foreign
[Music]
good afternoon
um so I'm here to introduce you to
Cameron tubball who's here to present on
unlocking the power of open security
standards Cameron has been working in
the security and infrastructure space
for several decades with a current focus
on security operations and his spare
time Cameron likes finding new and
interesting ways of breaking things and
hopes to figure out how to put them
together one day and today's talk
Cameron will discuss the options for
Open Standards to allow different tools
to work together and how you can build a
security defense strategy while
minimizing vendor lock-in please welcome
Cameron
whoo
all right
ah good afternoon
um I'm just going to start with a quick
disclaimer it's very hard to talk about
this topic without mentioning vendors I
don't want any conversation about
vendors I don't want you to take as an
endorsement or otherwise of a particular
vendor but we will talk about a few of
them
um
first I want to talk a little bit about
what the problem is with security uh
currently
and for that we're going to talk a
little bit about where we've come from
from security
it used to be that we worried about
things like ID and authentication and
users having the correct password that
kind of thing
networking we used to worry about
networking as a security perimeter so we
would have trusted networks and DMZ and
we'd worry about the perimeter Security
on a network
systems we're always worried about
system patching levels
whether there's bugs zero days that kind
of thing in our systems
and the code of our applications
we worry about things like are we
introducing bugs are we sanitizing
inputs
you know buffer overflows all the good
stuff
and then we realized that it turns out
the endpoint devices that people are
using also a problem so we need to start
worrying about protecting the laptops
and not just the systems those laptops
they're connecting to
and we have to worry about mobile
devices
and then we have to worry about people
um social engineering obviously a big
problem uh uh even things like malicious
employees has become more and more of a
prevalent thing that we're seeing we
worry about separation of Duties and we
worry about more importantly protecting
the people that we work with
and this is a long long way of saying
that the things that security operations
look at
become normal there are more and more
things that they are worried about
everything from the physical security of
a building and people all the way
through to Cloud environments
and in fact
we we have all these platforms and it's
just a much wider space that we worry
about
and so what this has led to is
the tooling space that security uses you
can't just rely on one vendor anymore
so you're used to go all in on Cisco and
you'd rely on them for your network
security
or all in one cloud provider and rely on
them for your network security
but then once you start adding things
like the endpoints mobile devices
uh there's multiple Cloud providers I
was at a conference where they did a
survey recently and 98 of people there
were on multiple Cloud providers
and that's pretty standard now so you're
worried about multiple Cloud providers
uh definitely endpoints a lot of
security vulnerabilities that we've seen
in the last 12 months have been from
developers laptops being compromised
uh and then you worry about environments
a lot of organizations traditionally
have projected production
but it turns out if somebody's looking
to
launch a Bitcoin miner although that
happens less now they don't care if it
runs in your Dev environment
but you will when you get the AWS bill
at the end of the month
and so we worry about all these things
and it comes back to there's a lot of
different tools for different things
it also means that a lot of the
traditional security methods that I
touched on like border security identity
security
we can't trust them anymore
because it turns out your border stops
existing especially now people work
remotely you can't rely on everyone
being in an internal office Network and
protecting that
and so we've moved towards using what we
call zero trust principles
and so these are the following three
this is Microsoft definition but they
all work around this
number one is verify explicitly
just because a user has authenticated
doesn't mean we can trust that user we
have to verify every interaction and
that they're authorized to do it
uh least privilege access we don't just
give root to anyone anymore hopefully uh
we tailor access to what each user or
each application needs
but more importantly is the last one
and that's assumed breach and that's the
one I want you to sort of keep in mind
from this slide because odds are our
systems are now so complex and so varied
that we don't know we've been breached
and we see that time and time again with
things like Optus and all the other
major public reaches
they happened months ago and
companies don't realize at the time that
they're being breached
and so that brings us to
anyone who's worked in security has
probably used the scene seems are sort
of our aggregate of all the information
we can pull from every system
uh his argument about what team stands
for uh it's either security information
or incident event management
and what it traditionally has been is
every log that we can get
or every bit of information or security
event that we can pull from every device
you pull it into a seam and then you do
analysis
in place
so it correlates all the systems and
then you try and do detection for
anomalies and try to determine when
you've been breached
the trouble is
we've talked about how everything is so
vast and you have to protect so much now
there's no standard
so you've got Apache logs you've got
Windows events
and there's you are doing a lot of
manipulation of this data to try and
correlate
because when you're trying to detect an
intruder into your system you're trying
to trace their jump from system to
system and none of these systems talk
the same language
so
you end up doing a lot of translation on
different security events and security
information that you pull in
and so
it'd be nice if we had a standard for
this right it'd be nice if we could go
all the security information comes in in
one standard and we can do that
correlation across systems
uh
unfortunately we don't have that
and so there's been many attempts for
this
um these are some of the standards and
I've been looking at all of those
but what is missing with all of these
standards is that none of seen wide
adoption so you'll find a vendor that
does one part of your security
it's an Android security portfolio and
they'll support one of these standards
but it doesn't help because all of your
other tools
aren't reporting so you're still doing
that data manipulation to get it into
that standard
and then last year
came this came along
so this is the open cyber security
schema framework and it's designed to
solve this problem
um it is basically a Json format but
it's
we'll describe it in a sec
um it's designed to provide standard
information from all your systems so
that you can
bring them together
so it was launched last year as a joint
program by AWS and Splunk
however they do not run the project it
is a open governance project it is run
on GitHub
but what it does provide is a standard
taxonomy for representing security
events from all types of systems and
it's rapidly growing
and so I said it started by Splunk and
AWS
which is a good start they are two of
the biggest companies working in this
space
but they had a whole heap of very
important partners
sign on at the very start
and so I apologize for the giant slide
of corporate logos and this isn't even
all the companies that signed on at the
start
and there are more joining and
supporting this
it's important I guess just from this
slide you understand this is a lot of
the big players in the security tooling
space
who are backing this standard
so let's talk about
ocsf
it's a very very simple architecture to
it
you have your security tools that
produce events
those events go into some kind of event
storage there is no standard or format
around that event storage
and then you just have something to
subscribe to that and process it
so
some examples I said apologize I've got
to mention vendors here because it's
important to where we're going uh you
have things like your Cloud security
posture management tools that tell you
you know monitor your Cloud environments
First Security problems so you have Orca
and you have Palo Alto have a whole
series of tools as well
um your endpoint detection and response
so that is your laptops your mobiles and
your servers virtual or physical
you need all the information from those
crowdstrike is probably the best example
there
platform providers
I'm going to mention AWS because I've
done most of this work in AWS but out of
the box AWS support those four things as
ocf standard so you can get ocff's ocsf
uh events from those four Services right
now
event storage there's really only one on
the market at the moment which is AWS
but as I said these are just Json logs
essentially so you can actually store
them any way you want
AWS have a built-in service called
security Lake which is their normal data
Lake service but it's optimized for
uh ocsf events
and it's essentially backed by S3
and so all you're really paying for in
most cases is just the S3 storage that
you can manage like you would normally
would for S3
and then you have subscribers
and so subscribers are things that will
take these events in and they understand
the taxonomy of these events and they
process them
so today the three commercial ones are
Splunk data dog Sumo logic they're the
three main ones
if you use open search or elasticsearch
there are ocsf
support for that
so let's let's talk a little bit about
what these events actually are
and under the hood they are just
standards for representing in Json
so you have your standard data types
which we'll cover in a sec
uh you have an attribute dictionary
and that's that's important because one
of the problems you have when you're
trying to correlate these events is that
some systems we'll call an IP address an
IP
some will call it IP underscore address
some will call it IP underscore addr and
so you end up having multiple names for
just something like an IP address that
you're trying to manage when you're
trying to bring all this data together
you have event classes which will
definitely cover which fit into
categories
and then you can build profiles so
profiles are basically groups of event
classes and if you're familiar with the
miter framework and a lot of times they
will map directly to miter
and you can do extensions but that's not
as popular
so for data types you have scalar data
types and they are exactly what you
would expect strings floats ins booleans
standard stuff uh but then we Define on
top of those things like timestamps
always a fun thing to try and manage
when you're getting different formats
from different places uh IP addresses
like I said and even things like
usernames so you can track user IDs from
system to system using consistent naming
in your schema
um
then you have attributes
attributes are unique and they're the
things that we Define in the data
dictionary or the attribute dictionary
and like all good type systems you can
have a raise of these things
categories so the categories of events
are system activities so things that
happen on what we traditionally consider
as systems routers
Linux servers Etc Windows servers
uh findings are things that are reported
by security tools so again out of your
Cloud security posture management tools
they'll generally go this is
misconfigured that's reported as a
finding
ordered activity is your authentication
authorization
failed at login attempts Etc
network activity
HTTP lookups DNS lookups
and configuration inventory is literally
just there's a new machine on the
network the config of that machine has
changed etc etc
so let's break them down
uh examples of system activity
you can there are the defined event
classes for everything right down to the
kernel so you can actually record kernel
level activity
um on Linux or Windows there's examples
for both if that's the level you want to
get to
there's also the windows specific ones
on the bottom uh yeah we'll look at a
Windows one because that's always a fun
example uh and this is a really good if
you're familiar with Windows events and
I can't imagine too many people here are
um Windows server has one good thing
going for it it's very very good event
but not so good at naming the events
and so here you can see so these are the
things that are in the standard
dictionary for ocsf and how they map to
things from a Windows Event
and you can probably fairly easily
imagine how things from a Linux system
or any other application that you're
building would match to these kind of
events
security findings fairly
self-explanatory
um
audit activity so this is what I was
talking about before so these are when
you create a user a user logs in a user
fails to log in
um when you've got somebody
authenticating to an API or using an API
these are the kind of things that
generally from the security point of
view you care about
so here's a good example uh this is
again I'm drawing from Windows because
they're eventful that's handy uh this is
a failed login
and again you can generally get a good
idea of the naming
and hopefully you can get an idea of how
the naming on the left provides a more
consistent
pattern for events
uh
examples of network activity that
currently exist
uh standard stuff dhp lookups remote
desktop connections SSH
um here's a example this is not the full
listing of what you get in the VPC flow
log from AWS but again it's a good
example of AWS is different to Microsoft
and that they're very non-descriptive in
their Eventing uh and so again you can
see it Maps directly into ocsf
another one so this is a Route 53
resolver or a DNS lookup
and again you can see
it's all very standard stuff
but still useful hopefully you can see
the use of ocsf and the naming being a
little more
flexible than the standard AWS naming
and then lastly
configuration or inventory changes
so the question becomes why why do we
care about this
what are we why are we worried about
keeping these things
and you can't talk about standards
without bringing up this XKCD
cartoon
um
because it's hilarious because we've all
seen it but it's a real tale right if
we've got all these standards and I've
set at the start they don't really work
because nobody's adopted them
why is this one going to be different
why is this not going to just be a
different standard
and for that we we need to sort of take
a left turn into one of my favorite
projects which is open Telemetry who
here is used open telemetry
besides David
who gets very excited about it
open Telemetry has sort of come out of
nowhere and because of the timing and
because of the space
it's become sort of the de facto
standard for all kind of telemetry and
logging now
and so you look at the a lot of the
vendors that I was referring to before
that are in The observed Village space
and they're all standardized around
theirs
you look at pretty much any language or
platform you're using and it supports
this
dotnet Java PHP
python everything has support for open
Telemetry now
um and the reasons for that are
it is vendor agnostic open Telemetry is
not supported by a single vendor
it's supported by every vendor now
because it's an open standard
and as I said it's platform agnostic you
can use it on every platform
and the fact that it's well supported is
because we've kind of hit that point
where nobody wants to go with vendors
anymore they want solutions to give them
the flexibility
timing thing
security events however work a little
bit different than your standard
observability and logs
number one being we need to keep them
all
when you're looking at Telemetry and
logs from systems a lot of times you
only need to keep them for say 30 days
for debugging or if you're doing
Telemetry and anyone who's used over
until lunch you will know you can't
capture everything that is a level of
data that you don't want to pay to keep
we however with security logs can't do
the sampling and the filtering that we
can with open Telemetry because we don't
know what we need and this goes back to
the assume breach part of the of what I
was talking about in zero trust
we don't know what logs will need until
possibly three to six months down the
track when we go ah this user was
actually breached we need to go back and
find out what have they accessed have
they leaked data did they what has
happened
so we have bigger data sets
and more importantly a bigger cost
not just restoring the data
but with the current way things are
because we integrate all these different
tools and we bring them together into
the scene like I talked about where
Trends Translating that data into some
kind of common format
whatever the theme is generally going to
use under the hood
and you're talking
the systems that I've worked on you're
talking Millions upon millions of events
a day and if you're going to run into
Lambda to do that like a lot of people
do Lambda costs can build up very
quickly that way if you're in AWS
so it's not just the cost of storing the
data and searching the data it's
Translating that data
and that's why having a common standard
is important
because it means that we're not locked
into these tools
um okay very careful not to mention
specific vendors when I talk about this
but there are a lot of vendors that will
lock you in because they will take care
of that piece for you and support you
but if you then want to go you know what
we think this tool over here is better
it's a big lift and shift job
if you are using
a common event storage
and it's all in a common format you can
easily switch from one button to another
choice of tools is the other thing and
so when we started looking at this
problem
and why we've started working with ocsf
is because we wanted to build our own
analysis tools
every business has
unique use cases and so what we're
getting now is from all of our security
tooling
that supports ocsf we're getting these
standard logs that we can then go back
and do analysis on
but we could build the systems that we
want to do that
um
and you get adaptive ecosystems and by
that I mean again you're not locked into
vendors
and it gives vendors a chance to sort of
innovate or and I'm hoping open source
projects to support this and then
provide Innovation that way
we've seen that with open Telemetry open
Telemetry is encouraged
um things like if anyone's used
honeycomb honeycomb is just a really
good tool that if without open telemetry
would have would not exist the way it is
so why why then is do I think this
standard is important and why do we need
to talk about it
number one the timing is right
we've got this much bigger focus on
cyber security coming not just from
governments but because of the size of
the breaches that we're seeing
companies very very much are talking and
taking the stuff a lot more seriously
we also see that companies and
organizations
have an absolute hunger for this kind of
data representation we've seen that with
open Telemetry we're seeing it with some
other things
so this is the right project at the
right time
um
and this is always a controversial thing
to say at a open source conference but
vendor support matters
as much as we'd like the world to run
100 open source it doesn't
and if you want to keep
sort of those being able to work
together with these things and switch to
open source Solutions where possible you
need to be compatible
and um
I've not been able to find any other
initiative like this that has had the
vendor support that this has
from very big players
and more importantly it is this solution
is a really good fit with our
experiments it's actually a really good
way of representing data for what we
need to detect
potential violations of our security
policies
so
to summarize for for this
it's a format and it is vendor and
tooling neutral
and I want I hopefully you're seeing the
advantage of that already but I want you
to take that as an opportunity
in that it's being adopted I'm talking
to people who are looking at it and
evaluating it now
so if you are building anything or you
have any open source tooling and you
generate any kind of security event it's
in your best interest to support it
um as I said that's a lot of big vendors
who have a lot of this Market space and
they are super interested in getting
this off the ground
the reduction in cost is a big selling
point
uh like when I say we spend thousands of
dollars a day on manipulating security
events and we are not I'm the stuff I
work with is not large scale
so saving thousands of dollars a day by
not having to do that translation it's a
super big win
and just the greater flexibility
so I can switch vendors a drop of a hat
and of course that helps you compete
when it comes to paying for vendors
but it also means it's a lot easier to
go you know what we could run our own
open open source stack over here and get
the same thing
so it induces that back into the market
uh if you're interested in learning more
GitHub
please come
uh so we are almost at version one
this is how brand new it is uh
rc2 is the current version as of
yesterday when I looked
and um there is a schema browser
I could delve into this game a lot
further and I'm happy to take questions
on it but
um you can actually browse the full
schema online it will say it's in draft
it will be in draft until 1.0 is
released
but that is all I have so thank you very
much
and I will more than happily take
questions
if anyone has any
um hello
can you hear me is that on no
okay is it I'll just talk louder there
we go um do you know of any open source
projects that actually do the conversion
at the moment so security Lake vendor
does the conversion anything like fluent
bird blog stash Etc that kind of thing
that is currently working on supporting
this not not from a meeting point of
view so they're as I say open search and
elasticsearch have things for like
subscribing and indexing them not enough
open source projects and none that I've
seriously seen will do that now you
could write your own in something like
logs Clash
um log slash of course you could just do
that conversion yourself but the whole
point of this project is to not have to
run that infrastructure
um again we have some log stash and we
spend a lot of time doing the conversion
from all the different formats that we
have uh if I could not do that that
would be awesome so not enough is the
answer yeah
what questions
but
so you said that past attempts at Open
Standards in this area haven't gotten
enough uptake yeah what was different
about this one that it got so much
support from the start
I honestly I think it's AWS uh and then
marker power if I was going to guess I
wasn't involved in that decision but
Splunk Splunk have oh let's talk about
AWS this is all opinion
um go back to my disclaimer AWS
obviously uh the kings in the um
in the cloud spice
and a lot of what AWS do they're very
interested in Open Standards and open
source where they don't own that piece
where where if it's got to go to someone
else they'd rather an open standard for
it so I think their support was big one
Splunk uh the 50-pound gorilla in the
logging space and I think they have seen
that they need to adapt
to something to this because they're
starting to lose to a lot of
the newer competitors
so I I think it's the combination of
those two that have driven it and then
you look at they've actually gone out
and collaborated with all these
companies so all the companies I listed
were already on board and working on
this before
they announced the project
so it's yeah it's just that vendor
support and a lot of the heavyweights in
the market will be supporting it same
thing we saw of open telemetry
right as soon as you see companies like
datadog for example switching to going
open Telemetry first you know that
it's going to stay around like that's
them taking it very seriously
so yeah we just have never seen
this many vendors take extended
seriously before
that's my that's my reading of it
yep
feels like I can't miss the opportunity
to Heckle you slightly sure because I
know this was an idea you had in the
early days when you were looking at some
of this yep
um is in using sort of that open
Telemetry tooling something like
honeycomb just at a sampling level to at
least have a baseline of what you know
normal across your systems might have
been for the past one or two months yeah
obviously it can't be that
um
audit Trail level but
what do you think of that so yeah that
that's a good thing so obviously
the the three pillars the security being
confidentiality integrity and
availability that availability piece we
definitely still rely on traditional
um
open Telemetry based I'm not going to
say honeycomb unfortunately but open
Telemetry basings for monitoring that so
this this is not a replacement for that
this is a solution for just those
security level events for that it
developers will still need open
Telemetry
um and Security will still need to rely
on that for the availability piece
but what you'll find is I talked about
there's an event class for findings
and so what I'd like to see is tools
that detect the anomalies in things like
open Telemetry and then produce a
finding event
yeah
that doesn't exist yet
that I've seen but I'd like that
yeah
that's kind of how the two match does
that make sense
yeah yeah cool
any more questions
no we're done thank you very much thank
you
foreign