- [Instructor] Encryption has great benefits
for security and privacy.
But in the world of incident response and forensics,
encryption introduces several challenges.
Even law enforcement agencies actually have been fascinated
in the use of encryption and the dual nature of encryption.
When protecting information and communications,
encryption actually has numerous benefits for everyone,
from governments, the military,
to corporations and individuals.
On the other hand, some of the same mechanisms
can be used by threat actors
as a method of evasion and (muffled speaking) right?
So to avoid being detected.
Now historically even governments
have tried to regulate the use of,
and exportation of encryption technologies, right?
A good example is the Wassenaar Arrangement,
which is a multinational arrangement
with the goal to regulate
the export of technologies like encryption.
Another example is the allegedly US National Security Agency
or NSA backdoor,
in the Dual Elliptic Curve
Deterministic Random Bit Generator, or the Dual EC DRGB.
And this, you know,
is actually done to allow for clear text extraction
of many algorithms
seeded by the pseudo-random number generator, right,
is by that dual EC DRBG.
Now some folks have shared the idea
of encrypting everything.
In that case, encrypting everything
will actually have very serious consequences,
not only for law enforcement agencies,
but for incident response professionals, right?
Something to remember
about the concept of encrypting everything,
is that the deployment of an end-to-end encryption
is difficult and can leave unencrypted data
at risk to an attack.
Now, there are many security products,
including the next generation IPS
and next generation firewalls
that can intercept, decrypt, inspect
and also re-encrypt
or even ignore encrypted traffic payloads, right?
Several people consider this
a man-in-the-middle attack, right?
And have many, you know, privacy concerns.
On the other hand,
you can actually use metadata from network traffic
and other security event sources
to still be able to investigate and solve security issues.
You can attain a lot of good information,
leveraging things like net flow,
firewall logs, web proxy logs
user authentication information, and even passive DNS data.
Now, in some cases, the combination of these logs
can make encrypted contents of malware payloads
and other traffic fairly relevant, right?
So of course, this is as long as you can detect
its traffic patterns,
to be able to actually remediate the incident.
It is important to recognize
that from a security monitoring perspective,
it is technically possible
to monitor some encrypted communications,
like we mentioned before, in the case of next generation IPS
and next generation firewalls,
however from a policy perspective,
is a different story, right?
Especially depending on your geographical location
and also your local laws around privacy.
Now, another technology
that introduces some challenges to security monitoring,
is the network address translation or NAT.
By using NAT, a firewall or a router
hides the internal private address
from the unprotected network or the internet,
and exposes only its own address
or a public range of addresses,
or predetermined address, IP address.
Now this enables a network professional
to actually use any IP address space
as the internal network.
Now, NAT or network address translation
can present a challenge when performing security monitoring
and analyzing logs, right?
And also when analyzing net flow and or the data,
since device IP addresses can be seen in the logs
as the translated IP address,
versus the actual real IP address, right?
In the case of port address translation or PAT,
this could even be more problematic
since many different hosts
can be translated to a single address,
making the correlation almost impossible to achieve.
Now there's some good news, a few security products,
such as the Cisco Lancope StealthWatch system,
provides features such as NAT stitching,
that can be used with net flow
and other data in the network,
to actually be able to correlate,
and map translated IP addresses in a NAT environment, right.
Now this accelerates the incident response task,
and also ease the continuous security monitoring operations.
Another technology that introduces some challenges
to security monitoring, is DNS tunneling, right?
Attackers actually have developed software
that enabled tunneling over DNS for years, right?
They actually have been using this
to exfiltrate data from their victims for years.
These threat actors like to use protocols,
that traditionally are not designed for data transfer
since they're less inspected
in terms of security monitoring, right?
So undetected DNS tunneling,
otherwise known as DNS exfiltration,
represents a significant risk to any organization.
Now, in many cases, malware can use Base64 encoding
and other types of encoding to put sensitive data,
things like credit cards, personal identifiable information,
and other type of sensitive information
in the payload of DNS packets,
to actually, you know,
exfiltrate that data from their victims.
These are some examples of encoding methods
that actually can be used by attackers, right?
So including Base64, binary encoding,
NETBIOS encoding, and also hex encoding.
There're several utilities
that actually have been created
to perform DNS tunneling, right.
For the good, and also for the bad.
Here I'm actually including a few example
for your reference, right?
So one thing to highlight is that some of these tools
were not created with the intent to steal data,
but cyber criminals actually have used it for years,
you know, for their own purposes, right,
to exfiltrate data from the network.
Another tool that presents some challenges
to security monitoring, is Tor.
Otherwise known as The Onion Router, right?
Many people nowadays use tools like Tor for privacy.
Tor is actually a free tool, that enables its users
to actually surf the web anonymously.
However, you know, Tor actually works,
by routing IP traffic through a free worldwide network
consisting of thousands of Tor relays, right?
That's what we call Tor relays.
Then Tor actually constantly changes
the way it routes traffic,
in order to obscure a user's location
from anyone monitoring the network.
The usage of Tor also makes it more difficult
for security monitoring and incident responses, right?
Since it can be hard to attribute and trace back
the traffic to a specific user
or of a specific user, right?
So different types of malware
are also known to use Tor to actually cover their tracks,
and actually to communicate,
between the malware and the attacker, right?
So this onion routing
is actually accomplished by encrypting the application layer
of a communication protocol stack that are nested
just like the layers of an onion,
thus the name, The Onion Router.
the Tor client encrypts the data multiple times
and sends it through a network or a circuit.
And that includes randomly selected Tor relays, right?
Each of the relays actually decrypt a layer of the onion,
and then reveal only the information to the next relay,
so it can then route the remaining encrypted data
and then so on, you know, and reach the destination.
Here I'm actually showing the Tor browser, right.
There you can see the Tor circuit,
where the user actually access cisco.com
from the Tor browser, right?
So first one to a host in the Netherlands,
then a host in Sweden, a host in France,
and finally to cisco.com.
Tor exit nodes are basically the last Tor node
or the gateways, where the Tor encrypted traffic
exits to the internet, right?
So a Tor exit node can be targeted
to monitor Tor traffic, right?
Many organizations block Tor exit nodes
in their environment,
to actually, protect, you know, their communications,
and to actually make sure that,
no internal devices, are you actually using Tor?
Now, the Tor project actually has a dynamic list
of Tor exit nodes,
that makes, you know, this task a little bit easier.
You know, this is actually the Tor exit node list
that actually can be downloaded
from the link that I'm actually sharing in here,
from the torproject.org website.
Now, security products
like the Cisco Next-Generation Firepower,
you know, appliances and Firepower Threat Defense,
provide the ability to dynamically learn,
and block Tor exit nodes, right?
That's actually a beauty
of this next generation platforms.
Peer-to-peer communication
also presents some security challenges, right?
So the peer-to-peer is actually referred to,
as the distributed architecture
that divides task between participants,
competing peers, right?
In a peer-to-peer network,
the peers are equally privileged, right?
This is why they're called a peer-to-peer network of nodes.
Now peer-to-peer participant computers or nodes,
reserve a chunk of their resources,
like you know, CPU, memory, disc, and network bandwidth,
so that the other peers or participants
can actually access those resources, right?
This is all done
without the need of a centralized server.
In peer-to-peer networks,
each peer can be both a supplier,
as well as a consumer of resource or data.
A good example was the music sharing application,
you know, that was actually very popular
in the '90s, called Napster.
Now peer-to-peer networks,
not only have been used to share music, videos,
stolen books and other data,
but even legitimate multimedia applications,
like, you know, an example is Spotify, right?
It actually uses a peer-to-peer network,
along with the streaming servers
to stream audio and video to their clients, right?
There's even an application called Peercoin,
also known as PP coin,
which is a peer-to-peer cryptocurrency platform
that actually utilizes both proof of stake,
and also proof of work systems,
to actually do, you know, Bitcoin mining,
and you know, cryptocurrency transactions, right.
Now universities like MIT and Penn state
actually have created a project called LionShare.
And that it's actually designed
to share files among educational institutions globally.
So again, not only for the bad, but also peer-to-peer,
actually has been used for the good as well, right.
Now, from a security perspective,
peer-to-peer systems introduce a unique challenge, right?
Malware has actually used peer-to-peer networks
to communicate and also to spread,
you know, other instances of the same malware
to victims, right?
So many free or stolen music and movie files
usually come with a surprise of malware as well.
So that's one thing to actually keep in mind.
Additionally, like any other form of software,
peer-to-peer applications
are not immune to security vulnerabilities, right?
This of course introduces risk for peer-to-peer software
to be more susceptible to remote exploits,
due to the nature of the peer-to-peer network architecture.
Another challenge is actually to keep network telemetry
and logs from all sources in sync.
Now, server logs, endpoint logs, NAT flows, syslog data,
and any other security monitoring data will be useless
if it is actually showing the run date and the run time.
This is why is a best practice,
that you should configure all network devices
and your servers, and you know, everything,
to actually use network time protocol or NTP.
So by using NTP, we ensure that the correct time is set,
and is also synchronized
between all the devices within the network
and all the sources of telemetry, you know.
Another best practice,
is to try to reduce the amount of duplicate logs, right?
Now these best practices will save you time,
and will also increase your operational efficiency
whenever you're monitoring your network.