Crafting the infosec playbook [security monitoring and incident response master plan]

275 Pages·2015·10.664 MB·English

by  Bollinger, Jeff;Enright, Brandon;Valites, Matthew

Crafting the
InfoSec
Playbook
SECURITY MONITORING AND
INCIDENT RESPONSE MASTER PLAN
Jeff Bollinger,
Brandon Enright & Matthew Valites

Crafting the Infosec Playbook
Jeff Bollinger, Brandon Enright & Matthew Valites
Crafting the InfoSec Playbook
by Jeff Bollinger, Brandon Enright, and Matthew Valites
Copyright © 2015 Jeff Bollinger, Brandon Enright, and Matthew Valites. All rights reserved.
Printed in the United States of America.
Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472.
O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are
also available for most titles (http://safaribooksonline.com). For more information, contact our corporate/
institutional sales department: 800-998-9938 or [email protected].
Editors: Mike Loukides, Katie Schooling, Indexer: Wendy Catalano
and Amy Jollymore Interior Designer: David Futato
Production Editor: Kristen Brown Cover Designer: Karen Montgomery
Copyeditor: Jasmine Kwityn Illustrator: Rebecca Demarest
Proofreader: Marta Justak
June 2015: First Edition
Revision History for the First Edition
2015-05-06: First Release
See http://oreilly.com/catalog/errata.csp?isbn=9781491949405 for release details.
The O’Reilly logo is a registered trademark of O’Reilly Media, Inc. Crafting the InfoSec Playbook, the cover
image of an American crocodile, and related trade dress are trademarks of O’Reilly Media, Inc.
While the publisher and the authors have used good faith efforts to ensure that the information and
instructions contained in this work are accurate, the publisher and the authors disclaim all responsibility
for errors or omissions, including without limitation responsibility for damages resulting from the use of
or reliance on this work. Use of the information and instructions contained in this work is at your own
risk. If any code samples or other technology this work contains or describes is subject to open source
licenses or the intellectual property rights of others, it is your responsibility to ensure that your use
thereof complies with such licenses and/or rights.
978-1-491-94940-5
[LSI]
Table of Contents
Foreword. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
1. Incident Response Fundamentals. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
The Incident Response Team 2
Justify Your Existence 3
Measure Up 4
Who’s Got My Back? 5
Friends on the Outside 8
The Tool Maketh the Team 10
Choose Your Own Adventure 11
Buy or Build? 12
Run the Playbook! 13
Chapter Summary 13
2. What Are You Trying to Protect?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
The Four Core Questions 16
There Used to Be a Doorway Here 17
Host Attribution 18
Bring Your Own Metadata 19
Identifying the Crown Jewels 21
Make Your Own Sandwich 22
More Crown Jewels 23
Low-Hanging Fruit 24
Standard Standards 25
iii
Risk Tolerance 26
Can I Get a Copy of Your Playbook? 27
Chapter Summary 28
3. What Are the Threats?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
“The Criminal Is the Creative Artist; the Detective Only the Critic” 31
Hanging Tough 33
Cash Rules Everything Around Me 36
Greed.isGood(); 37
I Don’t Want Your Wallet, I Want Your Phone 39
There’s No Place Like 127.0.0.1 40
Let’s Play Global Thermonuclear War 41
Defense Against the Dark Arts 42
Chapter Summary 43
4. A Data-Centric Approach to Security Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Get a Handle on Your Data 46
Logging Requirements 48
Just the Facts 50
Normalization 54
Playing Fields 55
Fields in Practice 57
Fields Within Fields 61
Metadata: Data About Data About Data 62
Metadata for Security 62
Blinded Me with [Data] Science! 63
Metadata in Practice 64
Context Is King 66
Chapter Summary 68
5. Enter the Playbook. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Report Identification 72
Objective Statement 75
Result Analysis 76
Data Query/Code 77
Analyst Comments/Notes 78
The Framework Is Complete—Now What? 78
Chapter Summary 79
6. Operationalize!. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
You Are Smarter Than a Computer 83
People, Process, and Technology 84
iv | Table of Contents
Trusted Insiders 87
Don’t Quit the Day Job 88
Critical Thinking 90
Systematic Approach 91
Playbook Management System 92
Measure Twice, Cut Once, Then Measure Again 94
Report Guidelines 95
Reviewing High-Fidelity Reports in Theory 97
Reviewing Investigative Reports in Theory 97
Reviewing Reports in Practice 98
Event Query System 98
Result Presentation System 99
Incident Handling and Remediation Systems 103
Case Tracking Systems 105
Keep It Running 106
Keep It Fresh 107
Chapter Summary 108
7. Tools of the Trade. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Defense in Depth 110
Successful Incident Detection 110
The Security Monitoring Toolkit 113
Log Management: The Security Event Data Warehouse 113
Intrusion Detection Isn’t Dead 117
HIP Shot 124
Hustle and NetFlow 129
DNS, the One True King 135
HTTP Is the Platform: Web Proxies 145
[rolling] Packet Capture 157
Applied Intelligence 158
Shutting the Toolbox 164
Putting It All Together 165
Chapter Summary 166
8. Queries and Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
False Positives: Every Playbook’s Mortal Enemy 168
There Ain’t No Such Thing as a Free Report 169
An Inch Deep and a Mile Wide 170
A Million Monkeys with a Million Typewriters 171
A Chain Is Only as Strong as Its Weakest Link 171
Detect the Chain Links, Not the Chain 173
Getting Started Creating Queries 174
Table of Contents | v
Turning Samples of Malicious Activity into Queries for Reports 176
Reports Are Patterns, Patterns Are Reports 179
The Goldilocks-Fidelity 180
Exploring Out of Sight of Land 183
Sticking with What You Know 183
Inverting “Known Good” 186
Looking for Things Labeled as “Bad” 187
Chapter Summary 191
9. Advanced Querying. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Basic Versus Advanced 193
The False Positive Paradox 195
Good Indications 196
Consensus as an Indicator (Set Operations and Outlier Finding) 196
Set Operations for Finding Commonalities 197
Finding Black Sheep 199
Statistics: 60% of the Time, It Works Every Time 202
Skimming the IDS Flotsam Off the Top 203
Pulling Patterns Out of NetFlow 206
Horizontal Scanning 206
Vertical Scanning 206
Looking for Beaconing with Statistics 207
Is Seven a Random Number? 209
Correlation Through Contingent Data 212
Who Is Keyser Söze? 217
Guilty by Association 220
Chapter Summary 221
10. I’ve Got Incidents Now! How Do I Respond?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Shore Up the Defenses 224
Lockdown 226
The Fifth Estate 227
No Route for You 228
Not Your Bailiwick 231
One Potato, Two Potato, Three Potato, Yours 231
Get to the Point 232
Lessons Learned 233
Chapter Summary 234
11. How to Stay Relevant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Oh, What a Tangled Web We Weave, When First We Practice to Deceive! 239
The Rise of Encryption 241
vi | Table of Contents
Encrypt Everything? 242
Catching the Ghost 244
TL;DR 245
Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Table of Contents | vii