Telephone - Good To Know Stuff

 

Today let's reminisce what was telephone and how it worked back then.

Telephone

• Telephone is common usage in Telecom, as it comprises telegram, television, fax, etc. 
• Teledensity is term which shows how many people are using telephone lines.
• A term commonly used to describe the number of telephone lines per some unit of the population (often per 100 people); the density of telephone. It also shows company's wealth.
• The different between telephone and computer is
• The old computer may not support to the current environment, whereas old model telephone can support to the environment but with the same features what it had.
• CTI => Computer Telephony Integration
• Voice Call recording system uses the following
• communicating with telephone
• on hook and off hook process

Analog Phones

• Analog telephones are dependent on voltages. It works on flow of voltage. It doesn't sends any packets.
• Types of Phones
• Rotary telephone
• Dial plan telephone
• Connection Settings
• Exchange ---- twisted pair wire ----> wall jack / rosette ---- twisted pair wire ----> local phone

• The local phone has two parts :
• headset
• connected with coiled wire
• twisted pair wire (copper wire) 
• red wire
• black wire
• jack
• base unit(box) or dialing box :
• Consists a place where the handset is kept, which is called "cradle".
• Consists two "hook switches", but now we have only one.
• Power
• The exchange gives power to phone.
• 50V dc power is sent to phone, when it is on hook state.
• The "multimeter" can measure the voltage passed.
• Dial Tone
• When the handset is picked up, a tone is played at the first is called dial tone.
• To check whether connection is established.
• To check the working state of the phone.
• If the dial tone is heard that means it is ready to use.
• Ring back
• The ring received after dialling the number.
• Handset place on the hook is called as on hook.
• Handset picked up then it is off hook.
• 70V AC is given when incoming call has come.
• While off hook is there then maximum voltage is given 20V to 28V.
• Flash => Getting the attention of the PBX. After that PBX will accept the numbers to perform some actions(hold). In the PBX certain numbers will be configured to respond that number.
• If the hook switches are pressed less than a second then we may get the attention of PBX.
• Oscilloscope is used to see the voltages.
• Rotary Dialler : The phone's dialler will be in a circle.

Architecture of Base Unit

                             

• hybrid : It will transform one type of signal to another. It is also meant as transducer. It is the very costly part of the base unit. The quality of the voice depends on this. The quality of the voice is evaluated here.
• capacitor : It will filter the AC from DC. It sends AC for ringing (incoming call). 
• In the on hook, the telephone will receive 50V.  When the incoming call comes the PBX will send 70V to our phone. When we make a call it will get a ring back tone from the PBX and the calling telephone will get 70V for ringing.
• The problem in this system is that, if the phone is disconnected from the wall jack then we too will get the ring back, it will just check the wall jack's connection not the wall jack to phone connection.
• In rotary phone, if we press the hook continuously, then there are chances of call to be made.
• When we pick up the handset, then the hook switch mechanism closes the switch. Then the voltage will be passed to the hybrid.
• To dial we will rotate the dialler, if we rotate zero then from the zero position it will open and close the dial switches(before hook switch) 10 times. All this will send pulse to the exchange, then the exchange will realise the pulse and calculate the number. All these pulses will be sent within a second. The one of the use of wall jack is that we can connect many telephones, else we can connect only one.

How Telephone Call Works

• After picking up the handset : Hear the dial tone passed by the PBX, this means the exchange is ready to serve.
• Dial the number, the dial tone will be stopped.
• Numbers are sent to the PBX in pulses, there it is counted and identifies the numbers. 

  Eg: The number dialled is 432.

  The pulse will be as following :

  _   _   _   _        _   _   _        _   _

               _| |_| |_| |_| |______| |_| |_| |______| |_| |_

                       4          |       3       |      2

                                  |               |

                                  V               V

• Inter digit Time : This is the time between the each digit pressed.
• Receive the ring back. And the other side receives 70V AC for ringing.
• The dial tone received back and voice will be of 400Hz purely which is modulated 20Hz.
• Then the connection is established, the voice will passed in pulses.
• All the combinations will be sent within a seconds, milliseconds or micro seconds.

Digital Phone

• Digital phone will send packets to communicate instead of sending voltages. 
• All the communication has been sent in 0s and 1s. 
• In digital, the header information like source address, destination address, etc., is used to send send and receive the packets.
• It is more intelligent and fast. 
• It gives lot of features of the analog phones.
• It gives constant power supply. 
• Unlimited signalling will be given.
• It has good speed to respond the request.
• Digital phones are fully dependent on PBX. So, if we use digital phone then the digital line has been made between phone and PBX.
• Noise tolerance.

VoIP

• It needs the network connection.
• It sends the data compressed in the packets format.
• It is more intelligent and faster compared to analog and digital.

Features of Telephones

• Ringing alert
• The LED will glow, if there are many telephones then to identify which phone is ringing.
• Ring volume controller 
• To control the volume, to minimize and maximize the call's volume.
• Automatic gain controller 
• To tune the voice.
• Flash button 
• To get the attention of PBX.
• Pulse and tone mode facility
• Can change the modes, but after the call completion it will reset to the original one.
• Hold button 
• To put a call in hold.
• Pause button 
• To pause a call, using this we can skip the IVR's options.
• Mute button
• To put a call in mute, this will avoid the user to hear us.
• Redialing 
• Wall mountable phones 
• Phones kept on the walls.
• Memory 
• Save the contact details.
• Hands free dialing 
• Echo cancellation 
• Subtracting the incoming and outgoing voice to avoid noise.
• Ringer Equivalent number 
• To obtain power consumption of the telephone.
• Caller id.

Telephone Exchange

                      Telephone Exchange

                  +------------+

      111(Phone) <------| *        * |-------> 101(Phone)

      112(Phone) <------| *        * |-------> 102(Phone)

      113(Phone) <------| *        * |-------> 103(Phone)

      114(Phone) <------| *        * |-------> 104(Phone)

      115(Phone) <------| *        * |-------> 105(Phone)

      116(Phone) <------| *        * |-------> 106(Phone)

                  +------------+

• A telephone exchange system acts as an intersection between two phone lines. 
• This is because a direct phone line between two establishments doesn’t actually exist.
• In the telephone exchange previously man intervention was needed. 
• This problem was solved by Mr. Strowger.  
• He designed the automated branch exchange.
• The communication can be done in only two ways analog(pulse) and digital(tone mode).
• Pulse Mode:
• Pulse mode refers to a way of signal transmission that involves sending electrical pulses down the telephone line.
• Pulse duration is short, measured in milliseconds or microseconds.
• Pulse is complicated.
• Tone Mode:
• Tone dialing refers to a way of transmitting signals in telecommunications systems that uses audio tones of different frequencies.
• Every digit when we press will have a frequency, which will be unique, to identify the number.
• The frequency is the combination of two frequencies. Since it will be difficult for the user to mishandle it, as this is very difficult to make the artificial voice.
• The tone is simple.
• There are phones now-a-days where we can change to Tone Mode or Pulse mode.

Telecommunication

Telecommunications such as radio, telephone, and television all use a method called multiplexing--shortened to "muxing"--to transmit and receive information.

Multiplexing

• Multiplexing was designed to send numerous analog signals or digital streams through one common transmission line.
• Multiplexing is the sharing of a communications channel through local combining of signals at a common point.
• One output, many input.

A------------+

B------------+ Multiplexing 

C------------+------------------- 

D------------+

De-Multiplexing

• Demultiplex (DEMUX) is the reverse of the multiplex (MUX) process – combining multiple unrelated analog or digital signal streams into one signal over a single shared medium, such as a single conductor of copper wire or fiber optic cable.
• Many output, one input.
• It is used for reducing the cost.

                         +------------- 

         De-Multiplexing +------------- 

        -----------------+------------- 

                         +------------- 

                         +------------- 

• Ex:
• A organization has 100 employees, get only one line from the exchange. From that make 100 connections.

TDM (Time Division multiplexing)

• This is also one of the methods in multiplexing which will work based on the time.
• The method of combining more than one independent data streams into a single data signal and transmitting that single data signal through a multiplexer to a demultiplexer is known as time-division multiplexing.

Ex :

----

   000|010 

A ---------+         +----------- A

   011|001 +   +------------+         +-------------+   +

B ---------+---+ Multiplexer+---------+ Demultiplex +---+----------- B

   111|100 +   +------------+         +-------------+   +

C ---------+            +----------- C

• Multiplexer read the data from the start(A) to end(B) within a second. If any channels are empty, it doesn't consider and send the data in a sequence. 
• Demultiplexer have control to identify the empty channels and separate the data using the given duration(one second). So first it reads the data 000 and 011 etc.
• First it takes all the data from the channels which has to be sent in the first one second. That will be passed into de-multiplexer. Then de-multiplexer separates the information based on the time. Here the time is one second but in real life it will be less than microseconds.
• Multiplexer does a multiplexing and De-Multiplexer does the de-multiplexing work. In between these two, one controlling terminal will be there for controlling the data. While passing it sends duration channels. Controlling terminal decides how many channels send that data.

Signalling

Analog Signals Features

• Accuracy
• Caller id is passed between rings.
• Analog Signal

      _           _           _           _           _

     / \         / \         / \         / \         / \

    /   \       /   \       /   \       /   \       /   \

----+   +-     -+   +-     -+   +-     -+   +-     -+   +------

          \   /       \   /       \   /       \   /

  \_/         \_/         \_/         \_/

Digital Signals Features

• Noise tolerance
• Avoid data loss
• Caller id is passed in packets.
• Digital Signal

                                           

    +---+   +---+   +---+   +---+   +---+  

    |   |   |   |   |   |   |   |   |   |  

----+   +---+   +---+   +---+   +---+   +------

PCM - Pulse code module

• This is a technique for converting analog signals into digital form.
• PCM samples the signal 8000 times a second, each sample is represented by 8 bits for a total of 64 Kbps.
• There are two standards for coding the sample level :
• Mu-Law 
• A-Law 

Sampling

• Sampling is a way to convert the analog to digital.
• Sampling rate means samples taken per second or hertz, the rate at which the samples of an analog signal are converted into digital form.
• To get original voice the sampling rate must be high.
• It requires double of bandwidth rate. Since the limiting factor is the bandwidth at which speech can be transmitted. 
• The 8000 samples per minute is taken for 64kbps.
• Example, the bandwidth telephone line we take as 64kbps at a sampling rate of 8kHz and 8-bits per sample.
• 8000 samples per second * 8-bits per sample = 64000bps = 64kpbs. 

Companding

• This is a technique used to compress data. It compresses the 16 bit data into 8 bit.
• This is formed from the words COMpressing and exPANDING. 
• Companding reduces the noise and crosstalk levels at the receiver by sending the compressed data and then expanding it at the receiving end to increase the signal quality when it is digitizing an analog signal.

CoDec

• The conversion of signals from analog to digital is performed by a coder. 
• On the receiving side, the process will be reversed using a decoder so that the signals can be used by an analog telephone.

PBX

• It is abbreviated as Public Branch eXchange.
• It is a switch station for telephone systems. It consists mainly of several branches of telephone systems and it switches connections to and from them (linking phone lines).
• To buy telephone for every employee of a organisation it will charge on the following basis :
• Wiring
• Rental
• Maintenance
• Deposit
• Call charge
• The calls made within the organisation costs heavily. Using PBX we multiple the phones.  Hence PBX is less expensive than connecting an external telephone line to every telephone in the organization.
• It's easier to call someone within a PBX, dial only 3 or 4 digits.
• It is like a hub, all the calls are routed to and from it.
• Two types of PBX:
• Soft PBX --> asterisk, freeswitch
• Hard PBX --> avaya, nortel, alcatel

PRI

• This is a type of ISDN.
• This is like a multiplexor, from a signal wire connected to the PBX 30 channels will be separated.
• This is a wire.
• This is an international communications standard for sending voice, video and data.

                           ------------ 701

                                    |

                                    |

                           ------------ 702

                                    |

                                    |

                           ------------ 703

   |

PRI --------- PBX  -------- |

                           ------------ 704

                                    |

                                    |

                           ------------ 705

                                    |

                                    |

                           ------------ 706

Cadence

• It is the pause between the rings.
• ring -- pause -- ring
• In America it is 4 seconds pause and 2 seconds ring.
• This differs based upon the country and PBX.

MSN

• The abbreviation is multiple subscriber number.
• These numbers will be given by exchange provider.
• E.G : from 700 to 799
• There can be many connections provided but only 30 can be simultaneously connected. 

Pilot Number

• It is a unique number given with a PRI connection.
• Example :
• From ABC, we are making a call and changing our profile details.
• We have changed our number to some other number which is not provided from MSN or it can be an invalid number.
• Then we will get a number as our caller number which is called pilot number.

ISDN 

• It stands for integrated service digital network. 
• It is communication standard which can be used between telephone exchange to telephone exchange and extension to extension.
• For communicating to the different exchange, one standard has to be followed that is ISDN.
• Types:
• BRI - Basic rate interface
• PRI - Primary rate interface 
• In BRI there are 2B channels and ID channel. In PRI there are 30B channels and 2D channels. 
• B channel -> Transfer the data(information)
• The speed of the B channel in BRI is 64 KBPS 
• D channel -> Control the data passed through B channel.
• The speed of the D channel in BRI is 16 KBPS 
• PRI Standards :
• E1 : European country introduces this standard. Indians are also using this standard.
• T1 : North America uses this type.
• J1 : Japan uses this type.

Type  Channels    Speed 

-----------------------------------

E1   (30B + 2D)  (64 Kbps + 64 Kbps )

T1   (23B + 1D)  (64 Kbps + 64 Kbps )

J1   Same as E1  (64 Kbps + 64 Kbps )

• For all the B channel only one D channel has been used. It is called as NFAS which will be used in T1 type standard.
• G7F1 is a standard which is used by B channel to send the data. The mulaw supply sampling rate is 8000 sp/s. For mulaw the sampling has been get as 16 bit and stored as 8 bit.
• G931 is a signalling method for controlling all the B channel. This standard is not only used for this. It is used globally in all the channels. Before sending the data it sends the packets in the channels for controlling the data.
• DID : It stands for direct inward dialling. It is a facility when the Multiple Service Numbers has been used. 
• Ex: In our organization MSN numbers are 43902701 - 43902799.
• ACD : It stands for Automatic Call Distribution which is used to route the calls to the appropriate systems.

Alcatel PBX

• The standard number is 4400.
• It has lot of wires such as power, extension, earth and PRI.
• It also has floppy, processor, hard disk.
• For knowing the status of extension LED's will be there.
• It transfers data in 0s and 1s.
• It uses the Unix OS.
• We can enable or disable any extension. 
• We can give the commands such as ping, ssh, traceroute, etc.
• If we need to add any device to the PBX, there no need to restart the PBX, since if we restart the data can be lost.
• It has the slots to add PRI.
• Main distribution framework : It is used to distribute the signals.

Facilities in the PBX

• Call parking
• It gives the numbers to park the calls. The parking is done based on the PBX.
• Call transferring
• Two types of transfer:
• Attended transfer (manual process needed to transfer the call to other person).
• Blind transfer (automated).
• Enquiry facility
• This is used to find out the line is busy or not.
• Queuing call
• If one number received more than one call at the same time, then the calls are made to be stand in the queue.
• Call waiting
• Conferencing
• Conference calls can be made.
• Wireless phone
• Noise tolerance 
• The noise and volume can be adjusted.
• Hunt Group
• Group of the extension numbers and call can be made to the group  number. 
• The call may be go simultaneously or one by one.
• Pick Group
• If you are in the same group then you can attend others call by typing # followed by the person's extension number.
• Chain dialling
• It is used to redirect the calls if one is not ready to attend.
• Heart Line
• Dedicate line for the extension. In this feature user don't need to type the numbers. 
• When the user picks up the handset, call goes automatically.
• Call follow me switch
• It is used to redirect the calls if one is not ready to attend with in a time.
• Call barring
• It is used to restrict the incoming call and outgoing call.
• Dynamic call barring
• It is used to restrict the call by some time.
• Call detailed record
• It is used to get call related informations. It is mainly used for billing purposes.
• Call budget
• It is used to restrict the minutes to speak.
• Call barging 
• It is used to hear the other's communication without their knowledge.
• Production from barging
• If we set this option no one can overhead of your conversation.
• DND ( Do Not Disturb )
• Toll Free Numbers ( Company will be charged )
• DSS (Digital station selector)  console
• It is used to control the calls and also used to restrict the extension numbers.

Asterisk

• It is open source soft PBX.
• Asterisk give the interface to configure all the things in easy.
• AsteriCon
• It has the details of asterisk meeting which happens every year.
• Switch matrix
• It is used to identify the capacity of PBX. How much matrices have based on that only the connection has been made.
• Least call routing
• The way of finding shortest path.

Credits and References

https://ars.els-cdn.com/content/image/3-s2.0-B9780080508030500101-f05-26-9780080508030.gif

https://media.hswstatic.com/eyJidWNrZXQiOiJjb250ZW50Lmhzd3N0YXRpYy5jb20iLCJrZXkiOiJnaWZcL3RlbGVwaG9uZTIuZ2lmIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjoyODV9fX0=

https://networkencyclopedia.com/plain-old-telephone-service-pots/

Incident Management

 

Introduction

Every organization irrespective how secure they are, there will be incidents occurring either internal or external. Planning for such incidents are vital. We will see life cycle which covers the responsibilities from identification to investigation and to mitigation. 

Incident Response

As a security engineer one might need to face and handle different security issues every day such as malware detection, buffer overflow attack, DDOS attack, data theft, access misuse, disruption, down time, ransom attack and so on.

NIST - National Institute of Security and Technology provides complete security handbook called "NIST Special Publication 800-61 Revision 2" - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf guidelines to handle the incident response lifecycle.

Incident Response Lifecycle

• Preparation
• Detection and Analysis
• Containment, Eradication and Recovery
• Post Incident Activity 

Incident Response Planning - Preparation

Incident response planning involves in preparation, roles, rules and procedures to tackle incident.

• Documentation
• Communication details and protocols
• Documentation for incident analysis
• Incident mitigation software
• Capture the data, including hardware and software to use later as evidence
• Policies while handling incidents
• Roles and Responsibilities:
• Incident Response Team - IRT, Cyber Incident Response Team - CIRT, SME plans and executes how to handle the intrusion. Trained team to handle the incidents for the entire cycle
• IT security management, precaution and post action measures such as firewalls
• Compliance officers, planning and communication
• Technical staff, helps in resolving 
• Users, awareness and training
• Vendors, awareness and training
• Management, strategies
• Communications team, informing the press or infected parties
• Legal team, decides when the information needs to be shared
• CIO - Chief Information Officer, CISO - Chief Information Security Officer, mission, policies and decision making
• Exercise
• It is important to ensure effectiveness during an event or identify any deficiencies in the process that should be addressed.
• Mock runs without impacting production or any system, rehearsal.
• Functional exercises, run through actual drill as they would perform during actual emergency. 
• Tabletop exercises as full drill would be time consuming and expensive, these would be in smaller simulated disaster version.
• Walk through, discuss and test processes, procedure from the tabletop exercise.
• Simulation, test the simulated event such as phishing attack
• Training, is critical to be given periodically to each teams based on their roles and responsibilities. Hence each roles and responsibilities needs to be clearing defined.
• Jump Kit
• As like first-aid, jump kit is prepared and available for immediate use of an incident.
• Communication
• Contact list needs to be update to date and accessible for everyone.
• Hardware and software for analysis and mitigation
• Secure storage facility
• Forensics workstations
• Portable printer
• Protocol analyzer
• Ancillary analysis resources
• Port lists
• Network diagrams
• Application architecture
• Continuity or Recovery Plans
• Disaster Recovery Plan
• To ensure full recovery of operational capacity following the natural disaster.
• Documentation, planning and periodic tests needs to be done.
• BCP or COOP - Continuity of operations planning
• Ensures the continuity of operations by restorations of an organization functions in the shortest time possible, even if the services resume at reduced level during emergency.
• COOP is similar to BCP but primarily focus on government and public sectors.
• Based on the incident either of the plan could be considered as part of recovery.
• Fundamentals of any disaster recovery plan involves backups.
• Retention Policies
• Backup of copies
• Regulatory compliance
• Operational needs

Attack Frameworks

IRT needs to understand the process of attack, how they are executed, and how to prevent. Having knowledge of these frameworks are crucial.

• Cyber Kill Chain
• Lockheed Martin developed to defend its network based on chain of attacks made by the attacker.
• Cyber kill chain adopts this process in cyber security.
• The cyber kill chain has steps involved the attacker attacks the system from the beginning to end, as a security engineer one needs to break this chain as early as possible.
• Lockheed Martin's cyber kill chain attack from the attacker's perspective in general includes below stages:
• Reconnaissance: Identifying the target
• Weaponization: Preparing for the attack
• Delivery: Launching the attack
• Exploitation: Gaining access from the attack
• Installation: Establishing persistence
• Command and Control: Enabling remote control for further manipulation
• Actions: Achieving the goals
• In order to defend, we need to understand the attacker's actions.
• There are different tools and solutions used at each stage, to break the chain before the attack reaches the goal.
• MITRE ATT&CK
• MITRE ATT&CK - Adversarial Tactics, Techniques and Common Knowledge Framework was created by MITRE Non Profit Organization in 2013 to document attacker tactics and techniques based on real-world observations.
• The document continues to evolve providing the organization's incident response team to understand the attackers behaviour and plan ahead to mitigate these attacks.

Credit: https://anomali.cdn.rackfoundry.net/images/uploads/research/mitre-attck-navigator.png

• Diamond Model of Intrusion Analysis
• Another similar framework to describe cyber attacks.
• There are 4 parts giving a comprehensive view for cyber attacks.
• Adversary
• Details about the attacker, who, why or purpose of the attack
• Infrastructure
• Infected physical or logical systems or data leak details
• Capability
• Develop or deploy using the attack tools or techniques
• Target
• Affected area, data centre or country or region
• The model provides flexible framework to analyze the threat as cognitive (understand interrelated logic) and as well as mathematical(improves strategic).

Credit: https://ars.els-cdn.com/content/image/1-s2.0-S0167404822002024-gr20.jpg

Incident Detection

• Challenge
• It is difficult to identify an incident has occurred as there is huge volume of data and hard to detect legitimate threats.
• Incidents are complex extensive knowledge is needed.
• Precursor
• Sign that an incident might occur in future
• Logs or vulnerability scanners giving the heads up incident
• Network traffic deviate from normal flow
• Unauthorized host configuration change alerts
• Indicators
• Sign of incident has occurred or may be occurring
• Alarms from anti malware or anti virus software
• Alerts from intrusion detection/prevention system
• Exploit announcement
• Direct contact from the attackers reach for ransom
• Isolation and Containment
• Sandboxes, to avoid malware spreading over the network it has brought to isolation run the malware and analyze the results
• Malware are smart at times they run differently or destruct the running system if they are isolated or unable to connect to other systems in network.
• Recovery after Incident
• Removing the malware is important following one of the methods
• Restore from backups
• Rebuild from scratch
• Replace compromised files
• Disable breached user accounts and create new 
• Tighten the system, such as 
• Firewalls
• Enable Multi Factor Authentication
• Certificate changes
• Reconstitution
• Eradication means removing the element of the incident such as malware.
• Recovery is restore systems to normally functional operations.
• Not all the incidents requires eradication, for some only recovery but be good enough, and sometimes bother eradication and recovery needs to work hand in hand.
• Eradication and recovery should be done in phased approach as recovery may take time and it needs to be efficient.
• Documentation
• Lessons learnt from the incident needs to be captured with all the details along with time and to be improved over a period of time.
• Functional impact of the incident, categorization such high impact or low
• Information impact of the incident, type of impact on the information, eg: data leak of PII can be classified as data breach
• Recoverability from the incident
• Post incident analysis documentation for future prevention.

Investigations

Suspected incident or indicators needs to analysed, first step would be to confirm if it is true positive. Different tools and frameworks are available to determine the scope of the incident. IRT will help the team to prioritize potential issue for deeper analysis or to take next action of incident mitigation.

Identify Vulnerability 

In the given system the vulnerability scanner will scan the entire device or application to check if there are any know vulnerabilities. In general these scanners will scan and match the signatures of existing identified vulnerabilities present in the device or it could warn us with the security controls not in place. 

After discovery we can read about the vulnerability and how to resolve this from different sources available in the internet or the vulnerability scanner itself can provide the details. One of the most popular site to refer is National Vulnerability Database at "https://nvd.nist.gov/vuln".

The scan report includes the issues such as malware found, firewall not configured, old version software found, unencrypted telnet server and much more. The report could produce false positives where it has identified a vulnerability but in reality it is not, which we need to be aware of. Sometimes it can have false negatives, the real issue is missed to report. To avoid such scenarios have the scanner up to date along with the signatures.

Credit: https://docs.gitlab.com/ee/user/application_security/vulnerability_report/img/project_level_vulnerability_report_v14_5.png

SIEM - Security Information and Event Management

SIEM is centralized log system, which will consolidate all the information and logs from different source systems such as operating systems, firewalls, routers, web servers, database servers, application servers and so on, to analyze from single reporting tool.

The logs are parsed and stored in common format, as each system would produce different style logs. As the single reporting system these information will converted and also tagged with different category, such as source system could tagged as linux, linux oracle server, and so on. Further each log entries would categorized as information, warnings, errors or urgent.

As these informations are collected over of a period of time it could be used to see the trends and proactively provide alerts or alarms. Additional reports and intelligence could be fed into these systems. SIEM provides interactive dashboards with charts, graphs, trends which can help investigator explore the data through interactive drilldowns.

Credit: https://www.softwaretestinghelp.com/wp-content/qa/uploads/2019/06/Splunk.png

Logging

Security monitoring process involves in creating and analyzing extensive logs and data. Log files will guide us where to look for the related data. Using these files we can gather information root cause information and plan for the solution. Hence while creating log files we  need to be careful as it takes up system resources - too much logs will be bog down the read operation though necessary information should be logged.

Log Files:

• Network logs
• Switch logs
• Router logs
• Firewall logs
• DNS logs
• Operating system logs
• Application logs
• Web application logs
• Database logs
• Audit logs
• System logs
• Call Manager logs
• Bandwidth logs
• Security logs
• Access logs - requests and connections between systems

Log Management:

• Syslogs
• Transferring logs from one device to centralized database usually SIEM is called syslogs in Linux.
• Logs come with different severity levels - debug, information, warning, error or fatal, we can configure to capture based on the level. Log level warning is good for the production and debug for development environment.
• Daemons running syslog are:
• syslog - syslog message includes the facility code and the severity level. A facility code is used to specify the type of system that is logging the message. Messages with different facilities may be handled differently. Eg: 0 - kernel messages, 1 - user messages, 2 - mail messages.
• rsyslog - Rocket Fast System Log
• syslog-ng - Logging with filter
• nxlog - Multi operating system platform log collector
• Journalctl
• The journald daemon collects data from all available sources and stores them in a binary format for easy and dynamic manipulation.
• Journalctl command is used to view, search and filter the logs stored in the binary format.
• Metadata
• The data that describes other data sources. Will be useful while performing the incident analysis.
• Eg: for email we will have standard header storing the sending and destination address, in mobile having the gps locations, etc.
• Network Activity
• Netflow
• Gathers the traffic statistics from all the traffic flow in the entire network.
• IPFIX
• IP Flow Information Export, tracks the IP actions in the network
• IPFIX collects the data packets from across the network, organized by an Exporter which sends the compiled version to the Collector.
• IPFIX provides the flexibility by customizing the templates, these templates outlines the data the user wants to collect.
• Serves as industry standard for the export of flow information from network devices.
• sFlow
• Sampled Flow, used for monitoring high speed switched networks.
• Packet sampling in embedded technology is used to monitor network devices such switches, routers, wireless access points.
• Only the portion of the actual network traffic is captured, yet been found useful in getting the complete network visibility, for defence against security threats.
• Protocol analyser
• Able to analyse the traffic at packet level, several tools such as wireshark protocol analyser

Incident Mitigation

In the process of incident mitigation is a critical part of the incident response process. Applying mitigation techniques or controls in order to secure an environment is a key to containment, eradication and recovery phases.

Incident mitigation requires eradication or containment of the malware for securing an endpoint as a precaution. An endpoint could be desktop computer, laptop, smartphone or tablet. As a security team its our responsibility for monitoring all of these different devices.

Approach

Controlling the applications running on the endpoint, creates more secure and stable environment.

• Allow List
• Create a list of applications that are approved
• Allow only the approved applications to run on the endpoint
• Restrictive approach 
• Deny List
• Maintain deny list of applications
• These list of applications will not be allowed to be executed on the endpoint
• Anti-virus and anti-malware behaves the same
• Quarantine
• Applications suspected to be malicious will not be allowed to run.
• It will move from that system and place it into a quarantine area, where no applications are allowed to run. This does not mean removing it or cleaning it, just in different area to avoid spread.
• Later security team can perform additional analysis on the suspected application and this will avoid its spread if proven malignant. 

Criteria

An ability to run or not run an application in an operating system is commonly built into the core functionality of the os. Security team can enable to disable different parameters to allow certain software to run or deny.

• Application Hash: Execute only if hash of the executable matches on the system.
• Certificate: Execute only if the digital signature matches.
• Path: Limit permissions to certain folders, allowing to be executed only from certain folders. Eg: one may run an application with local rights and accessing only those certain folders. Here this cannot extend accessing the folders belongs to root or other users.
• Network zone: Set a policy that would allow or disallow an application to run based on the zone it is executing from. Eg: an application run in private area but prohibited to be executed in public zone. 

Controls

• Firewalls
• Allow or deny application traversing in the network
• Block using rules such as ip address block or allow, zone wise allow or block
• MDM - Mobile Device Manager
• Have rules on the mobile devices that can allow or disallow access.
• These rules or polices can be configured using MDM and only security administrator can set or unset the policies
• DLP - Data Loss Prevention
• DLP identifies and blocks the transfer of any PII - Personally Identifiable Information.
• Eg: Credit card numbers, social security number, etc if it has been transferred outside will be blocked.
• Content filter/URL filter
• Restrict or allow only certain websites.
• Many of the these URL filters can also be integrated with third party blocklists.
• Blocklists can be updated constantly allowing real time blocking the malicious sites.
• Certificates
• Allow access from only trusted devices
• Deny the access if it does not have trusted certificate on that device
• Isolation
• Isolation is a process where a device or application is moved into an area where it has limited or no access to other resources.
• It is a key strategy while fighting against malicious software or software thats constantly trying to communicate back to a command and control location.
• Network Isolation
• Isolating device to a different network disabling the access to the rest of the network, when suspected malicious or not fully protected.
• No communication to other devices.
• Process Isolation
• When a process running on the device seems to be suspicious, we can disallow any access from that process to the rest of the network.
• This will limit application execution but allow device management.
• Containment
• Run each application in its own sandbox, limiting the interaction with the host operating system and other applications.
• Here it prevents the spread of malicious software to prevent from jumping outside of that application to infect the local machine or other devices in the network.
• Segmentation
• In general extensive security is created between the outside of the network and internal network. But once the malicious software enters inside network it is able to traverse freely without any concern of being blocked.
• To overcome this network administrators have started to create segmented networks within the network. 
• Eg: Database is usually placed in a network where it can be accessed only from backend application. And web application servers can be accessed from internet but internally it can only interact with backend applications.
• SOAR - Security, Orchestration, Automation and Response
• As there are different and many controls needs to be taken care, it would be challenging and mistakes can occur if done manually.
• To automate these processes we need SOAR.
• Using SOAR, an admin can integrate multiple third party tools and have them all work together.
• Runbooks
• A runbook holds detailed steps on how to perform particular task
• Playbooks
• When a particular event occurs, a set of runbook together performed is called a playbook.

References and Credits

https://gluu.biz/wp-content/uploads/2020/05/incident-management.png

https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/sy0-601-comptia-security-plus-course/

Cloud Cybersecurity Solutions

 

Introduction

Cloud enables elasticity allowing users to dynamically avail resources based on the needs and only pay for what they use. Voila! a great invention for the digital world.

Allowing only authenticated services to scale up or down and ease of ramping up or down with immediate visibility to the authorized admins. The authentication, authorization, firewalls, audit and transaction visibility are crucial steps in cloud security. 

Though we technically own the servers, but as we know mostly we don't have physical control on the servers, leading to additional care. Cloud security it is shared responsibility of the customer and the cloud service provider - CSP. 

Today we shall discuss about cloud infrastructure and some of key elements in towards its security. 

Region and Availability Zones

Uptime and availability are one of the two important aspects of cloud security. Regions are different geographic locations the service providers maintain their infrastructure. For each region there can be more than one Availability Zones - AZ. For example a cloud service provider could support two regions India and Australia, and in each of the regions there could multiple AZs for instance in India two AZs in Mumbai but different parts.

Each of the AZs are self contained and independent. Each having different power providers, separate network confirmations and so on. Making in reliable, if any one AZs downtime will not affect the other AZ.

As user we can take advantage of this, and could configure our application to the nearest region of our users in order to reduce latency. Also load balance either through active/active or active/standby configuration. Providing the flexibility to switch when there is an issue or overload requests, enabling high availability.

Each region cost may different of the services and not all regions would provide all the services. Also while selecting the region the compliance regulations needs to be considered. 

Virtual Private Cloud (VPC)

In a public cloud space we can create a private isolated network known as VPC. It is just like the private cloud having both public and private subnets. The private does not exposing the IP addresses as public address and can be accessible only through restricted means. VPC is essentially at the network layer as a IAAS service. 

An analogy, in a IT parks we have different organizations having different facilities such as parks, auditorium but the work area is private only employees or restricted person can enter. Here private area is similar to VPC, we have major control over it and as well its considered to be secure. Separation is security opportunity, eg the web servers can be accessed from anywhere but the database should be accessed only by the backend application servers.

Multiple subnets could be created in the single VPC, definitely within the range of IP addresses the VPC is created with. The subnet could be either private or public, this draws the line for the servers in these network not to access from public network. 

VPC Gateway endpoints, allows connecting multiple VPCs keeping the data private without using the internet.

Virtual LAN (VLAN) is as like LAN way of partitioning the network as the group of servers connected can access each other without hitting internet. Here the partitioning occurs in the layer two of OSI model.

Virtual Private Network (VPN) uses encryption on top of the public network, making it secure and avoiding man-in-middle attacks.

Firewall

Security groups are acting as a “firewall” on instances. Using security group, we can control both the incoming and outgoing traffic. They are stateful, which means any traffic in is allowed to go out, can go back in. Supports only allow rules, means traffic cannot be explicitly blocked, rather only allow configured traffic in. 

NACLs are acting as a “firewall” at the subnet level. We can associate a single NACL to multiple subnets, but only one NACL can be assigned a subnet.

These stateless as the inbound and outbound rules apply for all traffic. For example, if the output traffic is allowed our request would reach out, but if expect a response, sorry it would need to have the outbound rules specified. Supports all both allow and deny rules for both inbound and outbound traffic. Here we can specify only reference a CIDR range (no hostname). 

Additionally we have services provided by CSPs to protect at different layers of OSI, such as WAF - web application firewall secures at layer 7, Network firewall protects at layer - 4 and so on. This could enhance the security blocking unusual API calls, not allowing or allowing access from certain geographic locations, track and report attempts made to access critical data.

IAM Policies

In cloud access to resources is governed by policies and their permissions centrally with audit enabled by default. Each policy can be attached to the entity, user, user group or a role.  

There are two basic policies either we call it identity based policy or resource based policy. Under identity based policy permissions are given to the user, user group or role. And for the resource based policy these policies define who can access and what activities they are allowed to perform.

Stating access will be granted only when both the policies allow, if either is denied access will not be granted. By default all the access would be denied, explicit allow only grants the access. But if there is explicit deny it will get higher precedence and access will be denied.

Granular access policies can be set such as allow or disallow certain IP addresses, data and time, group, geographic locations, etc. 

Managing Secrets

Applications that use API Keys, encryption keys or credentials should not have it hard coded. Cloud provides services to handle the secrets elegantly. Secrets are encrypted at rest and in transit. 

Secrets management protects and manages the access to the applications and services. IAM policies makes sure one has access to secrets. 

Central Logging

Monitoring and audit is crucial phase of cybersecurity. Cloud provides framework and services to manage and enable monitoring granular level. 

IAM access, policy change, infrastructure changes are some of the common tasks where the logging is default enabled and aggregated in the central location. But these would not be sufficient, cloud provides APIs to write more and customized logs based on the user's requirement.

These centralized logs can be further used for further inspecting and analysis, as well integrate with any SEIM Solution. Intuitive reports could be created from these logs. 

Cloud Access Security Broker (CASB)

Each cloud service provider provides a set of tools enabling the security tools. But there could be gaps or the requirements could not be matched by them. And as the data resides with the cloud service provider maintaining security and adhering security policies becomes important. In such scenarios on premises or third party offerings - CASB come to a rescue, fill in the gaps and compliment cloud security services. This is placed between the cloud consumer and cloud provider.  

CASB provides security software as a service addressing cloud service risks, enforce security policy, threat protection, data security, comply with regulations. This can be implemented as software running either locally or in cloud. CASB operates on four primary characteristics:

• Visibility: Visibility on the entire processes running on cloud and if it authorized. Validation and avoiding misconfigurations.
• Compliance: Following organization own or mandated policies, like HIPAA, PCI
• Threat prevention: Allow only authenticated and authorized users to the granular level, including multi level approvals or multi factor authentication.
• Data security: Protect and encrypt the sensitive data at rest and in transit. Ensure APIs is secure, where the attackers can exploit the interfaces.

CASB along with next-generation secure-web gateways (SWGs) monitoring and management of web APIs and user/entity behaviour analytics (UEBA) provide the capability to deliver static and dynamic access to the management.  

CASB is evolving into on huge service known as Secure Access Service Edge (SASE) architecture. SASE combines multiple security and networking technologies to provide comprehensive web and cloud security. Security Service Edge (SSE) is the convergence of multiple cloud-based security services as part of a Secure Access Service Edge (SASE) architecture. 

Security Awareness

Structural awareness solutions help manage risk and apply protections to systems and data.

• Cloud compliance and best practices: Visualization and continual assessment of the environment, including the ability to enforce known good standards
• Instance and container visibility: Monitoring and protection of containers through their life cycle
• Virtual private network: Secure access to applications running in a VPC for remote employees
• Secure data: Encryption and key management solutions to protect data and meet regulatory compliance standards
• Vulnerability assessment and management: Visibility into the attack surface to discover and resolve security issues
• Software composition analysis: Management and security for open-source licenses
• Operational intelligence: Aggregation and correlation for the analysis of data across security, performance, and availability
• DevSecOps: Automated and continuous process management for continual integration and delivery of secure applications
• Cyber risk management: Prioritized insight into the threats, vulnerabilities, and impacts of cloud assets
• Container security: Minimal or hardened operating system that is specifically designed to run containers. Running similar security demand services on a same host, limit the scope of intrusion.
• Backup: Maintaining backups ensuring availability by following the legal requirements such as holding information for 7 years, data should saved our of country.
• Permissions: Authentication and authorization at granular level and constant audit to ensure there is no break.

Situational awareness solutions detect security events and are capable of responding, recovering, and helping with continual improvement. 

• Firewalls and proxies: Provide fine-grained inspection of traffic for potential threats at both the network and application levels
• Endpoint detection and response: Protect endpoints, including cloud workloads from zero-day and other attacks
• Intrusion detection systems: Monitor networks and workloads for security events
• Backup and restoration: Protect data from errors, failures, and accidental deletion
• Disaster recovery: Provides additional flexibility to quickly recover from a disaster, ensuring that cloud workloads are available
• Security information and event management: Ingests, correlates, and prioritizes events for deeper visibility into anomalous behavior and threat mitigation
• Workload isolation: Provides dynamic security control for microservices, containers, and other workloads

References and Credits

https://www.cloudcodes.com/blog/wp-content/uploads/2020/05/cloud-security-for-dummies.png'

https://www.cloudflare.com/en-in/learning/cloud/what-is-a-virtual-private-cloud/

https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/cloud-security-controls/