A "beat" of security - Codemotion Berlin 2017

From guessing a weak password to exploiting zero-day vulnerabilities, there are a lot of ways attackers can get into your private network. Even if you follow all the best security practices, there’s a good chance you will face a security incident sooner or later. The questions are: how quickly will you find out? how will you respond? how will you know which systems are compromised? How fast you can find out makes the difference between a catastrophe and a minor incident. This talk will show you what can you do to discover the security breaches as soon as possible, using the Elastic stack and Auditbeat.

Transcript

1. A “beat” of security Tudor Golubenco @tudor_g
2. Tudor Golubenco Software engineer and Tech Lead for Elastic Beats
3. Elastic Stack Kibana Elasticsearch Beats Logstash
4. Logging and Monitoring
5. Security
6. Tower defence 6 Firewall App security OS user isolation Encryption Unprotected host discovered Remote shell as unprotected user Remote shell as root
7. Security Breaches
8. • Zero-day vulnerabilities • Heartbleed, Cloudbleed, Shellshock, etc. • Out of date software with known vulnerabilities • Weak passwords. Default passwords • Lost unprotected phone that’s logged into email and Dropbox • Commit by mistake your AWS credentials in GitHub How breaches happen 8
9. WHY? 9
10. • You find out from the press • You find out from the attackers who request a ransom • You find out from the AWS bill • You find out yourself, but after the harm was done • You find out yourself, but you are not sure what the harm was • You find out yourself, no harm was done, and you can prove it How do you find out? 10 bad not so bad
11. How can you detect a breach as quickly as possible?
12. Logging and Monitoring
13. 50+ other community Beats shipping The Beats, collecting all sorts of operational data 13 Filebeat Metricbeat Auditbeat Packetbeat Winlogbeat Heartbeat
14. Demo
15. 15 • Like auditd, but: • correlates related events automatically • resolves UIDs to user names • publishes natively into Elasticsearch • easier to configure • Gives eBPF powers, but works on older kernels • Can run side by side with auditd Auditbeat - nothing gets past it
16. • Install Elasticsearch & Kibana (~30m) • Or get a cloud instance: https://cloud.elastic.co/ (~5m) • Run Filebeat & Metricbeat with the system modules enabled (~15m) • Install Auditbeat with the configuration I demoed: (~15) • https://gist.github.com/tsg/eb7a3beb511b81c083afa905c035f901 • ???? • Profit Homework 16
17. • More auditd / auditbeat rules: • https://github.com/linux-audit/audit-userspace/tree/master/rules • Setup alerting for common issues • Elastic Watcher • Watch the “Security @ Slack” talk, by Nate Brown & Ryan Huber • https://www.elastic.co/elasticon/conf/2017/sf/security-at-slack For overachievers 17
18. • Ship to Elasticsearch, apply analytics and alerts on there Keep your alerting logic private 18
19. Q & A @tudor_g