Scaling Network Incident Response
•Descargar como PPTX, PDF•
1 recomendación•252 vistas
Scaling Network Incident Response
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a Scaling Network Incident Response
Similar a Scaling Network Incident Response (20)
Más de Bangladesh Network Operators Group
Más de Bangladesh Network Operators Group (20)
Último
Último (20)
Scaling Network Incident Response
- 1. Scaling Network Incident Response Md Nahidul kibria Co-Founder, Beetles
- 2. The cyber threats are evolving
- 3. Mirai: An IoT DDoS Botnet Researcher analysis indicated as few as 100,000 Mirai IoT botnet nodes were enlisted in the incident and reported attack rates up to 1.2 Tbps.
- 8. Host based and Network based detection Complement Each Other
- 9. Artifacts PCAPs: traffic capture, packet capture NetFlow : Information (metadata) about packets Logs: Events about host or network
- 10. Typical packet capture and analysis. tshark -r nssal-capture-1.pcap -T fields -e ip.src -e dns.qry.name -R "dns.flags.response eq 0 and dns.qry.name contains google.com" 137.30.123.78 google.com 137.30.123.78 www.google.com
- 11. More challenges ● Rules: assets or liability ● Need to process data with threat intelligence ● Real time alert machine learning
- 12. Tons of data from different source
- 18. Service bus/distributed streaming platform.
- 28. Modern Security operation center
Notas del editor
- The threat is change is change over time, Cybercriminals Hacktivists Nation state Insiders
- Incident response is an organized approach to addressing and managing the aftermath of a security breach or cyberattack, also known as an IT incident, computer incident, or security incident. The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.
- If kernel level rootkit install host based detection may not work Not every single details can be derived from network based detection
- nfdump -R /var/log/netflow -q -O tstart -b -c 10 -o 'fmt:%ts %sap %dap %byt %flg' 'ip 192.168.11.104 and ip 192.168.11.101 and flags SA' | cut -c 12- | awk 'BEGIN{ printf "%12s %22s %18s %11s %5s\n", "Start time", "Source", "Dest", "Bytes", "flags"};{print};' Start time Source Dest Bytes flags 16:03:41.759 192.168.11.101:135 192.168.11.104:49297 72 .A..SF 16:03:41.813 192.168.11.101:139 192.168.11.104:49301 52 .A..SF
- http://www.metistream.com/comparing-hadoop-mapreduce-spark-flink-storm/