A "beat" of security, with the Elastic Stack

From guessing a weak password to exploiting zero-day vulnerabilities, there are a lot of ways attackers can get into your private networks. So even if you follow all the best security practices, there’s a good chance you will face a security incident sooner or later. The questions are: how quickly will you find out? how will you respond? how will you know which systems are compromised? In this talk, we’ll show you how to use the Elastic Stack, and in particular Beats, to detect security breaches.

Transcript

1. A “beat” of security Monica Sarbu and Tudor Golubenco
2. About us Monica Sarbu Software engineer and Beats team lead Tudor Golubenco Software engineer and Beats tech lead
4. Beats are lightweight shippers that collect and ship all kinds of operational data to Elasticsearch
5. The Beats 5 30+ other community Beats shipping
6. Elastic Stack Kibana Elasticsearch Beats Logstash
7. Logging and Monitoring
8. Security
9. http://www.campussafetymagazine.com/article/friday_humor_6_major_security_fails
10. • NSA breaks in your network • Zero-day vulnerabilities • Heartbleed, Cloudbleed, Shellshock, etc. • Out of date software with known vulnerabilities • Weak passwords. Default passwords • Commit by mistake your AWS credentials in GitHub Security breaches 10
11. • You never find out • You find out from the press • You find out from the attackers who request a ransom • You find out from the AWS bill • You find out yourself, but after the harm was done • You find out yourself, but you are not sure what the harm was • You find out yourself, no harm was done, and you can prove it How do you find out? 11
12. Logging and Monitoring (for security)
13. Data Sources
14. auth logs • SSH logins (password or publickey, IP, GeoIP) • failed sudo attempts • useradd / groupadd
15. Windows logons • logon failure events from the Security event log
16. auditd • watch file accesses • new network connections • new processes
17. Running processes • find suspicious commands
18. Network connections • outbound connections initiated by a process • processes in listening mode
19. Demo