- Security analyst in the security operations center,
in the SOC, always have to try
to have complete visibility
into what's happening in the network.
However, that task is easier said than done.
There are a lot of different challenges
that can lead into false negatives.
So, in other words,
where you cannot detect malicious
or abnormal activity in the network.
And here I'm actually, I'm gonna go over
and highlight some of these challenges
that you will indeed face in the security operation center.
The first one by far, is encryption.
Encryption has a lot of benefits for security,
a lot of benefits for privacy.
But in the world of instant response and forensics
it can present a lot of different challenges.
Even law enforcement agencies have been fascinated
with the dual nature use of encryption.
Whenever you protect information
and communications, definitely encryption
has numerous benefits.
However, the same mechanisms can be used
by threat actors as a method of evasion and obfuscation.
Now, many security products including next generation IPS
and next generation firewalls can intercept, decrypt
and inspect, and then re-encrypt the traffic,
even ignore the encrypted traffic payloads
in some cases, right?
However, some people may consider this
a man in the middle attack
and specifically nowadays with a lot of privacy concerns,
a lot of companies are actually trying to divorce
from that specially, because of regulation, right?
Think about GDPR for example.
Now, you can still use metadata from network traffic
and other different security event sources
to investigate and solve security issues.
Now, you can obtain a lot of good information
by leveraging things like net flow, firewall logs,
web proxy logs, user authentication information
and even passive DNS data.
Now, Cisco has a technology
called encrypted traffic analytics
which basically, is integrated into Stealthwatch
and cognitive security, which will help you determine
if some type of communication may be malicious
by examining that network metadata, you know,
including net flow and logs from servers,
logs from firewalls and so on,
to be able to determine that, right?
And it also uses behind the scenes
something that we call cognitive security.
Another challenge that you may encounter
in the security operations world, right,
is whenever you are inspecting traffic
that may be, you know, coming after a device
is actually performing network address translation or NAT.
And specifically, also whenever
you're doing port address translation,
in other words, PAT, right?
That can present a challenge whenever
you're performing security monitoring
and analyzing logs and you know,
many other things like even net flow
that we just mentioned because what you're seeing
in the log is the translated IP address versus
the real IP address that each of the systems has, right?
So, in the case of port address translation
or PAT, this could become even more problematic
because many different hosts behind that device,
behind that network infrastructure device,
whether it's a firewall or a router, you know,
a switch and so on, can be translated
to a single address, making the correlation
basically impossible to achieve, right?
Now, some security products
like the Cisco StealthWatch system,
it provides features that can be used
to correlate a map, or unquote, map
that translated IP address with things like NetFlow.
This feature in the StealthWatch system
is called NAT stitching.
And basically this accelerates the incident response task
and uses the continuous security, you know,
monitoring operations within your environment.
Another big challenge in a security operations center
and basically, in your security operations as a whole,
is whenever different systems
are not using the correct time.
And that's why it's extremely important for you
to use the network time protocol, to ensure
that the correct time is actually set
in all the devices within the network
and they're synchronized.
That's because it actually will help you,
I mean, of course correlate the information.
Imagine if you have a log saying
that it's two o'clock in the morning
and you know, something malicious was happening,
and the next device that you're trying
to correlate the information from,
it says that no, it's three o'clock in the morning.
So, it makes it extremely hard
if not impossible for you to be able
to correlate and protect your network.
Now, another best practice kind of, related right,
is try to reduce the number of duplicate logs.
That's why you have to think
and plan ahead as to where exactly you want
to deploy things like NetFlow
and how will you correlate it with other events
like syslog from other devices, and so on.
Now, for many years, threat actors have been using
many different non-traditional techniques
to steal data from corporate networks.
That includes things like DNS tunneling, right?
As you probably know, you know, DNS is a protocol
that enables systems to resolve domain names.
For example, if you want to resolve hacker.org,
cisco.com, et cetera, that's how you translate it
or you resolve it to an IP address.
Now, DNS is not intended for a command channel
or even tunneling for that matter.
However, attackers have developed software
that enable tunneling over DNS.
And as a matter of fact, you can also tunnel, you know,
data and tunnel traffic over other protocols.
For example, NTP the protocol
that we were just talking about as a best practice,
the network time protocol also have been used
for exfiltration.
And there are many different other ones
that also have been used
and specifically, since attackers know that probably,
these protocols are not gonna be blocked
within the organization, it allows them
to either encode sensitive data, like, for example
put Base64 encoding, and then putting
that type of data whether it's a stolen credit card,
personal identifiable information,
many different types of data
in the payload of the DNS packet, right?
And that, then subsequently,
it's actual traded outside of the organization.
And nowadays, just like we were mentioning
in the beginning of this lesson,
encryption is being used very, very heavily.
So, if you actually have an encrypted payload
inside of a DNS packet that you cannot inspect,
then of course, as a recipe to disaster,
because an attacker can then of course,
embed any type of sensitive data
that is actually able to, you know,
trying to steal and successfully exfiltrated
from the corporation.
So, these are some of the most common,
different types of evasion techniques
and challenges of the security operations center.