Security Incident and Event Management (SIEM) Overview

Security Incident and Event Management (SIEM) Overview

Starting from the top of a cybersecurity organization, a Security Operations Center (SOC) is in charge of proactively keeping company assets safe, such data stored on a company's network. One such tool for the SOC to do their job is to use a Security Incident and Event Management (SIEM) tool. SIEM collects data from a 1) wide variety of sources in 2) wide variety of formats - to enable a real time view and broad analysis of past data. SIEM is more about collecting, indexing, tagging, contextual mining than it is about security per se. That is why Splunk (a logging collection and analytics platform) is a leader in the Gartner SIEM MQ. 

Sources of data to SIEM: 

• Endpoint (EP) Security : As the agent that protects laptops, tablets, and phones an the edge of enterprise control, the End Point Agents needs to Prevent Threat, Protect Data, Secure the Network, Ensure Compliance, Respond to Incidences.
• Firewall (FW) Security : A firewall acts as a barrier between a internal network and external networks, by controlling incoming and outgoing traffic based on predetermined security rules. Packet filtering, stateful packet inspection are some of the techniques used.  
  
• Intrusion Detection System (IDS) & Intrusion Prevention System (IPS) : An IDS monitors network traffic for suspicious activity and potential threats, alerting administrators when such activities are detected. An IPS takes IDS a step further and ACTS to prevent or mitigate further damage.
  

Types of data sent or accessible to SIEM:

• events : a simple record of what happened in the network - can be just a time stamp, source identifiers, and a code
  
• messages : a bigger, verbose record of what happened in the network - usually containing contextual information to help with forensic investigation
  
• logs : a record of systems happenings, such as events and messages
  

Types of actions from SIEM:

• alert
• analysis
• reporting : start with alerts, and after an analsis
  

At the bottom, I have listed Security Orchestration, Automation and Response (SOAR) as a receiver of SIEM alerts, and SOAR can provide automated responses to the alerts. SIEM alerts can also be fed to User Entity and Behavioral Analysis (UEBA) to leverage the power of AI/ML to find threats.

Security Landscape

The term "Security", especially in the Cybersecurity context, is broad and confusing. Terms like "NGFW" and "UEBA" are thrown around - sometimes without context. So here I lay out the security landscape, but with focus on Network Security - the old guard and hence has the highest market share of roughly 40%. In this drawing, I will try to show Network Security, and how it is peers to other important security measures such as Application Security and Endpoint Security, and where "NGFW" and "UEBA" fit.

Note that some cybersecurity practioners might categorize IDS and IPS as part of a firewall - and that is completely ok. Firewalls are primarily about controlling access to networks. IDS focuses on detecting and alerting on suspicious activities. IPS combines detection with proactive blocking capabilities to prevent attacks. But for this blog, I purposely broke them apart because terms like "Gen 2 Firewall" and Gen 3 aka NG Firewall" and thrown around, and I wanted this diagram to make that easier to find. 

A quick walk through of compute : mainframes to containers to smart contract

 

This is my stab at the history of computer usage in business enterprises.

Time Shared Mainframes & Terminals

Early machines were big, heavy, and only for enterprise usage. Long forgotten names like Wang, Sperry, DEC roamed these ground, with IBM was the leader and barely growing today. Because these machines were so big and heavy, users had to time share the usage of these machines from dummy terminals. Some of the machines ran on vacuum tubes. Tubes were hot, and a moth flew into one, melted itself on a tube, and caused the computer to malfunction. The term "de-bug" came from this era.

Mini, Micro, and Personal Computer

A The "personal computer" era started with the semiconductor industry producing cheap, powerful processors. Motorola and Intel were leaders in this field. The big and heavy mainframe machines were shrunk from house sized to desk top sized. Microsoft created DOS, but PC usage was obscure until Windows was introduced.

Client and Server, Monolithic & Service Oriented Architecture

On the enterprise front, software was delivered in a client server architecture. Client is the user facing front of of the computer system, usually a PC or a terminal. The back end of that system, invisible to the user, is the server. It is usually found in a room dedicated to servers, hence called back office. The programs that ran in the server included Enterprise Resource Planning, Accounting, Database. The programs (such as ERP) were written in a single large program - hence monolith. Monolithic programs sometimes needed to talk to other monolith programs, and this was done via a Service Oriented Architecture.

Cloud & RESTful API

The computer server infrastructure sat physically in the office, or in a dedicated remote building called data center. But companies did not like buying, maintaining, replacing servers that they owned. Why not lease them? That's what cloud did. They lease compute, and started to port their original "monolithic" programs to the cloud. What if you had one program used by many users at the same time? If you had 100 users, do you have 100 programs running? That is wasteful. Multi-tenancy technology allowed one program to run, but accessed by 100 users. Its slower, but data is consistent, making the system faster overall.

Cloud Native & Containers

Monolithic programs were not designed to scale to more users, more regions, more storage. And they made upgrade components of the software very hard - need to bring down the entire program, instead of just updating the little piece. Big monolithic programs were broken down into small containers. The containers talk to each other through API or queues. If a component of the program needed to be updated (let's say it is responsible for displaying the latest news - not critical if it is part of a stock trading website), just bring down that container, and replace it with a newer container.

The Future : Edge, WASM, Smart Contract

Some say we have swung to far into the container world. It benefits are obvious (scale, modular maintenance, etc), but it also brings a lot of overhead (connectivity, versioning, etc). We suspect adoption will be selective. New startups will pick the latest compute paradigm. But the old, with its vast amounts of technical debt (think COBOL), will change just enough to function, but not change enough to break. Watch out for more "edge" compute, including Web Assembly (WASM), where your browser is smart enough to perform compute, elevating the status of browser from "show" only to "compute and show". Blockchain "smart contracts" will unify business code from both the application and the network itself into once place - with the added benefit that it can natively handle money via cryptocurrency.

Identity & Access Management (IdM or IAM)

Identity & Access Management is the tool, framework, and process to control access to privileged resources. Let's look at current framework to deploy identity and access management : inspired by ISC2 is the IAAA framework : Identity,  Authenticate, Authorize Accounting. Decoding what this frame requires:

• Identity : the unique attributes that define you, usually validated and issued by a trusted entity
  
• Authentication : proof that you are indeed the person that you claim to be, sometimes called identity proofing
  
• Authorization (or Access Control) : once you prove who you are, what are you allowed to do and not do
  
• Accounting : logging of everything so that there is a forensic trail to audit all activities

Let's dig deeper into IAAA.

Identification - the unique attributes that define you, validated and issued by a trusted entity

Identity of a person usually starts at birth - your name - written on an official document. In California, it is on a "Certificate of Live Birth" document. Other examples identification include passports issued by its sovereign national government, drivers license by the state government, school ID by a university.

Authentication - prove that you are indeed the person that you claim to be

For you to prove that you are you, there are five types of authentication that can be used.

1. Type I : what you know, such as PIN, passwords, favorite ice cream flavor
2. Type II : what you have, such as a physical "token fob" 
3. Type III : what you are (bio), such as fingerprints, iris color
4. Type IV : where are you, such as work campus
5. Type V : what you do, such as a signature
   

Authorization (or Access) - once you prove who you are, what are you allowed to do

Once that your identity is know, you authenticate to be the identity, the IAM/IdM system controls what you can do.  Authorization can be 1) centralized or 2) decentralized. Centralized control is implemented via Single Sign On (SSO) systems. Decentralized control is trusting the the tools, process, and framework will enforce the IAAA framework. 

 

Systems that implements identity and access management : authenticate + authorize

SAML 2.0 (authenticate + authorize)      

Security And Markup Language (SAML) is a framework for systems to exchange   information on security. The information format is in XML. It is common used in Single Sign On (SSO) - using one login (un+pw) to access multiple web applications. Detractors say that it can be too verbose and cumbersome to use.

   

OpenID Connect (authenticate) + OAuth 2 (authorize)

Conclusion

You have a protected resource - such as  data or hardware. You only want to allow authorized users to be able to use it. Identity and Access Management (IdM or IAM) is the tool, process, and framework that can do this. It will follow the Identity Authentication Authorization Accounting (IAAA) framework to ensure that the user is authenticated, authorized to use the resource, and all actions will be tracked.

 

     

Amazon Lightsail - A Easy Way To Deploy A Small Business LAMP Stack Website

Introduction  

Amazon launched Amazon Lightsail late 2016 as a way for small businesses to create and host their own website.  One way to build a website is to leverage LAMP (Linux Apache MySQL PHP) -  an open source software bundle that websites can use to server a web page (Apache), process inputs (PHP), and store/retrieve data (MySQL or MariaDB). I decided to take Amazon Lightsail for a test drive, using my locally working "Ravendale Community Exchange Board" as the example. 

 

 

Ravendale Community Exchange Board LAMP Prototyping on Local Macbook Pro

The Ravendale Community needed a web based exchange board for its citizens to post messages about items for sale and services offered. After the initial requirements were gathered, a prototype was built on a Macbook Pro. The development was done on Ubuntu OS, running inside a VirtualBox that was running on MacOS. XAMPP from apachefriends.org provided the LAMP stack software.

Amazon Lightsail sign up

Once you sign up for an AWS account, you are led to an AWS console. (The version shown here is from March 2022, but there is a new version of the Console out in April 2022). From here, you can pick specific services such as an EC2 instance or build a web app. It is from here that I picked Lightsail.

 

 

LAMP on Lightsail

A website requires a web server, database, and a language to process requests and responses. This is exactly what LAMP - a stack of software put together - can do. Here you can see that I configured a decent machine (2GB RAM, 1vCPU, 60GB SSD) as the server to host my LAMP. 

LAMP from  Bitnami on Lightsail

Bitnami is a company that makes bundles of software easy to download and use. This is what Lightsail uses for its LAMP delivery. This in contrast to apachefriends.org XAMPP that I used for my development environment. Let's see how it will go!

 

 

 

 
Lightsail SSH via Web Browser

On my Macbook Pro, I use "vi" in a terminal for all development. I tend to favor simple editors over GUI IDEA such as IntelliJ or VSCode (both are installed on my development machine). Lightsail makes a SSH shell easy to start up by pressing a button - which brings up a web browser with a terminal.  Note that I also have started a SSH session on my native Macbook Pro, but I would have had to download a license PEM file, change permissions, then start a "ssh" session in a terminal.

Command Line Tools (git, vi, ...) in Lightsail terminal 

Once a terminal to Lightsail is available, I can fully operate as though I am on my own Macbook Pro. For example, I can use "git" to pull source code for the project from github. From the command line, I can easily bring up MariaDB (which replaced MySQL to get away from Oracle) to pre-populate / migrate data into it. The vi editor, a super old and trusty command line editor, already had syntax highlighting on, so even an old language like PHP looks readable.

Lightsail Provides a Static IP Address - Exchange Users Only Need To Go To One Place

Think of this as a P.O. Box - if I bring down Lightsail and bring it back up, I normally would be assigned a new IP address. Which means I need to tell all exchange users to where to point. With a static IP address, users can just continue to use the same IP address to reach the exchange, regardless of what happens in the backgroud. 

 

 

 

 

Web Site Running on Lightsail

With a static public IP address available, residence of Ravendale can now browse and post on the exchange. 

Amazon Lightsail Cost

Pricing is not only transparent, it is low. For $3.5 / month, you get all the goodies of LAMP : Linux, Apache to serve web requests, PHP to process, and MariaDB for data storage. Everything is bundled together, so no need to hobble each component separate, incurring a separate bill for each (compute, network, database).

Conclusion

Amazon Lightsail provide a complete solution (compute, database, networking, easy to install LAMP) and makes building and hosting a website predictable, cheap, and easy. 

Funding in anything Blockchain/DLT/Crypto/Web3/Decentralized Web/DeFi/Fintech/NFT

Funding of blockchain related projects mostly come from venture capitalists and hedge funds, according to Tech Crunch.

March 17th, 2022 : Optimism raises $150M Series B,  $1.65B valuation;  Optimism is creating layer 2 scaling solution built on the Ethereum blockchain using "optimistic roll up" - news link

March 15th, 2022 :  Aptos Blockchain (ex Facebook Diem people) raises $200M, $1B valuation, to create its own layer 1 network (not layer 2 that sits on top of existing networks like Ethereum) - news link

March 15th, 2020 : Hex Trust raises $88M Series B;  - news link

March 14th, 2022 : Gauntlet raises $23.8M Series B, $1B valuation;  Gauntlet is building a blockchain simulation and testing platform for financial systems - news link 

March 14th, 2022 :  ConsenSys Raises $450M Series D Funding, $7B valuation,  as Leading Self-Custodial Wallet MetaMask Reaches Over 30 Million MAUs - news link 

February 7th, 2022 : Polygon raises $450M; Polygon makes an Ethereum scaling solution, or broadly on the blockchain infrastructure play - news link

January 27th, 2022 : Silvergate buys Diem (just assets, no people, see Aptos Blockchain) from Facebook for $182M  - news link

October 5th, 2021 : Hex Trust raises US$10 million in new funding round - news link
 

March 29, 2021 : Hex Trust Raises $6M in Series A Led by QBN Capital - news link

Maven : An Introduction to Java Build

Maven Introduction

Updated : Feb 3, 2022

Maven is a free software utility, like unix makefile, to automate compiling, testing, and packaging Java source code. In simple terms, a bunch of Java source files is needed to make a program. Maven is a single command to compile all of those Java files into a program, test the program (using JUNIT), then package up the program (into JAR). To configure Maven, it  reads pom.xml to define targets, much like unix makefile; newer build tools like Gradle define tasks.

Hello World Example:

•     Install Maven

 

%brew install maven # installs Maven on a Mac

%mvn –version # Apache Maven 3.6.3
 

%which mvn # /usr/local/bin/mvn

•     Create a playground:

%cd /Users/chiangal/Learn/Maven/0Hello

#%cd /Users/chiangal/Learn/JavaFun/MavenHelloWorld

#%cd /Users/chiangal/Learn/Maven/Tmp

•     Use Maven to create project scaffold

%mvn \

archetype:generate \

-DgroupId=com.vmbc.app \

-DartifactId=dapp-ecs \

-DarchetypeArtifactId=maven-archetype-quickstart \

-DarchetypeVersion=1.4 \

-DinteractiveMode=false

# will create dir dapps-ecs/, with pom.xml and src/

# src/main and src/test

•  Go to Maven projects “dapps-ecs” directory

%cd dapps-ecs

•     Look at pom.xml

%cat pom.xml

<project>

    <groupId> com.vmbc.app </groupId> # the company domain?

    <artifactId> dapps-ecs </artifactId> #name of app in build system world

    <version> 1.0-SNAPSHOT </version>

    <name> dapps-ecs </name> # name of app in English

    <dependencies>

…..       <artifactId>junit</artifactId>     # easy way to test Java

</dependencies>

    <build> <pluginManagement><plugin> #build contains plugins

          <artifactId>maven-compiler-plugin</artifactId>

          <version>3.8.0</version> # version of Maven

        </plugin>

    </build>

</project>

•     Edit App.java to put in "Hello World"
  

 

%vi src/main/java/com/vmbc/app/App.java # HelloWorld.java



        public class App {

 public static void main() { #             Remember “PlayStation Very Manly”

         System.out.print("hi \n");

       }

public static int giveMeOne() {

           return 1;

  }

}

•       Edit AppTest.java to test "giveMeOne()"
  

%vi src/main/java/com/vmbc/app/AppTest.java # HelloWorld.java

•     Use Maven to test compile

%mvn compile     # [INFO] BUILD SUCCESS, create target/

•     Use Maven to “package”, which means, compile->test->package into jar

%mvn package     #