Cyber Sleuth: Finding Hidden Connections in Cyber Data Jennifer Reif Developer Advocate, Neo4j jennifer.reif@neo4j.com @JMHReif github.com/JMHReif jmhreif.com linkedin.com/in/jmhreif

Who is Jennifer Reif? Developer Advocate, Neo4j • Continuous learner • Conference speaker • Tech blogger • Other: geek Jennifer Reif Developer Advocate, Neo4j jennifer.reif@neo4j.com @JMHReif github.com/JMHReif jmhreif.com linkedin.com/in/jmhreif

Let’s talk Cybersecurity Diverse topic https://www.linkedin.com/pulse/map-cybersecurity-domains-version-20-henry-jiang-ciso-cissp/

Attack chain for CVE-2018-20250 exploit (WinRAR RCE) https://www.microsoft.com/security/blog/2019/04/10/analysis-of-a-targeted-attack-exploiting-the-winrar-cve-2018-20250-vulnerability/

Who are we up against? Everyday data - complex, intricate Photo by mauro mora on Unsplash

Cybersecurity tasks Identify and prevent: • Attacks (DOS / Ransomware) • Disclosure of private / sensitive data • Unauthorized changes to applications / privileges • Unauthorized account access

How do we fight (all) these? • Separate hardware solution tools • Tackle multiple aspects: • (Usual) Internal accounts / exploits • External user accounts (customer + partner) • Exploitation pathways (exposed account) • Multiple action paths: • Reactive • Proactive

Recap The problem(s) • Complex, intricate data • Attackers: looking for gaps across many vectors • Several cybersecurity tasks to manage • Need to compile multiple sources • Need to strategize from multiple perspectives

What do the scenarios have in common?

It’s a graph! Connected data = graph

John Lambert -- Distinguished Engineer, Microsoft Threat Intelligence Center

Defenders: lists Row + Column view of data • List of access user has • List of groups • List of permissions • List of applications • Lists of steps to perform Photo by Thomas Bormans on Unsplash

Attackers: graphs Entrypoint -> What’s connected • Admin user -> workstation -> domain controller • User -> group -> machine <- admin

Attack chain for CVE-2018-20250 exploit (WinRAR RCE) https://www.microsoft.com/security/blog/2019/04/10/analysis-of-a-targeted-attack-exploiting-the-winrar-cve-2018-20250-vulnerability/

Path Connections present attack path(s) https://github.com/JohnLaTwC/Shared/blob/master/Defenders%20think%20in%20lists.%20Attackers%20think%20in%20graphs. %20As%20long%20as%20this%20is%20true%2C%20attackers%20win.md

Networks are connected graphs Holistic view of network • Surface hidden connections • Combine data sources for direct/indirect relationships • Provide uni fi ed view • Naturally visual analysis/tooling https://ernw.de/download/BloodHoundWorkshop/ERNW_DogWhispererHandbook.pdf

Graph can help Approach data di ff erently • Minimize impacts by • Quickly identify risks • Detect anomalies • Protect systems from multiple vectors

Building a graph

Graph components Graph theory foundations • Node (vertex) • Relationship (edge)

Nodes Graph components • Represent objects or entities • Can be labeled • May have properties Order Product Employee orderId: 162468 orderDate: 2019-04-01 productId: 08746589 name: “Ipoh Coffee” id: 247924 startDate: 2016-05-04 position: “Barista”

Relationships Graph components • Must have a type • Must have a direction • May have properties • Nodes can have multiple Order Product Employee orderId: 162468 orderDate: 2019-04-01 productId: 08746589 name: “Ipoh Coffee” id: 247924 startDate: 2016-05-04 position: “Barista” CONTAINS date: 2022-08-16 tip: 1.00 SOLD CONTACT CREATED

Label Graph components • A group of nodes • Like a category Person Employee Customer

Neo4j Export / Import • Cypher + APOC • ETL Tool • Dump fi le (not backward-compatible)

Cypher: powerful and expressive Jennifer Neo4j WORKS_FOR CREATE (:Person { name: ‘Jennifer’}) -[:WORKS_FOR]-> (:Company { name: ‘Neo4j’}) NODE PROPERTY NODE PROPERTY LABEL LABEL

Cypher: read Jennifer Neo4j WORKS_FOR MATCH (:Person { name: ‘Jennifer’} ) -[:WORKS_FOR]-> ( whom ) RETURN whom

Loading a dump file Drag+Drop

APOC library Import CSVs (or other data) • Cypher LOAD CSV • apoc.load. • MERGE (node) • SET properties • APOC functions/procedures for manipulation and cleaning

Demo!

No content

Resources • Github repository (today’s code): github.com/JMHReif/cybersecurity-sleuth • Sandbox (hands-on - cybersecurity): sandbox.neo4j.com/ • GraphAcademy: graphacademy.neo4j.com/ • NODES 2024: dev.neo4j.com/nodes24 Jennifer Reif Developer Advocate, Neo4j jennifer.reif@neo4j.com @JMHReif github.com/JMHReif jmhreif.com linkedin.com/in/jmhreif