Jason: There is a large amount 2 2
of security data that we can obtain 3 3
from our various network appliances, 4 4
such as our firewalls, 5 5
and our intrusion detection and prevention systems. 6 6
In this lesson, we're going to focus 7 7
on a review of firewall logs, 8 8
to determine the security posture of our networks. 9 9
Now, this lesson and this course assumes 10 10
that you already are familiar 11 11
with the basic functions of a firewall 12 12
and the basic configurations of one, 13 13
because you've already taken Network Plus, 14 14
and Security Plus in your past studies. 15 15
As you probably remember, 16 16
a firewall is designed to provide you 17 17
with a line of defense at the network's boundary, 18 18
to limit the types of traffic 19 19
that pass in and out of a given network. 20 20
It does this, usually, using an Access Control List. 21 21
Now, an Access Control List is a list 22 22
of permitted and denied network connections, 23 23
based on either an IP address, a port, 24 24
or the applications in use. 25 25
As you start to analyze firewall logs, 26 26
you're going to notice that they provide you 27 27
with four types of useful security data. 28 28
First, they provide you with connections 29 29
that are either going to be permitted, or denied. 30 30
You can start noticing these patterns within the logs, 31 31
and this will help you identify holes 32 32
within your security posture. 33 33
Second, they have port and protocol usage. 34 34
This is going to tell you what ports 35 35
and protocols are being used in your network, 36 36
which ones you want to allow, 37 37
and maybe which ones you want to start blocking. 38 38
Third, your logs can show you bandwidth utilization, 39 39
with the duration and the volume 40 40
of usage for particular connections. 41 41
This way, you can break down 42 42
connection by connection, user by user, 43 43
department by department, or server by server, 44 44
and figure out which ones you want to focus on. 45 45
And fourth, they provide you 46 46
with an audit log of all of the address translations, 47 47
whether they're network address translation, 48 48
or port address translation that have occurred 49 49
within your networks. 50 50
If you ever find yourself responding 51 51
to an incident response, 52 52
you're going to find yourself going through these firewall logs 53 53
to determine which host 54 54
had that particular IP at any given time, 55 55
especially since so many enterprises use DHCP 56 56
for their internal addressing. 57 57
So, what does a firewall log look like? 58 58
Well, each firewall log format is going to be different 59 59
based on the vendor that you're using. 60 60
Each one has its own specific format. 61 61
In this course, I'm going to cover two tools, 62 62
and show you what their logs look like. 63 63
First, iptables. 64 64
Iptables is a Linux-based firewall 65 65
that uses the CIS log file format for all of its logs. 66 66
This is what they look like, 67 67
as you can see here on the screen. 68 68
Now, as you can see, there is a lot of detail inside this 69 69
and this is just two lines out of a log. 70 70
Now, each of these indicates one attempted connection, 71 71
either going in or out, 72 72
and we're going to walk through these logs 73 73
to make sure you understand how to read them. 74 74
Each log entry is prefixed with a timestamp, 75 75
a device ID or host name, and a facility, 76 76
which is usually going to be the kernel. 77 77
After that, each log rule is going to have a log prefixed value 78 78
or a log level, and this will tell you 79 79
which rule was being applied when this was logged. 80 80
In this case, you see iptables input drop 81 81
which tells me this was a drop rule that was being applied. 82 82
Now in this area, sometimes you'll also have 83 83
a log level value, 84 84
which will tell you from zero to seven 85 85
on the CIS log log scale, what it is. 86 86
I'll talk about those in a little bit more later on. 87 87
In this particular log, you don't see that being shown. 88 88
Following this header values, 89 89
we then have the actual contents of the log message. 90 90
This includes a lot of attribute value pairs, 91 91
each one delineated by commas or spaces. 92 92
Following that header information, 93 93
we are going to have a set of attribute pairs 94 94
showing the attribute equals value as it goes through, 95 95
and each one is going to be in a delineated format. 96 96
Now, here you can see the first ones we have 97 97
is our interfaces. 98 98
This is going to tell us which 99 99
firewall host interfaces were involved. 100 100
In this case, it was an inbound interface 101 101
called eth0 or Ethernet zero. 102 102
There was no outbound because this was something 103 103
attempting to get into our network. 104 104
Next, we have which Mac addresses are involved, 105 105
both the source and the destination. 106 106
After that, we have the source and destination IP addresses, 107 107
and this is going to be logged as well. 108 108
After you have that, 109 109
you're going to end up having some information 110 110
about the packet itself. 111 111
This will include things like it's LEN, 112 112
the TOS, the precedent, the time to live, 113 113
and lots of other details. 114 114
You also see the protocoling use, was it TCP or UDP? 115 115
You'll see what the source port was, 116 116
and the destination port. 117 117
You'll see the window 118 118
and all the other information like that, 119 119
that is important to you 120 120
as you look at that packet header. 121 121
Now, as we take a look at these two packets 122 122
that were being dropped, 123 123
the first one on the top, 124 124
is actually showing a destination port of 23. 125 125
So, as something was trying to come into our network, 126 126
the firewall saw it was destined for port 23, 127 127
which is Telnet, and said, I don't have a Telnet server, 128 128
that port isn't open, and it dropped this packet. 129 129
Now, the second one on the bottom, 130 130
you could see as a destination port of 21. 131 131
Similarly, there's no FTP server being run. 132 132
This port was closed, and so the firewall is going to drop it, 133 133
and reject that request. 134 134
This is what it looks like when you start looking 135 135
at something in iptables in the CIS log format. 136 136
Now, earlier I mentioned that there was a CIS log value 137 137
that could be used, anywhere from zero, 138 138
which is emergency up to seven, which is debug, 139 139
and here on the screen you can see all the categories, 140 140
from zero to seven. 141 141
This chart should be reviewed for you, 142 142
because it was covered in Network Plus and Security Plus. 143 143
I'm putting it here on this slide just for your reference 144 144
because you may see questions about this on the exam. 145 145
Now, as I said, this CIS log format 146 146
is used by iptables and Linux, 147 147
but what if you're using a Windows firewall? 148 148
Well, Windows uses a Windows-based firewall that uses 149 149
the W3C Extended Log File Format. 150 150
Now, here's what this looks like. 151 151
The nice thing about the Windows Firewall log format 152 152
is that it is a lot easier to read 153 153
because they put comment lines above it. 154 154
So, it tells you right off the bat, 155 155
what software are you running? 156 156
In this case, the Microsoft HTTP server, API 2.0. 157 157
What version of the software are you running? 158 158
What was the date that this file was written? 159 159
And then, what fields are there? 160 160
And this is really important 161 161
because this is your key 162 162
to the next piece of information. 163 163
As you go through the logs, 164 164
that last line that you see on my screen, 165 165
that is the log file itself. 166 166
Now, all the information above 167 167
is the beginning of that log file that shows comments, 168 168
but as we start logging multiple things, 169 169
we're just going to get repeats 170 170
of that bottom line with the different details. 171 171
So, let's go ahead and read through that. 172 172
Notice that we have that commented line of fields 173 173
and it tells us exactly what is being covered here. 174 174
So, first we have the date 175 175
and you can see the matching date, 2002-05-02. 176 176
Then we have the time, in this case, 17:42 and 15 seconds. 177 177
Then we have the client IP. 178 178
Where was this request coming from? 179 179
In this case, 172.22.255.255. 180 180
Then, we have the client's username. 181 181
In this case, we didn't have one, 182 182
so it just shows up as a dash. 183 183
Then, we have the server IP, 184 184
in this case, that's 172.30.255.255, 185 185
and then we have the server port 186 186
we're trying to connect to, in this case, port 80. 187 187
Then, we have the method, 188 188
and this is going to be the client method that was used, 189 189
in this case, it was the GET method, 190 190
which we talked about in a previous lesson 191 191
when we talked about the HTTP methods. 192 192
After that, we have the client URI stem 193 193
and this is what resource was it trying to access? 194 194
In this case, it was the picture JPG file 195 195
inside the images directory, 196 196
and then we have the CS URI query, 197 197
and in this case, it has a dash, 198 198
because there was no query being made. 199 199
If we were using something like a post method instead, 200 200
we would have a query associated with it, 201 201
and that would be shown here. 202 202
And then we have our SC status, 203 203
and if you remember, back in our HTTP lesson, 204 204
we talked about the fact that 200 205 205
meant it was okay, it was a successful status. 206 206
So, this tells me this get request actually worked. 207 207
They were able to access that server, 208 208
and get that file that they wanted and have it downloaded. 209 209
The final thing we have is what's called 210 210
our client user agent, 211 211
and this is that long string there, at the bottom. 212 212
This is Mozilla, 213 213
and then it tells us some information about it. 214 214
So, by reading this, I know 215 215
that they're using the Mozilla browser. 216 216
In this case, it's most likely Firefox, 217 217
and it also tells me what type 218 218
of client it was used on, 219 219
in this case, Windows 2000 server. 220 220
This gives me some details 221 221
about the client that was actually accessing this, 222 222
and going through the firewall, making this attempt. 223 223
So, before we go any further, 224 224
I want to take a quick pause 225 225
and talk about a quick exam tip for you. 226 226
For the exam, you should be comfortable 227 227
reading these types of logs. 228 228
You need to be able to understand what has occurred. 229 229
For example, if on the exam they give you five to 10 lines 230 230
from the Windows firewall log, 231 231
you should be able to tell 232 232
if the client requested a file from the server, 233 233
if that request was successful. 234 234
For example, did they get that status code 200? 235 235
Or if a post request was successful, 236 236
to send a file to a remote server. 237 237
You don't have to be a firewall expert here, 238 238
but you do have to have a solid understanding 239 239
of reading these iptable logs, 240 240
and these Windows Firewall logs 241 241
because that is going to be essential to you 242 242
passing the CYSA Plus exam. 243 243
All right, so we have all these log files, 244 244
and we start collecting a ton of data. 245 245
What do we do with it? 246 246
Well, the first thing you should do 247 247
is employ a log collection tool 248 248
to gather the large volume 249 249
of firewall logs for later analysis. 250 250
You can't have them sitting on one single machine, 251 251
because if that machine goes down, you lose all the logs. 252 252
Also, a single machine probably can't hold all these logs, 253 253
because there's so much data here. 254 254
Now, one of the big things 255 255
is that you can become overloaded with information, 256 256
and so you have to scope your logging properly. 257 257
How much do you really want to log? 258 258
What is the important things to log? 259 259
Where are you going to place these sensors, 260 260
and where are you going to place these firewalls 261 261
to collect the information and provide the best protection? 262 262
These are all things you have to think about. 263 263
If you don't think about this, 264 264
and you don't scope your logging properly, 265 265
and you try to log everything, 266 266
you may become overloaded with events, 267 267
and it makes it really hard to analyze later, 268 268
or your system can actually be blinded, 269 269
and this is known as a blinding attack. 270 270
Now, a blinding attack is a condition that occurs 271 271
when a firewall is under-resourced, 272 272
and it simply can't log all the data fast enough, 273 273
and therefore some of that data 274 274
is going to be missing in the logs, 275 275
and you're not going to be able to analyze it later. 276 276
Another thing you have to determine 277 277
is how long you're going to retain these logs. 278 278
Log retention should be determined 279 279
by the number of events that are being generated, 280 280
and your available storage capacity. 281 281
But it also has to be determined based 282 282
on your business case. 283 283
And if you have a business case to keep all these logs, 284 284
then you may need to buy more storage capacity 285 285
to be able to handle that. 286 286
For example, if you've been attacked in the past, 287 287
and you won't be able to go back and look at that, 288 288
if you don't have long-term retention, 289 289
you're not going to be able to do that. 290 290
So, some companies might say they're only going to keep logs 291 291
for three months, some say six months, 292 292
some say 12 months, some say forever. 293 293
It really depends on your organization 294 294
and what you're willing to spend. 295 295
Now, if you have the threat of an APT, 296 296
remember on average, an APT can be in your network 297 297
for five, six or seven months 298 298
before you ever determine they're there, 299 299
and that means you probably need to keep your logs 300 300
at least 6 to 12 months, 301 301
so you have a chance of finding out how they got in, 302 302
and how you can stop them for next time. 303 303
Now, I get asked a lot by students, 304 304
how do I practice this stuff, Jason? 305 305
Where can I find log files? 306 306
Well, one of the best things to do 307 307
is actually set up your own firewall 308 308
in your home network. 309 309
This way you can turn it on and start analyzing those files, 310 310
and if you want to do this, 311 311
there's a great tool called PF Sense. 312 312
PF Sense is a Unified Threat Manager 313 313
which contains a firewall, 314 314
and it is a free open-source program. 315 315
You could take an old laptop or an old desktop, 316 316
install PF Sense on it and run it to protect your network. 317 317
Also, you'll be able to log that information, 318 318
go through those logs, 319 319
and be able to determine what they look like, 320 320
and get comfortable reading them. 321 321
There is nothing better 322 322
than reading real world logs to get a real sense 323 323
of what's going on out there 324 324
and really get yourself better at doing this, for the exam.