As an analyst, your job is to identify potentially
activity.
This could be in the form of spam emails to phishing emails,
even network activity looks potentially dangerous
people clicking on the wrong links or malware
that's been injected inside of your system through USB
or even through the process of downloading potentially
malicious files throughout your course of your career.
You need to be able to not only identify those specific activities
but identify different trends that come in play throughout your network.
Are you seeing a boot
network activity when there shouldn't be,
are they visiting sites or specific IP addresses that
are related to known specific malware or bad threat actors
throughout your career?
You need to be able to look and analyze different activities,
subsets and different trends associated specifically
with malicious activity
within malicious activity specifically on a network basis.
You need to be able to look specifically
at the three different tiers associated with it.
Whether that's at the application layer ie the software
that your employees or the different departments interacting with.
Is it just Microsoft 365?
Maybe it's a new program that's been identified specifically for that department.
Uh What type of applications are being utilized
within that department and what's authorized versus unauthorized?
What processes are they doing?
Is there a process that contradicts a security safeguard that we've put in place?
Is there unauthorized usage
during the time of day that they're
accessing the information or specific files or infrastructure
that they're not authorized to access all of this wraps into
the application form right at the top of the pyramid.
Then you need to identify specific hosts,
different hosts have different permissions and those different permissions
correlate to the authorizations associated with instant employee.
We need to be able to identify which employee is authorized to access which host.
Now, it may sound pretty simple because you're saying, oh, well, I've got, you know,
293 systems and all of them on Windows.
But what happens if there's a Linux operating system in there or even another
Windows system that has specific hardware or
software attributed to a specific project?
All of those need to be carefully
when we're looking at the authorizations and the
authentications that we utilize within our host network,
we need to look at the processes and applications to make sure that
different processes are corresponding properly to
other applications on the same system.
How are they interacting with one another?
Are there crashes occurring or bugs occurring within the specific host?
Because those applications are cross connecting
within your role as a security analyst,
you need to be able to identify specific and potentially
unwanted processes or bugs occurring at the host level.
Finally, there is a network level
now, more often than not, when we look at network level,
we see fancy words like IP S or I DS firewall router
and you're just hit with a slew of basic networking components,
but that's not really what your job as a network analyst is.
Yes, it's one part and yes, you need to be aware and trained properly on those parts.
But what about the other
aspects of it? What about unusual Bandwidth changes?
Is there Bandwidth that's occurring at 2 a.m. in the morning?
That shouldn't be there.
Is there Bandwidth that's occurring in the middle of the afternoon?
We often relate to Bandwidth uh surges at inappropriate times throughout
the night when we look at our baseline and go.
Oh, well, we're usually playing in this much traffic
and then all of a sudden at 2 a.m. we've got this much traffic.
But what about the middle of the day?
We often forget that even though that's the majority of
the time where our workplace is using that information.
If I'm a malicious actor, I'm not going to try to do something at 2 a.m. in the morning.
It's too easily caught.
I would go in in the middle of the day in the middle of the afternoon.
And that's when I would try to exfiltrate data because usually
a security analyst is kind of blinded by the traffic,
they're not really paying attention to what's going on.
You need to be able to look at those unusual
traffic patterns and identify
what traffic is appropriate and authenticated and
which traffic is inappropriate or unauthenticated.
And what I mean by that is where is the traffic going? What is interfacing with?
You have a proprietary servers that you're utilizing that is only has so much
traffic per day that only a limited number of people should be utilizing.
And all of a sudden we're seeing upbound trick traffic in that unauthorized access.
We need to really pay attention to our traffic levels as they
could be a major indicator of what's going on in our,
on our network as a whole and could identify potentially unwanted or unauthorized
traffic and even potentially dangerous traffic such
as malware or exfiltration of data.
We need to look at those unusual connections
if we don't authorize FTP ports to be open on our network.
And all of a sudden, we've got five of them. That's an issue. But what about that? What
often we look at things and we go, oh, well,
it needs to be this major Empire state building in the middle of our traffic.
And it's just so glaringly obvious that that's what we want to point out.
But as an analyst, that's not what we're looking for more often than not.
We're looking for that needle in the haystack, but there's trends,
there's little idiosyncrasies that we can identify in those traffic patterns.
And unusual connections are one of those trends
if I have even one FTP port open and I shouldn't have any. That's a problem.
What about one telnet
port? What about one HTTP port?
If our network doesn't authorize those type of connections,
we need to be able to identify them very quickly
and then shut them down as soon as we can,
network related systems come in different forms and formats.
The first one usually being beaconing,
beaconing occurs when I've got a malware
or potentially unwanted person inside my network.
And every so often they beacon back to a command and control portion, meaning
that they're beaconing back out.
Now, this is usually only a few bits that says, hey, I'm alive.
It's also known most appropriately as a keep alive signal.
And what's happening is I've got that one client or that server that's sending
a signal back to a command and control for malicious activity saying yes,
I'm still here, please send me data or send me a command
and it just throws it out there.
Now, we can usually find bacon
as a security analyst because it's very, very uh synchronous,
meaning that it may happen every 10 minutes on the dot or
every two hours on the dot or so on and so forth,
right?
But sometimes malicious actors get really careful
about it and they're like we're going
to spread it out and do a random time between five and 10 minutes,
which makes it harder to see.
But if you're seeing a specific form of traffic to a
website or a known IP address on a regular basis,
maybe every hour or every 24 hours.
And it's very, very small.
That could be an indicator of compromise called beaconing.
There's also peer to peer communications.
Most of our networks don't do peer to peer communications except internally
if we're starting to see peer to peer communications outside of
our network through a specific device or a specific IP address
and they're not going through a VPN. That's an indicator of compromise.
What can we do about that and how are they communicating?
We need to investigate and find out and analyze how
are they not only proceeding with that type of communication?
But what is the communication that they're utilizing?
Rogue devices are another major problem with our
environment.
Usually rogue devices are pretty well.
They're, they're from employees that just don't know any better.
They're not really negligent or malicious in activity.
They're just people that don't realize what they're doing
could cause security vulnerabilities within their own network.
Our
own device is very simple. I've got a RJ 45 port inside an office.
Uh Somebody's trying to hook their computer up to it,
but maybe the break room or even the
conference room doesn't have a very good wifi system
and they've called it. Usually they've opened up a ticket but it is slow to respond.
Or maybe it told them, hey, that's not authorized equipment.
But the employee just really wants Wi Fi in there.
Usually it's a manager or even somewhere high up where they're like,
this is ridiculous.
I just want wi fi in my conference room.
And so what inevitably happens is an employee goes out,
they go to Best Buy or maybe Target or even Walmart and they pick up this Wi FI router
and they put it in basic bridge port just like they would
in the residential office and they plug it into our network.
This then creates a wi FI signal for their conference room.
And now all of a sudden we have a security violation.
That device usually isn't set up properly. It's not part of our control structure.
We don't know what's on there.
Maybe the security on there is very low key because usually it came from like I said,
a residential portion.
So it's not big on security and it's just
evaded or bypass a lot of our security controls.
So those rogue devices need to be handled very quickly,
very swiftly and we need to educate our employees on how to do that
at the same time. From a cyber perspective.
In an it perspective, we need to look at it and go,
why did they put this in the first place?
Right?
Did they have a ticket open with us or was it somebody acting, will nilly,
this is a perfect opportunity to educate the users and not only let them know, hey,
this rogue device could cause security vulnerabilities.
But we have policies or procedures in place where
if you need Wi Fi inside the conference room,
open up a ticket, we'll get to it when regularly time.
If it's an emergency,
have your manager or your director reach out to
us and we're more than happy to comply.
A lot of people when it comes to rogue devices,
they're uneducated or they feel like there's
roadblocks put in their place by having an
open communication between the it staff or
the cyber staff and those different departments,
we have a better line of communication.
And remember for cybersecurity, an open
communication is the best valuable defense that
we can utilize inside our organizations.
On this slide,
you can see a wire sharp screenshot
where somebody has taken place and they've outlined
and read for you where someone has actually performed a sweep of the environment,
meaning they've taken a single IP address and they're
trying to communicate to other addresses associated with it.
Now, specifically with this one, it's just an example.
But I want you to think as an analyst,
how important is something like Wireshark really is.
We can identify different scans
through port crawls as in looking at Wireshark
and identify is it going through this port
and then this port and this port and you can actually detect on a WireShark scan,
a blueprint like this where they've gone through different ports,
looking to see if the port is open that shows up in Wireshark and
in Cysa,
it is expected that you understand and are able to
read different scan sweeps that are occurring within this environment.
There's other tools that you can utilize as well.
There's tcpdump for instance,
that provides you with a non graphical user
interface for the same type of information.
Both of those have their own buses and minuses associated with it.
But most people relate back to wireshark.
You can also find this on an IP S
and intrusion prevention system or intrusion detection system.
You can see the security logs in a seam or in your own
firewalls as well.
And you really need to be able to read how those different
uh uh scan sweeps play out within an environment such as this,
you will be asked questions like this in your cys a exam.
And while you don't have to go that much into depth with it,
you do need to be able to quickly identify whether this is a port sweep
or if it's a sweep that's trying to identify or do a brute force attack
our network.
All this would play into something like this
where they provide you a screenshot of an
element or a tool and you're expected to identify what's going on within that tool.
Most of them are pretty cut and dry.
You can see the different ports, you can see the usernames and passwords,
so on and so forth.
But if you haven't had the opportunity,
definitely go through and learn how to read these log
files as they're an important part of the cys.
A example
within our own networks, we can also see different traffic spikes.
Now,
we've talked about this already where we have
a baseline of traffic information coming through our,
through our network, whether it's 2 a.m. or 2 p.m. it doesn't really matter.
But that's where the baseline of traffic information really comes into play.
You can see on this screenshot that we have two major spikes in network traffic.
Now,
this is indicative of an indicator of compromise where we're seeing a
massive amount of traffic in a very short amount of time.
However, there could be explanations for this as well.
We don't want to have a knee jerk reaction
where we just go through and say, oh, that's malicious activity.
And here's why we need to investigate, why is there a spike in traffic?
There could have been a major product rollout.
There could be a marketing uh meeting that was going through,
there could be a lot of changes or maybe there's
a conference going on where our company or organization is,
be ping back into our systems because they forgot
something or maybe their computer system isn't acting greatly.
We need to be able to track where these traffic spikes come from
and whether they are malicious in nature or if there's legitimate traffic,
they'll always assume just because you're in cybersecurity
that everything we see is malicious activity.
This sets you up for a, a failure, right? At the get
go instead come from the ideology that, hey,
I don't know what this is and let's investigate it and find the truth behind it.
Now, sometimes that requires a knee jerk reaction.
For instance,
if I have a very secure server and we're seeing network traffic
come out of it where nobody should be accessing that server.
Yes, that warrants a knee jerk reaction to cut it off as soon as possible.
However, if it's just a file server that's maybe not on the hr system
on the operation system
and it's classified as low. Does it require an
a reaction to shut that off? Probably not.
But that doesn't mean we shouldn't investigate it either.
Throughout this presentation,
we've identified different indicators of compromise.
We've also
pointed some network symptoms and trends that
can be associated with listless activity.
We've also identified different exam points that you're expected to see
whether it's with network traffic or tools using wire sharp or even
how
network traffic could be indicative of malicious
activity versus regular activity on your network
as you're going through these different courses
as you're going through these different tools.
It's important to identify what can I
learn from these specific advantages of the tool
itself and how can I utilize that tool within my own job of analysis.
Remember that with security plus,
you already know the foundational knowledge and
the level that you need to appropriately.
Uh I understand
uh cybersecurity cys A takes it a step further.
What you're trying to do here is prove that you understand how to read
logs and how those logs interface with the business aspects of your organization.
As AC Y SS A specialist,
you're really supposed to be able to identify the
different attributes associated with malicious
traffic versus legitimate traffic.
And then how does that correspond to business needs within your environment?
It's important to note with NCYS A that you're supposed to have
2 to 5 years of experience before you take this exam.
And that's what Kia
really is expecting.
And so take it from the perspective of a senior analyst or even someone, a low
level manager where you need to not only understand the technical perspective,
but the business perspective as well and how those correspond with one another.
If you can do that, you'll be very successful in this example.