1 1 00:00:00,140 --> 00:00:02,150 SIEM in this lesson, 2 2 00:00:02,150 --> 00:00:05,240 we're going to discuss a security technology known as a SIEM, 3 3 00:00:05,240 --> 00:00:08,240 or security information and event management system. 4 4 00:00:08,240 --> 00:00:11,040 Now a SIEM is a security solution that provides real time 5 5 00:00:11,040 --> 00:00:13,760 or near real-time analysis of security alerts 6 6 00:00:13,760 --> 00:00:16,620 that are generated by network hardware and applications. 7 7 00:00:16,620 --> 00:00:19,020 In our networks, we have a lot of different devices, 8 8 00:00:19,020 --> 00:00:21,040 including not just our network infrastructure, 9 9 00:00:21,040 --> 00:00:23,480 but also all our client devices that we host on the network 10 10 00:00:23,480 --> 00:00:26,230 as well, to maintain a strong security posture, 11 11 00:00:26,230 --> 00:00:27,970 it is critical to understand the status 12 12 00:00:27,970 --> 00:00:30,620 of each of these devices by reviewing their logs, 13 13 00:00:30,620 --> 00:00:32,204 informational alerts and events. 14 14 00:00:32,204 --> 00:00:34,790 But if we had to log into each of these machines 15 15 00:00:34,790 --> 00:00:37,130 individually to collect and analyze all that data, 16 16 00:00:37,130 --> 00:00:39,360 it would take us forever. 17 17 00:00:39,360 --> 00:00:42,190 Luckily, we have a solution known as a SIEM, 18 18 00:00:42,190 --> 00:00:44,250 that helps us overcome this challenge. 19 19 00:00:44,250 --> 00:00:46,010 A SIEM is able to gather logs and data 20 20 00:00:46,010 --> 00:00:47,720 from all sorts of different systems 21 21 00:00:47,720 --> 00:00:50,580 and combine them into a single combined data store. 22 22 00:00:50,580 --> 00:00:52,400 This allows our cybersecurity analysts, 23 23 00:00:52,400 --> 00:00:54,450 system administers and network administrators 24 24 00:00:54,450 --> 00:00:56,730 to review the logs and find abnormalities 25 25 00:00:56,730 --> 00:00:59,460 or things that are not operating within our baselines. 26 26 00:00:59,460 --> 00:01:01,110 When it comes to reviewing these logs, 27 27 00:01:01,110 --> 00:01:03,040 it shouldn't be done only after an incident 28 28 00:01:03,040 --> 00:01:04,600 or after breaches occurred. 29 29 00:01:04,600 --> 00:01:07,080 Instead conducting law reviews should be something 30 30 00:01:07,080 --> 00:01:08,900 that's done regularly and routinely 31 31 00:01:08,900 --> 00:01:10,410 as part of your network administration 32 32 00:01:10,410 --> 00:01:12,100 and system management functions. 33 33 00:01:12,100 --> 00:01:14,700 To effectively conduct a log review and analysis though, 34 34 00:01:14,700 --> 00:01:16,980 you really do need to utilize a SIEM. 35 35 00:01:16,980 --> 00:01:18,950 A seam is used to help us correlate the events 36 36 00:01:18,950 --> 00:01:21,110 between different systems across the network. 37 37 00:01:21,110 --> 00:01:23,000 Something that we couldn't do ourselves easily 38 38 00:01:23,000 --> 00:01:25,690 if we're looking at logs from each individual machine. 39 39 00:01:25,690 --> 00:01:27,930 Now by using a SIEM, we can combine 40 40 00:01:27,930 --> 00:01:30,010 five essential functions that provides us 41 41 00:01:30,010 --> 00:01:32,870 with a more comprehensive view of our enterprise network. 42 42 00:01:32,870 --> 00:01:34,900 This is done by performing log collection, 43 43 00:01:34,900 --> 00:01:39,060 normalization, correlation, aggregation and reporting. 44 44 00:01:39,060 --> 00:01:41,160 Now, first we have log collection. 45 45 00:01:41,160 --> 00:01:43,070 Log collection of all of our event records 46 46 00:01:43,070 --> 00:01:45,140 from sources throughout the network is going to happen 47 47 00:01:45,140 --> 00:01:47,390 usually using something like Syslog. 48 48 00:01:47,390 --> 00:01:49,290 This will provide us with important forensic tools 49 49 00:01:49,290 --> 00:01:50,945 and help us address 50 50 00:01:50,945 --> 00:01:52,310 compliance reporting requirements as well. 51 51 00:01:52,310 --> 00:01:54,230 Second, we have normalization. 52 52 00:01:54,230 --> 00:01:56,180 Normalization is going to map log messages 53 53 00:01:56,180 --> 00:01:59,020 from different systems into a common data model. 54 54 00:01:59,020 --> 00:02:00,800 This will enable us to be able to connect 55 55 00:02:00,800 --> 00:02:02,320 and analyze related events, 56 56 00:02:02,320 --> 00:02:03,590 even if they're initially logged 57 57 00:02:03,590 --> 00:02:05,360 in different source formats. 58 58 00:02:05,360 --> 00:02:07,260 Third, we have correlation. 59 59 00:02:07,260 --> 00:02:09,340 Correlation is going to link the logs and events 60 60 00:02:09,340 --> 00:02:11,030 from different systems or applications 61 61 00:02:11,030 --> 00:02:12,580 into a single data feed, 62 62 00:02:12,580 --> 00:02:14,630 which speeds up our detection of threats, 63 63 00:02:14,630 --> 00:02:16,370 as well as decreases the time for us 64 64 00:02:16,370 --> 00:02:18,590 to be able to respond to those threats. 65 65 00:02:18,590 --> 00:02:20,630 Fourth, we have aggregation. 66 66 00:02:20,630 --> 00:02:23,160 Aggregation is going to reduce the volume of event data 67 67 00:02:23,160 --> 00:02:25,000 by consolidating duplicate events 68 68 00:02:25,000 --> 00:02:26,540 and taking those records and merging them 69 69 00:02:26,540 --> 00:02:28,010 into a single record. 70 70 00:02:28,010 --> 00:02:29,530 Fifth, we have reporting. 71 71 00:02:29,530 --> 00:02:30,820 Reporting is going to be used to present 72 72 00:02:30,820 --> 00:02:32,910 the correlated, aggregated event data 73 73 00:02:32,910 --> 00:02:34,630 in a real-time monitoring dashboard 74 74 00:02:34,630 --> 00:02:37,020 if you're an analyst, and if you're in management, 75 75 00:02:37,020 --> 00:02:39,200 you're going to get some form of a longterm summary 76 76 00:02:39,200 --> 00:02:42,300 or report at the end, and that's also part of reporting. 77 77 00:02:42,300 --> 00:02:44,151 All right, let's consider a simple example. 78 78 00:02:44,151 --> 00:02:45,950 You're looking through the logs and you see 79 79 00:02:45,950 --> 00:02:48,640 that somebody has logged in over VPN from Asia. 80 80 00:02:48,640 --> 00:02:51,660 When you look up the user ID, you see it's John Smith, 81 81 00:02:51,660 --> 00:02:53,030 all right, that seems normal. 82 82 00:02:53,030 --> 00:02:54,771 Maybe he's in Asia because he's on a business trip. 83 83 00:02:54,771 --> 00:02:57,130 Now, while there may be nothing wrong with this, 84 84 00:02:57,130 --> 00:02:57,963 a few minutes later, 85 85 00:02:57,963 --> 00:02:59,250 you're looking at your SIEM and you see 86 86 00:02:59,250 --> 00:03:01,180 that the access control system says 87 87 00:03:01,180 --> 00:03:03,160 that John Smith's ID was just used 88 88 00:03:03,160 --> 00:03:05,430 to log into the server room inside your building. 89 89 00:03:05,430 --> 00:03:07,360 All right, now we have an issue 90 90 00:03:07,360 --> 00:03:09,175 because if your server room is sitting in America 91 91 00:03:09,175 --> 00:03:11,690 and John Smith is supposedly accessing us 92 92 00:03:11,690 --> 00:03:14,370 from a VPN in Asia, something is wrong, 93 93 00:03:14,370 --> 00:03:15,710 'cause he can't be both in the server room 94 94 00:03:15,710 --> 00:03:17,710 and on a business trip in Asia at the same time. 95 95 00:03:17,710 --> 00:03:19,870 So one of these things has to be wrong. 96 96 00:03:19,870 --> 00:03:21,170 Now, either of these two events 97 97 00:03:21,170 --> 00:03:23,210 by themselves would be totally fine 98 98 00:03:23,210 --> 00:03:24,740 and not suspicious at all. 99 99 00:03:24,740 --> 00:03:27,060 But by seeing them correlated together 100 100 00:03:27,060 --> 00:03:29,570 at the same time or nearly the same time, 101 101 00:03:29,570 --> 00:03:31,750 this tells us that there's something wrong here. 102 102 00:03:31,750 --> 00:03:33,240 And we need to flag that as suspicious 103 103 00:03:33,240 --> 00:03:34,800 and investigate it further. 104 104 00:03:34,800 --> 00:03:36,560 Now, as we look into the situation, 105 105 00:03:36,560 --> 00:03:38,660 we can determine where this person really is. 106 106 00:03:38,660 --> 00:03:40,300 We can just walk down to the server room and say, 107 107 00:03:40,300 --> 00:03:41,270 is John here? 108 108 00:03:41,270 --> 00:03:43,280 And so he says, no, he's on a business trip in Asia. 109 109 00:03:43,280 --> 00:03:45,130 Now we need to go check the security footage 110 110 00:03:45,130 --> 00:03:46,870 and see who is logging in with John's credentials 111 111 00:03:46,870 --> 00:03:48,180 here in the server room. 112 112 00:03:48,180 --> 00:03:50,370 A SIEM allows us to do this type of correlation 113 113 00:03:50,370 --> 00:03:52,160 very quickly and very easily, 114 114 00:03:52,160 --> 00:03:54,160 and be able to deconflict these things. 115 115 00:03:54,160 --> 00:03:56,310 A security information event management system 116 116 00:03:56,310 --> 00:03:59,400 or SIEM can be implemented in many different ways. 117 117 00:03:59,400 --> 00:04:01,120 A SIEM can exist as a piece of software 118 118 00:04:01,120 --> 00:04:03,293 running on a server, a hardware appliance, 119 119 00:04:04,311 --> 00:04:05,590 or even as an outsource managed service. 120 120 00:04:05,590 --> 00:04:07,470 In order to effectively deploy a SIEM, 121 121 00:04:07,470 --> 00:04:09,970 you have to consider a lot of different things. 122 122 00:04:09,970 --> 00:04:11,640 First, you need to be able to log 123 123 00:04:11,640 --> 00:04:13,800 all the relevant events and filter out anything 124 124 00:04:13,800 --> 00:04:15,910 that's considered to be irrelevant data. 125 125 00:04:15,910 --> 00:04:17,720 Second, you need to make sure you establish 126 126 00:04:17,720 --> 00:04:19,780 and document the scope of the events. 127 127 00:04:19,780 --> 00:04:21,720 Exactly what is it that you're going to log? 128 128 00:04:21,720 --> 00:04:24,740 What's going to be considered inside or outside of your scope? 129 129 00:04:24,740 --> 00:04:28,070 Third, you need to develop use cases to define a threat. 130 130 00:04:28,070 --> 00:04:29,910 This will help you to find exactly what you do 131 131 00:04:29,910 --> 00:04:32,150 and do not consider a threat and what you may 132 132 00:04:32,150 --> 00:04:34,970 want to take action on or postpone for later. 133 133 00:04:34,970 --> 00:04:37,410 Forth, you need to plan incident responses 134 134 00:04:37,410 --> 00:04:39,210 for given scenarios or events. 135 135 00:04:39,210 --> 00:04:41,500 If you know that when you see this type of thing occur, 136 136 00:04:41,500 --> 00:04:43,400 then you need to take those types of actions. 137 137 00:04:43,400 --> 00:04:44,900 That's what I'm talking about here. 138 138 00:04:44,900 --> 00:04:46,640 You need to have these pre-planned responses 139 139 00:04:46,640 --> 00:04:49,070 for any given threat that you might face. 140 140 00:04:49,070 --> 00:04:51,650 Fifth, we want to establish a ticketing process 141 141 00:04:51,650 --> 00:04:54,060 so we can track all these different events that we flag. 142 142 00:04:54,060 --> 00:04:55,930 This way, as we go into the SIEM, 143 143 00:04:55,930 --> 00:04:57,710 we can see something that looks unusual, 144 144 00:04:57,710 --> 00:04:59,870 like my example of somebody logging in from Asia 145 145 00:04:59,870 --> 00:05:01,730 and at the local office at the same time. 146 146 00:05:01,730 --> 00:05:03,570 And then we can flag it and have it tracked 147 147 00:05:03,570 --> 00:05:05,490 through the process to completion, 148 148 00:05:05,490 --> 00:05:07,700 to make sure nobody forgets about it. 149 149 00:05:07,700 --> 00:05:10,800 Sixth, we want to make sure we schedule regular threat hunting 150 150 00:05:10,800 --> 00:05:12,560 by working with our cyber security analysts 151 151 00:05:12,560 --> 00:05:13,980 and using our SIEM. 152 152 00:05:13,980 --> 00:05:15,340 By doing this, we want to make sure 153 153 00:05:15,340 --> 00:05:16,910 we're not missing any important events 154 154 00:05:16,910 --> 00:05:18,183 that may have escaped the automated alerts 155 155 00:05:18,183 --> 00:05:20,330 that we create inside the system. 156 156 00:05:20,330 --> 00:05:22,060 By going through and doing threat hunting, 157 157 00:05:22,060 --> 00:05:24,620 our cyber security analysts will be able to catch bad guys 158 158 00:05:24,620 --> 00:05:26,510 doing bad things that may have escaped 159 159 00:05:26,510 --> 00:05:28,790 our automated alerts and seventh, 160 160 00:05:28,790 --> 00:05:31,160 our final consideration is how are we going to provide 161 161 00:05:31,160 --> 00:05:33,490 auditors and analysts an evidence trail? 162 162 00:05:33,490 --> 00:05:36,490 by using a seam, we have this great centralized repository 163 163 00:05:36,490 --> 00:05:37,900 with lots of different data. 164 164 00:05:37,900 --> 00:05:39,640 And so it becomes a great place for an auditor 165 165 00:05:39,640 --> 00:05:42,020 or analyst to look through as they're doing their analysis 166 166 00:05:42,020 --> 00:05:45,200 as part of a compliance-based inspection, as you can see, 167 167 00:05:45,200 --> 00:05:47,410 there are a lot of great benefits and considerations 168 168 00:05:47,410 --> 00:05:49,690 that we have when we start using a SIEM. 169 169 00:05:49,690 --> 00:05:50,523 It's important for us 170 170 00:05:50,523 --> 00:05:52,490 to always properly configure our network devices, 171 171 00:05:52,490 --> 00:05:54,840 to make sure they're feeding their data into our SIEM 172 172 00:05:54,840 --> 00:05:56,570 within the scope of our events. 173 173 00:05:56,570 --> 00:05:58,460 Remember, a SIEM is going to take data 174 174 00:05:58,460 --> 00:06:00,170 using the Syslog protocol. 175 175 00:06:00,170 --> 00:06:03,110 This means we're going to be using UDP port 514, 176 176 00:06:03,110 --> 00:06:07,940 or TCP port 1468, as that is being brought into the SIEM, 177 177 00:06:07,940 --> 00:06:09,140 it's going to be classified 178 178 00:06:09,982 --> 00:06:11,410 based on a log level from zero to seven. 179 179 00:06:11,410 --> 00:06:13,910 Zero is our most important or most critical, 180 180 00:06:13,910 --> 00:06:17,160 and seven is our least important or most informational, 181 181 00:06:17,160 --> 00:06:20,330 just like we had with our regular devices using CIS log. 182 182 00:06:20,330 --> 00:06:22,150 For the exam, it's important to understand 183 183 00:06:22,150 --> 00:06:24,350 the purpose of a SIEM and that a SIEM relies 184 184 00:06:24,350 --> 00:06:26,420 on the Syslog protocol to collect the data 185 185 00:06:26,420 --> 00:06:28,290 from all these different network devices 186 186 00:06:28,290 --> 00:06:30,660 and client devices on our enterprise network. 187 187 00:06:30,660 --> 00:06:32,738 And then we're going to use that to normalize, 188 188 00:06:32,738 --> 00:06:35,330 correlate and aggregate that logging data 189 189 00:06:35,330 --> 00:06:37,893 into a single repository for further analysis.