Narrator: IAM Auditing. 2 2
In this lesson, we're going to talk 3 3
about auditing and monitoring and logging. 4 4
First, let's talk about IAM auditing 5 5
because IAM auditing is necessary for us to use 6 6
if we want to detect compromises of legitimate accounts 7 7
any kind of rogue account use or an insider threat. 8 8
The idea with IAM auditing is to look through our systems 9 9
to see if there's anything bad happening, 10 10
and one of the best ways to do that is 11 11
by monitoring and logging. 12 12
Now, one of the most key logs we're going to be looking 13 13
at is our audit logs. 14 14
Audit logs contain a log of all file access 15 15
and authentications within a network-based operating system, 16 16
an application or a service. 17 17
As we go through our audit logs, 18 18
we're going to be accounting for all of our user actions. 19 19
As we look through that 20 20
and we see which users did which things, 21 21
were they supposed to be able to do those things 22 22
and why were they doing those things? 23 23
As we look through that, we can figure that out. 24 24
That would help us determine 25 25
if there was some rogue account use going on. 26 26
Also, we're going to use this to detect intrusions 27 27
or attempted intrusions. 28 28
For instance, if I look in there and I see 29 29
that somebody tried logging 30 30
into the same account multiple times and failed 31 31
that could be an indication 32 32
that somebody's trying to break into that account. 33 33
That would be an attempted intrusion or it's an indication 34 34
that somebody just forgot their password. 35 35
Now again, we're going to have to look at these 36 36
and make the intelligent guess based on what we're seeing. 37 37
If I look through my audit logs and I see 38 38
that somebody tried logging in with A and then AA 39 39
and then AB, and then AC, what does that look like to you? 40 40
To me, it looks like a brute force login attempt 41 41
and so I would want to go and look at that, 42 42
turn that access off 43 43
and then go into a further investigation. 44 44
Now, one of the things we have to worry about 45 45
here is logging and logging can be a really good thing 46 46
but it can also be a really dangerous thing for us. 47 47
Now, why would logging be dangerous? 48 48
Because we could become buried in logs. 49 49
Obviously, the more events that are logged, 50 50
the more difficult it's going to be 51 51
for us to analyze and interpret those logs. 52 52
Therefore, it's important for us as cybersecurity analysts 53 53
for us to choose what to log and how much to log 54 54
and we have to do this carefully. 55 55
The other challenge with logs is that they get overwritten. 56 56
When logs reach their maximum allocated file size, 57 57
they're going to actually start overwriting the older logs 58 58
so you need to make sure that you have a way 59 59
to back up those logs and be able 60 60
to look at them in the future. 61 61
For example, we talked earlier about intrusions. 62 62
How long does it take before the average intrusion is found? 63 63
Over half of the time it took months. 64 64
So if you have logs that are being overwritten 65 65
every seven days, you'll never be able to find it. 66 66
So you need to be able to think about that as well 67 67
as you think about what your maximum allocatable size is 68 68
or if you're going to offload those logs 69 69
to another system where you can store them for longer. 70 70
Another thing you have to think about 71 71
when you're storing these logs is 72 72
how are you going to keep them secure? 73 73
Are you going to encrypt them? 74 74
Are you going to make sure there's confidentiality to them 75 75
and are you going to hash them to make sure there's integrity? 76 76
You want to make sure that these logs aren't being modified 77 77
because an attacker, when they break into your system, 78 78
one of the things they want to do is cover their tracks 79 79
and they will do that by modifying your logs. 80 80
Now, when you start determining what to log 81 81
this can be a challenge for a lot of security personnel. 82 82
Most people just say, "I'm going to log everything," 83 83
but that can be gigabytes of information every hour 84 84
or every day, and you might not have enough data 85 85
to store it all on your system, 86 86
so you have to think about what you want to store. 87 87
Now, to figure this out, 88 88
you should take a look at the audit policy recommendations. 89 89
This is a document on Microsoft's website 90 90
and it'll give you some recommendations 91 91
on how they say you should configure your audit policy. 92 92
Some typical categories that are covered 93 93
underneath these recommendations are things 94 94
like the account log on and management events, 95 95
and how many of those you should be capturing. 96 96
The process creation, the object access, 97 97
things like file systems and file shares, 98 98
things like changes to your audit policy 99 99
or changes to system security and integrity 100 100
like for instance, if somebody turns on or off a firewall, 101 101
on or off an antivirus, and things like that. 102 102
All of these are things you should consider 103 103
as you're determining what to log 104 104
because these are some of the big rocks. 105 105
Now, if you want to configure all of this, again, 106 106
you can refer to that Microsoft document 107 107
but essentially you're going to go 108 108
into your group policy object 109 109
and you're going to go in there and configure these things. 110 110
Either enable them or disable them based 111 111
on how much you want to log and what you want to log. 112 112
Now again, the reason logging is so important is 113 113
because it is the primary method we use 114 114
to uncover account access violations. 115 115
This is known as a log review. 116 116
We're going to go through and look at these logs. 117 117
If you're logging everything 118 118
but you never look at the logs, they're worthless to you. 119 119
Logs are only good 120 120
if you open them up and actually look at them. 121 121
Now, what are you going to be looking for in this log review? 122 122
Well, multiple consecutive authentication failures, 123 123
that's a good indication 124 124
that somebody's trying to break into your network. 125 125
You might look for unscheduled changes 126 126
to a system's configuration. 127 127
That might tell you that they're infected with malware. 128 128
You might look at sequencing errors or gaps in logs. 129 129
This can tell you, you have a modification problem. 130 130
Somebody might have broken into your system 131 131
and deleted some of the logs, or they modified the logs. 132 132
All of these are things you have to worry about. 133 133
Now, another thing you need to worry 134 134
about is doing a manual review. 135 135
Now, a manual review helps you look at your user accounts 136 136
and make sure they actually have the right permissions. 137 137
Why do you need to do this? 138 138
Well, because in every company. 139 139
people get hired and people get fired 140 140
and as people are hired, they're given permissions. 141 141
When they're fired, they should be losing permissions 142 142
and if they move even jobs within the company, 143 143
they should have different permission levels based 144 144
on the job they have. 145 145
So doing a manual review will make sure 146 146
that those permissions are accurate for those users. 147 147
This is an important thing and another reason 148 148
why we'd like to put people in and out of groups 149 149
to give them permission 150 150
as opposed to giving people permissions 151 151
directly on different file shares or different services. 152 152
It's easier to take them and remove them from groups 153 153
than it is to find every single place 154 154
that they have been given permission. 155 155
So keep that in mind and try to use 156 156
role-based authentication as you set up your systems. 157 157
Now, the other thing we're going to do is a re-certification 158 158
and this is part of our manual review. 159 159
A re-certification essentially is a manual review 160 160
of all the accounts, the permissions, the configurations 161 161
and the clearance levels, and you'll do this 162 162
at a given interval that might be monthly, quarterly 163 163
every six months, every year, every five years. 164 164
I don't care what it is. 165 165
That's for you and your organization to determine based 166 166
on your risk appetite. 167 167
In my organization, we do this once a year. 168 168
Now that's a pretty long time for most organizations 169 169
but we have a small staff 170 170
and we don't have people hiring and firing very commonly 171 171
so for us, a recertification isn't something 172 172
that takes a big priority based 173 173
on our risk appetite and our risk posture.