cais sensor: distributed sensors network in brazilian...
TRANSCRIPT
![Page 1: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/1.jpg)
CAIS Sensor: Distributed Sensors Network in Brazilian NREN
LACSEC
LACNIC27
![Page 2: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/2.jpg)
Regarding RNP
• Brazilian National Research
and Education Network (RNP).
• Created in 1989.
• Implementing the first Latin
American fiber network in 2005.
![Page 3: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/3.jpg)
Regarding CAIS
• Coordination CSIRT of Brazilian
research and education network since 1997.
• CAIS works in detection, resolution and
prevention of network security incidents.
Security Vulnerability Management
Security Incident Handling
CSIRT Development
Security Awareness
![Page 4: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/4.jpg)
Rede Ipê, Brazilian academic network
backbone. Built-in capacity of 347 Gbps
* dados de 2015
Interconnects 1.911 units of RNP's Customers
(Universities, Federal Institutes, Research
Organizations).
Highly diversified environment, regarding
networks, technologies and maturity of
customers’ security teams.
Difficulties for efficient detection.
Motivations to create a
CAIS Sensor network
![Page 5: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/5.jpg)
CAIS Sensor Requirements
![Page 6: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/6.jpg)
What is the CAIS Sensor?
![Page 7: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/7.jpg)
How does CAIS Sensor analyze traffic?
![Page 8: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/8.jpg)
How does CAIS Sensor work?
Sensor (Suricata)
Master Server
Engine(Suricata)
Engine(Suricata)
Engine(Suricata)
+ + Query
![Page 9: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/9.jpg)
What does Master Server do?
• Sensor’s system updates
management
• Sensor management
• Statistics of malicious
activities detected
• Information about sensor’s
“health”
• System general
administration
Master
Engines(Suricata)
![Page 10: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/10.jpg)
Regarding Engines(Suricata)
• Friendly user interface
• Plug and play
• Less technical knowledge required
• Low maintenance and support
• Send detections by email
• Send statistics and status data
• Update requests
Engines(Suricata)
![Page 11: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/11.jpg)
The CAIS Sensor(Screenshots)
Main menu
Quick access
tasks
Quick
Information
dashboard
![Page 12: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/12.jpg)
The CAIS Sensor(Screenshots)
![Page 13: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/13.jpg)
Engine(Screenshots) – Installation Menu
• Restart Services.
• Network interface configuration.
• Select network pickup interface.
• Use license configuration.
![Page 14: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/14.jpg)
27 RNP Points of Presence
17 Customers
44 Sensors Installed
CAIS Sensor
Implementation
![Page 15: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/15.jpg)
Statistics – Average Analyzed Traffic
![Page 16: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/16.jpg)
Statistics
91%
9%
Incoming Outgoing
Malicious activity flow Most attacked ports
![Page 17: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/17.jpg)
Statistics - Main types of malicious activity
detected
DDoS Attempts(protocol xdmcp) 702.345
DDoS Attack (protocol NTP) 535.204
Malwares 236.985
DDoS Attack (protocol SNMP) 102.478
![Page 18: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/18.jpg)
Statistics – Types of detected events
![Page 19: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/19.jpg)
Statistics - Botnets
nicaze.net Zeus XcodeGhost
Feodo
DealPly
PCRat/Gh0st
Palevo
Bladabindi/njrat
Beacon
Kelihos
![Page 20: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/20.jpg)
Next Steps
• Optimize reports
• Integrate with other sources (URLs blacklist,
IPs blacklist, others)
• Increase number of sensors in educational institutions
and RNP customers
• Finalize and expand the partnership model
![Page 21: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/21.jpg)
Questions ?
![Page 22: CAIS Sensor: Distributed Sensors Network in Brazilian NRENslides.lacnic.net/wp-content/uploads/2017/05/sensors_rildo.pdf · Brazilian NREN LACSEC LACNIC27. Regarding RNP • Brazilian](https://reader035.vdocuments.mx/reader035/viewer/2022071216/604790aa1ff6495814103081/html5/thumbnails/22.jpg)
Thanks!RNP – Brazilian Educational and Research Network
CAIS – RNP Incident Security Response Team
Yuri AlexandroSecurity Analyst
Rildo SouzaSecurity Analyst