ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit...

18
ICS/OT Devices And Assets Management Using Splunk Efi Kaufman, Head of Big Data and Analytics Dell EMC @ Israel Ministry of Energy, Cyber Security Center

Transcript of ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit...

Page 1: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

ICS/OT Devices And Assets Management Using Splunk

Efi Kaufman, Head of Big Data and Analytics

Dell EMC @ Israel Ministry of Energy, Cyber Security Center

Page 2: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Agenda for today

•About Us : The Ministry of Energy Cyber Security Center

•References to similar projects

•Quick intro to IT vs OT

•Assets Inventory: Manual vs Automatic and the dark side of the plant

•Getting Data in !

Hope to provide you with an insight into this exciting on-going project, Share my knowledge and maybe spur some interesting ideas (talk to me !)

February, 2019 2

Page 3: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

>whoami

A Family Man, Tech-Geek, Shutterbug

1980 1990 2000 2015

Development Applications and System Analysis InfoSec/Cyber Big Data and Analytics

February, 2019 3

Page 4: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Ministry Of Energy Cyber Security Center

• Generate sector-wide security posture and resilience status

• Provide a safety-net, primarily focus on the private sector

February, 2019 4

Page 5: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

NIST National Cybersecurity Center of Excellence:Energy Sector Asset Management For Electric Utilities, Oil & Gas Industry

Scope:

•Asset Discovery: establishment of a full baseline of physical and logical locations of assets

•Asset Identification: capture of asset attributes, such as manufacturer, model, operating system (OS), Internet Protocol (IP) addresses, Media Access Control (MAC) addresses, protocols, patch-level information, and firmware versions

•Asset Visibility: continuous identification of newly connected or disconnected devices, and IP (routable and non-routable) and serial connections to other devices

•Asset Disposition: the level of criticality (high, medium, or low) of a particular asset, its relation to other assets within the OT network, and its communication (to include serial) with other devices

•Alerting Capabilities: detection of a deviation from the expected operation of assets

https://www.nccoe.nist.gov/sites/default/files/library/project-descriptions/es-am-project-description-final.pdf

February, 2019 5

Page 6: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Discovered Intelligence: Real-time Asset Discovery and Identity Attribution Using Splunk

• Splunk .Conf 18CES :1624- keeS dna dniF— Real-time Asset Discovery and Identity Attribution Using Splunk

by: Paul Johnson, Discovered Intelligence

February, 2019 6

Page 7: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Ou

r fo

cus

Quick intro to Operation Technology (OT)

February, 2019 7

Source: Nist 800-82 – Guide to Industrial Control Systems (ICS) Security Cyber-Physical War Gaming - EJM Colbert, DT Sullivan, A Kott

Page 8: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Risk management in IT vs OT

OT IT

Very often no security at all Security by Design

Maintenance only by the vendors or

approved 3rd parties –

Else, warranty will void!

Available support and patches

Might find the same hardware and software

for 10-15 years and more

3-5 years life cycle

Relatively fixed in order to provide greater

reliability and safety –

But, things are changing with IIoT

Whitelisting ?

Environment will keep changing

(BYOD, Mobile…)

February, 2019 8

Page 9: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Risk = Threat

x Vulnerability x Asset value

February, 2019 9

Is this threat relevant to me and how ?

Am I running the vulnerable device/firmware/version ?

How critical is this device to the safety and reliability of the process ?

Page 10: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Objective: Know Thy Systems

• What devices I see on the network

• The dark side: What should be installed and is not sending any telemetry• Newly added systems

• Dropped systems

February, 2019 10

Page 11: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Source of information

Use logs from an already installed systems (hosts, servers) and security controls (Routers, FW, AV, AppControl) to extract Host+IP+Last Seen

•Authentication events (from DC or hosts)

•Network (Firewalls, Gateways)

•Anti-Malware

•Application Control (White listing)

•ICS IDS (This is really interesting !)

February, 2019 11

Page 12: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

ICS specific Intrusion Detection Systems (IDS)

Allows visibility into devices that are close to the manufacturing process and not communicating over internet protocol (IP)

February, 2019 12

Page 13: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Normalizing the data !

“The Splunk Common Information Model (CIM) is a shared semantic model focused on extracting value from data. The CIM is implemented as an add-on that contains a collection of data models, documentation, and tools that support the consistent, normalized treatment of data for maximum efficiency at search time.”

•The Authentication and Network Traffic are a good place to start

• Authentication : Extract source and target from Interactive logon sessions or host to host/server

• Network Traffic : Extract source and target fromswitches, routers, gateways, firewalls (Dropped connections are helpful as well)

February, 2019 13

Page 14: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

• Manual Assets Inventory Mapping : IP, Host, Model, Version, Zone• Extremely tedious process

• Will provide the ground truth for the asset management process

• Risk Rating : ICS-CERT vulnerabilities History• Great resource for consolidated list of all ICS/OT vulnerabilities

• Watch for the CVSS scoring – must be adapted to each facility

• Device History from the Incident Management System• What this device has been up to….

Enrichment

February, 2019 14

Page 15: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

https://subscription.packtpub.com/book/networking_and_servers/ 9781788395151/1hc/01 lvl1sec 10eht/-eudrup-ledom-rof-lairtsudni-lortnoc-smetsys

Security Zones: Purdue Reference Model

Important tagging

February, 2019 15

Page 16: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Splunk’in it ! (High Level Design)

FacilitiesLogs

Normalize Enrichment

Latest State(Outputlookup

to KV store)

History(collect to

Summary Index)

Manual Assets Inventory records

Search

What devices currently communicate ?

What devices did communicate before and stopped ?

What devices didn’t send any telemetry ?(This is your ‘Dark Side’ or other problem)

ICS-CERT

What devices are known to be vulnerable and in what security-zone they are ?

Runs everyX minuets

What can I say about the device from enriching with other events ?

February, 2019 16

Page 17: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Advanced Topic: Setting a baseline and finding anomalies

• Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authenticationand Network Traffic counts, from which you derive a baseline and call out outliers:

• Simple StdDev*n to draw an upper and lower bounds

• Interquartile range (IQR)

• Or use Kalman Filter or ARIMA to identify seasonality, trend and residual components

February, 2019 17

Page 18: ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

Any questions ?

February, 2019 18


FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

Splunk user group - automating Splunk with Ansible

Splunk user group - automating Splunk with Ansible

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Islands*of*Splunk* - .conf2017 | The 8th Annual Splunk ... · Background*! Splunk*administrators*are*increasingly*required*to*provision*Splunk* as*aservice*offering*to*mulJple*customers*

Islands*of*Splunk* - .conf2017 | The 8th Annual Splunk ... · Background*! Splunk*administrators*are*increasingly*required*to*provision*Splunk* as*aservice*offering*to*mulJple*customers*

Splunk> Partner+ Program Terms · Splunk’s® Technology Alliance Partner (TAP) Program is focused on delivering customer value through complementary technology solutions. By growing

Splunk> Partner+ Program Terms · Splunk’s® Technology Alliance Partner (TAP) Program is focused on delivering customer value through complementary technology solutions. By growing

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Splunk conf2014 - Onboarding Data Into Splunk

Splunk conf2014 - Onboarding Data Into Splunk

Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad itinnovation@contacts.bham.ac.uk Indexing 2.2.1 Searching using splunk Splunk uses

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Supercharge*Your* Mobile*App*Delivery* With*Splunk*MINT* · Splunk*MINT*itBecame!* 6 September*16,*2013*Q*Splunk*acquired*BugSense* • Team*moved*to*Splunk’s*HQ* • New*productline*

Supercharge*Your* Mobile*App*Delivery* With*Splunk*MINT* · Splunk*MINT*itBecame!* 6 September*16,*2013*Q*Splunk*acquired*BugSense* • Team*moved*to*Splunk’s*HQ* • New*productline*

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

ISSA Thought Leadership Webinar · 2018-11-14 · Launches and Content. Prior to Illumio, Vijay spent 4+ years at Splunk running Product Management and Strategic Alliances for Splunk’s

ISSA Thought Leadership Webinar · 2018-11-14 · Launches and Content. Prior to Illumio, Vijay spent 4+ years at Splunk running Product Management and Strategic Alliances for Splunk’s

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for

SPLUNK’S DGA MACHINE LEARNING APPLICATION

SPLUNK’S DGA MACHINE LEARNING APPLICATION

Splunk*MintSDK* · splunk*Mintitbecame!* 5 September*16,*2013*the*day*Splunk*acquired*BugSense* • Team*moved*to*splunk’s*HQ* • New*productline* • Combined BugSense’s*data

Splunk*MintSDK* · splunk*Mintitbecame!* 5 September*16,*2013*the*day*Splunk*acquired*BugSense* • Team*moved*to*splunk’s*HQ* • New*productline* • Combined BugSense’s*data

Splunk Overviewsplunk402.com/wp-content/uploads/2015/01/AITP.pdf · Agenda • What is Splunk? • What is Machine Data? • Splunk’s Interface • Troubleshooting with Splunk •

Splunk Overviewsplunk402.com/wp-content/uploads/2015/01/AITP.pdf · Agenda • What is Splunk? • What is Machine Data? • Splunk’s Interface • Troubleshooting with Splunk •

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

BOOZ ALLEN CYBER4SIGHT FOR SPLUNK: … Allen Cyber4Sight® for Splunk fuses Booz Allen’s human-derived intelligence with the power of Splunk’s analytics-driven security to deliver

BOOZ ALLEN CYBER4SIGHT FOR SPLUNK: … Allen Cyber4Sight® for Splunk fuses Booz Allen’s human-derived intelligence with the power of Splunk’s analytics-driven security to deliver