and Closed Issues	358	(1)
Configuring Check Point Provider-1 R60	359	(2)
Index	361

Excerpts

Foreword Foreword Today's biggest challenge in computer security is dealing with the huge amounts of data that pour in from disparate and distributed sources. Gigabytes of firewall logs, intrusion detection system logs, and user activity logs are more than any human can expect to cope with or analyze; we need software layers to help sort through the mass of data and turn it into useful, actionable information. The notion of "actionable" information, in this context, is especially important. It's no longer enough to inform a security administrator, "Something suspicious happened on this host at 11:54 p.m." The threats are too complex and fast-moving for a human to be effective inside the response cycle. We need software that wraps the data analysis with a knowledge base of what are reasonable reactions to take to certain classes of events, so that an administrator is presented not merely with a problem diagnosis but also a resolution recommendation. That's what Cisco's MARS is all about--turning data into actionable information and recommendations. Typically a technical book's foreword is a chance for someone who has read the book to ramble for a couple pages about some high-level topic, then end with a ringing exhortation to "buy and read this book!" For most of us, that adds nothing (except for two or three pages you can flip past), so I thought I'd approach this foreword a bit differently. To me, one of the things lacking in most technical books is a feeling for the authors themselves. Who are these guys? What motivated them to write this book? Besides, you probably didn't pick up this book because you wanted to read my pontifications--you wanted to see what Dale and Greg haveto say! Instead of my opinions, I thought I'd use this space to interview the authors about some of the things you won't find elsewhere in the book. Dear reader, let me introduce Dale Tesch, Jr, and GregAbelar: Marcus: So CS-MARS is obviously a system in which you have a lot of time and energy invested. How did you first get involved with it, and what got you excited about it? Dale:I was first introduced to MARS while I was a security engineer for Cisco working with Channel Partners. I had a partner approach me looking for a solution that could help them deploy a security managed service to their customers. They had customers with all kinds of products and looked to Cisco to help them find a solution. Cisco did not have a product that could help them, so I started looking outside the Cisco product set. I turned to my fellow engineers in Cisco and discovered one of them left Cisco to start up Protego Networks. They had a product that may do what my Cisco Partners needed. I contacted him and fell in love with the product. As a security engineer I was very passionate about security technology that promised what it delivered, and MARS delivered what I needed and more. It filled a gap in the security market that no company was fulfilling. I knew it was going to take off! Protego MARS was so simple to operate yet very strong in SIM and behavioral analysis. It was making me so successful with our key security partners that I decided to leave Cisco and join Protego. Greg:I first experienced CS-MARS when it was still part of a company called Protego. I was deeply involved in network intrusion prevention systems (IPS) at the time. IPSs have their strengths, but their value is diminished by the huge volume of noise and false positive alerts they generate. A friend of mine called me asking about a company called Protego that had a device that could supposedly reduce false positive alerts. Intrigued, I set out to find out a little bit about this technology. As luck would have it, the next day I saw some engineers testing a Protego box in the lab, so I hung out to see what the big deal was. Big deal, indeed. I saw a demo where they ran an attack that triggered a group of IPS alerts, but CS-MARS consolidated those alerts to a single event and also recommended a command to mitigate the attack. It did multidevice event consolidation and event correlation. It was easy to use and also made and deployed mitigation recommendations. The rest is history. I was hooked. Cisco acquired Protego, and the daily nightmare that security responders faced dealing with several thousand alerts was significantly reduced. They suddenly had a tool that improved their efficiency to a level that was staggering. Marcus: You're talking about a technology that sits right in the middle of the entire computer/network security problem--it's a lot to get a handle on! How did you figure out where to start? Greg:On the surface CS-MARS appears to be a tame animal. You launch the GUI, configure it, then off you go, right? Well, right but also wrong. Your question indicates there is much more to it than that, and you are correct. You can configure CS-MARS with a basic configuration and get some valuable data that will help you respond to threats. But to get the most out of your CS-MARS appliance, you need to have a good understanding of your network topology, your security devices, and how attacks work. Then you need to understand the capabilities of the CS-MARS product. This book answers exactly this question. It not only addresses how to start working with CS-MARS, but it also addresses where you go after you have started. Looking at the book from a high level, we take the reader from the basics of security reporting and mitigation, explain any new terminology and technology used by CS-MARS, explain basic configurations, and then explain how to interpret incidents as they are reported. To simplify the learning experience for the reader, the book includes plenty of step-by-step guidelines as well as clearly explained technical tidbits to give you an excellent jumpstart into this technology. Dale:Good old trial and error worked for me! You can take all kinds of advice, training courses, or pointers from the pro's, but until you get your feet wet in real operational networks with the technology, you can never get the insight and experience on how to solve business problems with it. Marcus: Dale, you say it's important to experiment. Do you remember any "AHA!" moments that you've had that really made things click for you? I've found with many of the products I've worked, sometimes you use it in a way that nobody expects, and it works great. It's always fun when you talk to the designers and say, "It's great for doing blah blah blah," and they respond, "Really!!? We never thought of that!" Dale:When I first joined Protego and really started working with MARS, I discovered the product was schizophrenic. Meaning, it had many personalities. The appliance was built for security threat detection, analysis, and mitigation, yet it could play many other roles in a network. Shortly before the acquisition by Cisco, I was in a VARS SOC. I was rather impressed by the facility they had and how automated it was. They were bragging about how they could manage it remotely from anywhere via the web. Their HVAC system, physical security system, and lighting systems were all automated and sent log data via SNMP. Just for show and tell and a little experiment, we configured the systems to report to MARS and built rules outlining normal behavior of temperatures, lighting, and physical access control. We began to design rules and alarms to go off when temps went out of range, visitors checked in but not out, and even when certain lights were turned on during odd hours. The VAR then took this to the company that sold them the building systems and they bought one for themselves. They are now positioning it as a monitoring solution for their building automation products. They recently ins