start	end	text
930	6230	...edition of DEF CON. Those are the hours that start at 8 and never end.
7750	17110	My name is Ophir Arkin, and I will be speaking today about infrastructure discovery.
17110	24910	Usually, a lot of people at DEF CON talk about how to break things.
26410	31110	How to search cool stuff, how to take something and to break it.
31110	38990	Most of the people that I know from the world that actually do network security,
38990	42630	they are in charge of how they maintain their stuff.
44870	52090	This talk is basically going to speak about what kind of knowledge and how we get it from an enterprise network.
52090	55750	How do we acquaint ourselves with our users.
55930	60290	How do we acquaint ourselves with the machines that operate on the network
60290	63070	and with actually what is being done on the network.
63070	69290	Usually, if you look at the DMZ, the DMZ is usually well fortified.
70110	73430	Most of the things are already there.
73430	78870	Most of the firewalls that we have can block 90%, 95% of all attacks.
78870	83710	We can put another system where we are 99% protected.
83710	90350	The guys that understand how to defend themselves, they are actually pretty good at doing that.
90350	93610	Usually, it's not that hard to do that.
93610	96790	You just need to understand what you need to do, what you need to defend.
96990	99510	That's another interesting question.
100510	110250	The talk will be... well, I'll try to do it really fast so they can take one of those walls down and have the ball here.
111010	115270	We're going to talk about why do we need infrastructure discovery.
115610	120130	Why active network discovery and passive network discovery are not that good and what can we do.
120650	133350	I will demonstrate to you a new, agent-less, real-time approach that enables us to have real-time information about our infrastructure and to allow us to do monitoring and auditing.
136110	138690	A bit about myself, I'll do that pretty fast.
138690	141690	I'm the Chief Technology Officer for InsightX.
141690	143590	I'm also the founder of the Cisco Security Group.
143590	146390	Most of you know me from my previous work.
146390	148790	ICPSR Scanning Expert 2.
149810	152590	And other things that I've published along the years.
152590	155270	I'm also a member of the Voice over IP Security Alliance.
155990	157070	Let's go.
157110	159790	Okay, so you have an enterprise network.
159850	161550	It's large, it's complex.
161590	163410	A lot of things operate there.
163830	173310	Usually it may be combined from multiple networks in different locations.
173310	177570	And basically there are a lot of nice things that operate on the network.
180150	181770	Some of those are mission-critical.
181770	185910	Mission-critical is a nice definition that says a lot of things to different people.
186130	191770	At the end of the day, we need those systems to work in order not to have some financial damages, another nice definition.
192050	201170	But at the end of the day, mission-critical means that if those systems are down or if those systems cause some kind of a problem, it means that other systems suffer.
201170	209250	So for some, mission-critical means the servers, the networking gear, and for others it means also the desktops.
209310	222090	If you had suffered an outbreak of a worm that hit a desktop and that desktop brought down your access switch or other things on your network, then that desktop is mission-critical to you.
224730	233730	IT basically needs to take care of a lot of things that are actually important for the regular operation of the network.
233950	242890	We need the network to be available, we need the elements to be available, we need to maintain the security of the network, and of course the availability of whatever is on the network.
243030	245290	So basically IT has a ton of work.
245290	257950	Usually the CIO will come to IT and say, well, you have enough people that needs to maintain what we have, just invest in smarter management systems.
258370	269250	So IT needs to identify what are the assets, what they mean to the organization, their properties, their roles, the different interdependencies, what would happen if one of them would fail,
269250	276590	how that will affect the IT organization and the business process, to understand the importance of those assets.
277030	288910	A lot of boring stuff, which at the end of the day is very critical to be done, because if we're not doing this, we don't stand a chance to actually run an IT organization.
288910	301330	And we have here a lot of things that relate to provisioning the network, provisioning the elements, know what we're defending, knowing what we're managing, detect and troubleshoot issues, defend our assets,
301330	312130	eliminate those systems that actually pose a risk to some of our assets, and of course do other things like prepare for the worst, do disaster recovery, disaster recovery management, and a lot of other things.
312130	332770	The problem is that in order to do all of those things, we need information. We need information about the network layout, how does our network look like, another worker at your local burger store.
337980	350060	Okay, so we need to know the topology, we need to understand what are our resources, and we also need to understand what are the elements that we actually need to manage and secure.
350480	363940	So at the end of the day, we need intimate, complete, and accurate knowledge about our infrastructure, and without this kind of knowledge, it will be, well, we can't actually do management and security.
364860	376100	The problem is that the information that we need is either unavailable, partial, or incomplete. This is because this kind of information is not easily produced.
377340	389040	Some people in our organization may have had that information, but they left. Some of this information is dynamic, and some of the systems that we use in order to maintain that information are insufficient.
389040	395380	So at the end of the day, if we don't know the network, we can't actually manage or secure it.
396500	403660	This brings us to this slide, to the result. The result is that we always work at the 80-20 rule.
403700	411140	And you know what? The 80-20 rule is really bad when you do management for networking and for security.
411140	419480	Because you know what? The 80% that I know of, you know what? I'm managing them right. I'm doing all the things that I need to do for them right.
419480	427760	But those other 20% that I'm able to uncover, that I don't know what they are in my organization, those that actually pose the highest risk for me.
428020	434160	Well, the highest risk can come from a compromise. The highest risk may come from auditing perspective.
434160	438380	The highest risk may come from a lot of things, but at the end of the day, I don't have control.
438380	443580	I cannot understand what I have, and I have full sense of control and full sense of security.
443780	447780	And when I have these, then it's all downhill from there.
448140	454840	So along the years, there were several technologies that were trying to solve the issue of knowing the network.
454840	471880	Basically, what they were trying to do is, they were actually trying to have the topology of the network, understand what are the elements that reside on the network, what their properties are, and they maintain this information up to date.
471880	480720	It seems that this is a definition that is very small, right? It contains everything, but it has a lot of problems in it.
480720	488640	Doing network topology, if some of you are using network management systems that claim that they do this, it's a hard thing to do. It's not that easy.
488640	495020	It's not that easy to say which switch is connected to another if you do not use CDP or other proprietary protocol.
495320	500820	It's also not easy to produce the information about what actually lies on the network.
501660	506540	So, let's start with one of my favorites, Active Network Discovery.
506540	514800	With Active Network Discovery, basically, we send some packets to the network and we hope that we'll see some responses from those elements on the network.
514800	522240	And sometimes, according to those responses or the lack of, we will draw some conclusions about those elements.
523880	534320	An Active Network Discovery system will try to get information about the inventory, meaning the elements, their properties, information about network services, the configuration, the topology,
534320	538440	and if this Active Network Discovery is able to do vulnerability assessment.
538440	547740	Usually, it will be installed on a single location on the network, although you can install it in multipoints, and we'll scan the network from that point.
549300	560500	The way this can actually work is that an active tool can be fed with a list of IP addresses it needs to scan, or a list of networks it can scan,
560500	569220	or that the Active Network Discovery tool will try to do that automatically by querying local elements and drawing that information from them.
569220	579740	For example, HP OpenView, Tivoli, and other management systems go to the router, take the routing table, understand there are other networks they might need to operate against,
579740	591180	and continually trying to detect other routers on the network, taking more and more IP address ranges, and from there, trying to enumerate all the information about the network.
594100	603560	The strength that Active Network Discovery has mainly relates to the ability of active tools to completely control what they're asking for.
603560	611180	They send the stimuli out so they can understand, well, we need this information from that element, we need that information from another,
611180	620100	and they can also control the initiation of the scan, and also they can control the pace the queries are being sent.
621060	628580	Technically speaking, if we're not having any kind of obstacles between the Active Network Discovery to the target,
628580	633480	an Active Network Discovery system can scan entire IP address ranges.
635980	643200	The weaknesses are a lot. I'll try to do something with the refresh rate pretty fast. Sorry if I can fix this.
645360	650940	The weaknesses, well, the first one is that the discovery that will be done will be incomplete.
650940	654820	This is since network obstacles on the network will prevent packets to reach their targets.
654820	662740	If you have network-based firewalls, host-based firewalls, those Windows XP, SP2 that you installed and forgot that by default they have firewalls,
662740	670160	and now you're unable to manage, not enable devices, load balancers, and other things that you put on a network will prevent the packets to reach their targets,
670160	673280	and basically this will create black holes of information.
673280	680140	So from a network that has a lot of elements, you'll discover that you have a very small network.
680140	681440	Well, it's not true.
682180	690140	Sometimes you'll need some type of information to be enumerated from those elements in order to draw your conclusions.
690140	696580	And you know what? Sometimes those services will not be operating on those elements, and sometimes they will not be willing to speak to you.
696720	702760	So, for example, if you need information from the Windows Remote Registry and you have the administrative rights for the domain,
702760	706360	but the system is not a member of the domain, guess what? It will not help you.
706360	712660	Also with SNMP, if you don't know the community strings of those routers that you want to enumerate,
712660	715060	at the end of the day you can't draw the information from there as well.
715360	721660	The process is very slow, it's time-consuming. By the time you get the information, the information that you get is obsolete.
721660	723720	This is because it's not real-time.
724420	733040	It also consumes a lot of network bandwidth, and it might take some elements down when it's actually doing the process.
733040	740000	This is because sometimes it will overhelm the networking elements between the scanning system to the target
740000	744900	with the amount of traffic it produces and will cause an out-of-service condition.
745840	752340	So some folks went and said, well, you know what? We can do scanning at off-peak hours.
752600	760020	We'll take our active network discovery systems or management systems, we'll take that to off-peak hours, and that will do it.
760020	763060	Well, wrong, because you can't actually define what are off-peak hours.
763060	768260	And sometimes during off-peak hours there are some crucial processes that actually are being done,
768260	773460	like backup, restores, some reporting on your databases.
773500	779820	So actually the process of probing those elements might not actually can be quantified to a certain time,
779820	783220	and sometimes it may take longer than you actually know.
783220	791900	A telecom company that I know runs HPOV against 4,000 devices and takes them 24 hours to complete the scan.
791900	797560	Now, this is absolutely no-no if you're doing that against your operation network.
797660	801880	So there are others who said, well, you know what? We'll do the scan faster.
801880	807520	So we'll narrow the time that the scan needs to be done, and we'll finish it faster.
807520	809940	Well, it's a good thing in theory.
809940	814260	How many of you know NMAP? How many of you use NMAP? Cool.
815040	820900	So someone can tell me what's the usual time that NMAP scans an element on a local network?
822480	823760	Three seconds.
823880	825660	How many packets does it send?
825920	826920	1,500.
827080	833720	So, let's see. If I scan my network, three seconds per element, 1,500 packets, that's a very bad thing to do.
833720	835300	Try that on your local printer.
836480	842340	Believe me, my printer cannot withstand that kind of faster scan.
842540	848680	So whenever someone from my engineering team goes and uses NMAP by mistake, I know that I can't print.
848680	852460	So I need to go to the printer, power it off, power it on, and then use it.
852460	858060	And then see who's the engineer that was trying to play with network discovery on my network.
858400	863580	So at the end of the day, this will cause disruptions on your network.
863580	866400	Scanning faster is not the solution.
868180	872780	And we go to the stability issues, which are the major ones.
873820	878300	Basically, what those will cause, they will cause your machines to be unstable,
878300	884360	like print servers, printers, other elements that cannot withstand a lot of traffic.
885540	891640	And all of those, at the end of the day, will be denied of service.
891640	895000	Doesn't help if I play with it, even. Sorry about that.
896160	901640	This is because either the pace of the scan, the usage of non-RFC compliant packets,
903320	905740	the type of information enumeration you're using.
905740	910960	So if you're thinking that you can do network topology by taking the ARP tables from the routers,
910960	913900	believe me, this is something that you do not want to do.
914120	917980	You make the routers choke, you don't have connectivity to nowhere,
917980	920960	and this is the last time that you will run an active tool on your network,
920960	924140	because your CIO either will fire you or will tell you,
924140	926560	this tool does not run on my network anymore.
929520	934120	Some folks just forget that when they do invulnerability assessment,
934120	940860	they shouldn't use those tests that actually cause denial of service.
940940	942180	It's a bad thing.
942900	945560	Against production machines, it's not a good thing as well.
945560	951900	So sometimes the stability issues will arise just because there's the element between you
951900	956080	and the scan target cannot withstand what you're doing.
956080	958880	If you remember some of the old checkpoint and out-of-services
958880	963680	where someone's scanning from the internal network, someone on the other end,
963680	967740	what will happen is that all these state tables will be filled with information.
967740	972960	They will wait for the timeout for the connections, but the state table is full.
972960	977120	It cannot handle other legitimate connections, so what you have is a perfect denial of service
977120	979480	that someone from the inside doing a pen test did.
980180	985340	Also switches, they will be overhelmed by the number of connections and they will die.
985620	990860	Believe me, it's very nice to, for example, I'll mention that later,
990860	997440	if you span too much on a Cisco 3550, it's a party going on.
997440	1001080	It will send packets all over the place and you'll never understand networking in your life.
1001080	1002220	You should see that.
1002660	1009420	So, at the end of the day, the result is that some of the networks you have may be declared as active scan-free.
1009420	1012100	You'll never be able to scan them at the end of the day
1012100	1018040	because all of those other admins, the app admins, the network admins will come and say,
1018040	1023540	well, we can't do this because you know that at the end of the day,
1024440	1028000	I'll have denial of services and I don't want to do that in my production machine.
1028000	1035700	So, there's a lot of production networks that are unable to be scanned because of these things.
1035700	1037760	Nothing I do that helps me with this.
1038340	1044400	So, we have some parts of your network unable to be scanned because people fear about active network discovery tools
1044400	1048260	or previous history has proven them right about that.
1048700	1057060	So, some people suggested that scanning, active scanning can be done in a different way.
1057060	1061040	Let's see, let's have multiple machines scanning from the same place.
1061040	1065120	It's actually called a cluster. Guess what? This doesn't help you actually.
1065120	1068400	Because the scan is now distributed among several boxes.
1068440	1073160	They scan the network at the same time and they send actually more traffic to the network.
1073160	1080300	So, all of your denial of service conditions, all of your other problems are still there, but nothing is really a plus.
1081140	1086360	Others were suggesting to put a proxy in each IP subnet or broadcast domain.
1086360	1092180	That's actually a better idea because you can actually scan faster and you do not need to go through routers.
1092440	1098820	But, at the end of the day, it doesn't give you any other advantage.
1098900	1102100	Because, still, you need a pretty knowledge about what you have.
1103060	1109360	The scan packet still might cause instabilities with the elements that are on the network.
1109360	1118940	And, still, if you have firewall devices, not enabled devices and any other obstacles on your network, still, those packets will not go through those.
1119320	1127680	So, basically, Active Network Discovery, at the end of the day, provides you with incomplete and, in some of the cases, inaccurate map of what you have on your infrastructure.
1127680	1129120	Questions until this point?
1131960	1134440	Because you have to understand what you have.
1134440	1139380	The idea is that I don't want you to tell me what you have.
1139380	1142240	I want my tool to discover it automatically.
1142240	1146240	So, if you have something that you are not aware of, the tool will understand what it is.
1149980	1152200	It depends what you want to take out of it.
1152200	1155660	I mean, a segmented data is nice, but do you need the information to be current?
1155660	1166520	If you need to manage something, if you need to be able to do something useful with the information that you uncover, you need this information to be real-time.
1166520	1168840	And Active Network Discovery cannot be real-time.
1169520	1188020	Yes. Exactly. Yes.
1195900	1198860	Yeah. It's absolutely true.
1200320	1203840	So, going fast to another area of invention.
1203840	1209000	If you didn't know, Passive Network Discovery Systems were first introduced in the mid-1990s.
1209760	1213420	Don't let other people tell you that they were invented last year.
1213940	1223000	Basically, Passive Network Discovery System is merely a sniffer installed at the chock point of the network processing packets that were sent by active network elements on the network.
1223440	1225500	That's actually one of its biggest problems.
1225500	1229040	So, how can we look at the deployment?
1230780	1247620	The system can be connected to the network using a tap, like this one, a span port, like this one, span port at the access layer, and span ports which are sent to one element.
1247620	1249620	So, what kind of information can be harvested?
1249620	1253180	Basically, the information is about active elements.
1253180	1271560	Active elements that may have shown up in the inventory, active network services, the distances that those active network elements are from the monitoring point, the client-based software, the network utilization information, and, if possible, vulnerability information, if this passive network discovery tool is doing.
1274240	1301540	The purpose of collecting the information would be to build the Layer 3 based topology, which is fairly problematic because what you need is actually the physical network topology, including the switches, including the hosts, to know exactly what you have and not just the Layer 3 one, the network utilization information, some network forensics, if the tool is able to do that, vulnerability discovery,
1301540	1306660	to create some context about the network and to feed that information to other systems.
1307680	1331360	The strengths of the system is merely the ability of the system to be real-time, to have no impact over the monitored network in the means that it doesn't send any type of traffic to the network and there it doesn't pose any kind of risk to the network when it runs on.
1331360	1340840	It can process packets and can process information from all TCP IP layers and it can detect anything that is active on the network, even if it's for a short time period.
1343740	1361760	It can also detect elements behind network obstacles, such as not-enabled devices, firewall elements, and also can provide you with network utilization information and can also be useful for network-related anomalies.
1361800	1367320	Who is using a system that actually is based on anomaly detection?
1368640	1370600	Cool. Are you happy with it?
1370600	1377500	No, right? Because my anomaly is not your anomaly, it's not his anomaly, and that's the main problem.
1378520	1381520	I'm not going to go into it, but I don't like it.
1382080	1390560	Weaknesses. The first and biggest weakness of a passive network discovery system is that what you see is only what you get.
1390560	1400860	So if you have an idle service, if you have an idle system, if you have an idle whatever, that kind of element, that kind of information will not be uncovered.
1401140	1406840	If the information does not go through the monitoring point, it will not be uncovered.
1407640	1418380	It means that at the end of the day, the discovery will be incomplete and inaccurate and non-granular because we cannot control what passes through the monitoring point.
1418380	1428740	We cannot go to the client and say, you know what, we need you now to browse because we need the type of information that your browser sent to the network in order to build something or to conclude about something.
1428740	1432640	We don't have any kind of control. We don't control the stimulus.
1433620	1441740	So passive network discovery cannot detect all assets and cannot detect all protocols and services and cannot detect all ports.
1441740	1457060	We cannot control what we see and in order for us to detect something, well, you know what, sometimes we cannot detect it because the kind of information that discloses the type of information that we need may never pass the monitoring point.
1458400	1466110	So, another interesting subject. This is actually getting worse.
1468690	1470010	Shut it off.
1472990	1474030	Sorry?
1479280	1481980	Where's the projector thing?
1484580	1486280	You want to try this?
1486840	1489060	Oh, he's recording. Yeah, you can do it.
1490020	1495760	Nobody's here to press it, so just feel free to...
1495760	1499340	Hey, it gets everything in all of those...
1499340	1501260	Yeah, now we'll see...
1501980	1503800	No, we don't want to do that.
1505320	1505960	Sorry?
1506860	1507540	Yeah.
1514440	1516600	Okay, did you power it on?
1516600	1520800	Okay, I'll continue. I have some modifications to the presentation of the problem.
1521600	1544200	So, basically, when it tries to build the topology, what it will do, it will look at the distances the elements are from the monitoring point and it will look at the time to leave field value with the packets it receives and that actually would be the information that it will use in order to build the Layer 3 topology.
1544200	1546280	And you know what? Guess what?
1546620	1571960	That actually does not help me because if I see where the elements are and how are they located and what is their position according to my system, I cannot actually build everything because I will have islands of information and I will not be able to uncover the exact routers that are actually operating on my network.
1571960	1578200	And the only thing that I will be able to detect is those systems that actually send traffic to the network.
1579660	1583000	Okay, now this projector doesn't work at all. That's nice.
1586510	1588290	It's always the messenger.
1589190	1590030	Okay.
1591290	1599750	So, if we have routing not done through the monitoring point. Okay, it seems to be trying to work.
1600090	1607340	Wow.
1607440	1609320	Yeah, it's encrypted stream.
1613940	1618460	I'm not mirroring and it's 640x480.
1618660	1621220	And I'll try to detect again.
1621220	1622320	Oh, yeah.
1622940	1625040	Refresh rate is down.
1628760	1631760	Yeah, buy something else. That always works.
1637680	1638420	Yeah.
1659380	1661240	Yeah, I'll do that one second.
1669580	1670240	Yeah.
1670340	1759060	At least it works with Windows, right?
1828220	1831200	See, I got an upgrade. So, now I'm using Windows.
1834530	1838770	Thanks for the help. A round of applause for the guy that donated his machine.
1842660	1844640	Yeah, I want it back. Okay, here it is.
1844760	1847500	Should I go to JD Travel and see what's in it? Nah.
1861660	1862300	Nice.
1871160	1873460	Yeah, do it by telephone. That would be nice.
1889740	1890380	Okay.
1903640	1905180	Start from the beginning.
1917180	1918680	At least you can see it now, right?
1926870	1927510	Okay.
1928150	1937010	So, basically, if this is my network and I want the passive network discovery system to draw it, this would be the result.
1937470	1938590	Similar, right?
1939790	1942090	I had this and now I've got this.
1942090	1944910	The problem is that I wouldn't be able to uncover the switches.
1945270	1949650	I would not be able to uncover which machine is connected to which switch.
1950130	1952330	And at the end of the day, I get this thing.
1952330	1953830	I have a router. I have systems.
1954410	1957590	But actually, it's not my system. It's not my network.
1959630	1963710	The problem is that we need to be deployed as close as possible to the access layer.
1963710	1966910	We need to see latitude traffic.
1966910	1970690	In order to do so, it means that we need a lot of moving boxes.
1970850	1978330	And to do this in a complete coverage, it means a lot of boxes and a lot of moving parts.
1978330	1985270	So, another weakness is that I'm unable to monitor the state of network services.
1986210	1989110	If this is an idle service, I cannot monitor it.
1989110	1992230	If the service goes down, I cannot monitor it.
1992590	1996070	At the end of the day, no service monitoring.
1996270	2001770	So, for example, I might see traffic for a certain port.
2001770	2003710	I may declare it as an open.
2003830	2006010	The guy would close the port.
2006010	2008050	I will never know it.
2008650	2015290	So, the less obvious weaknesses are the fact that I can inject whatever I want to the network.
2015290	2019090	And guess what? The passive network discovery system will take it.
2019350	2025630	The problem is that there is no way for the passive network discovery system to actually validate the information.
2025910	2031430	This is since the only traffic it sees, well, goes through the monitoring point.
2031430	2032550	It can't do anything.
2032550	2037250	So, at the end of the day, that leaves it with the inability to validate it.
2041310	2046950	The problem with it is that it's not only influencing the passive network discovery system.
2046950	2052970	If there are other systems which rely on the type of information that the passive network discovery system actually provides
2053550	2057730	in order to draw other conclusions, to do other things like network intrusion detection systems
2057730	2063710	or even network intrusion prevention systems, that might be something which we don't want to be happening.
2065470	2071610	This would actually cause the kind of information that will be taken from a passive network discovery system
2071610	2078070	will cause other management systems that actually get the information from passive network discovery systems
2078070	2084350	to produce even more inaccurate and incomplete information when they process the information the system provides them.
2084350	2089530	A very simple example to show you how this works.
2089530	2093030	Let's say we have a Windows-based machine like the one here.
2094190	2099510	And a passive network discovery system might have some kind of counter
2100670	2107150	or it might have some abilities to say, well, until I'm not detecting the operating system itself,
2107150	2112070	I'm not trusting the information that actually is being sent through the different field values.
2112070	2118450	So unless I understand that this is a Windows machine, I'm not going to trust the time-to-leave field value.
2118590	2122750	So what I've done is that I only played with one field.
2123390	2130730	I played with the time-to-leave field value. I changed it from default value of 128 to default value of 126.
2130930	2134970	And all in all, that is still a valid Microsoft Windows machine.
2134970	2142230	But for the passive network discovery system, it is now being located two hops down.
2142770	2150690	I didn't do anything, actually. I didn't move it. I didn't have to actually physically disconnect it from the place that it is being connected to.
2151110	2158550	This is because passive network discovery system, in this case, is unable to go to the switch and ask the switch, OK, who is connected to you?
2159710	2165250	So a simple example to show you that it is very easy to trick the system.
2165250	2176210	All you need to do is to understand the methodology and the way the system works in order to just put some decoys and deception and remove your system.
2177970	2187590	Other weaknesses, denial of services, mainly because you need to take the information, open it up, and understand what you're seeing.
2187590	2198530	Other examples of even remote code execution. Usually you will see this against Ethereal, which is a great tool, one of the best network analyzers out there.
2198630	2203790	But some remote code execution is possible against it in its different versions.
2205330	2210510	So, as some of you, I was in charge of a network and I had a problem.
2210790	2215070	I had a problem that I couldn't understand what I have. I couldn't understand what I need to defend.
2215070	2222390	I couldn't understand where are my elements so I can understand what are the differences that I need to do.
2222450	2227290	I cannot build walls without understanding first what I need to defend.
2227930	2237050	I've actually been doing this for the past several years and actually analyzed whatever there is to analyze regarding active network discovery, passive network discovery,
2237050	2247510	and actually figured out that both of them will never help you if you want real intimate knowledge, complete and accurate about your infrastructure.
2247670	2262570	Another interesting point is that there is many theoretical researches out there that actually they cannot be working on live environments, real world environments.
2262570	2271590	If you remember the NAT researches, those are good for paper. They don't really work on the real world, unfortunately.
2272930	2278570	So, the goals of the research were to have this kind of complete and accurate information, to have it in real time,
2278570	2288630	to not have agents to detect and react to changes in real time, and basically not allow someone to send decoys that will be taken,
2288630	2294170	but to understand that we have them and to ignore them, and to cover the entire IP address range of a network.
2294170	2298550	And, of course, to have some other things like topology, which is really important.
2299190	2303290	So, what I've come up to is with a technology called dynamic infrastructure discovery.
2303590	2310870	Basically, this is a technology that combines, tightly integrates, actually, between active and passive network discovery.
2310870	2325490	And by tightly integrating between them, it has new discovery abilities that are not able to be made with each and every one of those, if you use them solely.
2327270	2332470	This technology, actually, is adjustable to any type of network that you are using.
2332470	2341630	This is because it is able to balance between the information that is being harvested from a passive link to the amount of traffic it needs to send through an active link.
2341630	2347750	It means that it works by listening to traffic that goes through a certain monitoring point on the network.
2347850	2355390	It starts to build profile of the elements, data profile of the elements that are working on the network.
2355390	2367910	And after a certain time had passed, and it seemed that some pieces of data that were not being collected, or there are some pieces of data that cannot be collected through using passive means,
2367910	2375270	it's actually calling the active side and surgically inserting packets into the network in order to get the missing pieces of information.
2375270	2381450	So, for example, if you want to know where your elements are, you need to talk to the switch. You can't do that passively.
2381450	2386430	Or if you want to validate the type of information that you've seen passively, you do that actively.
2386810	2395230	So at the end of the day, it balances between the type of information that it sees going through the monitoring point, which can be good, can be bad, and can be great.
2395230	2400990	It all depends on the time of the day that you operate on or that you are at.
2400990	2407350	For example, when your users are coming to work, 8 o'clock, 9 o'clock, everything is working, right?
2407350	2410710	They do email, they browse the web, everything is fine.
2411450	2414630	12 o'clock, everybody at lunch, nothing works.
2415070	2416890	6 o'clock, everybody works.
2416890	2423330	A lot of elements basically disappear from the network because people shut down their machines and go home.
2423590	2427670	2 a.m., you might see a lot of backup activity on a network.
2427670	2434770	So at different times of the day, you see different things on a network that you are able to take different things from them about the elements.
2434770	2438190	But at the end of the day, you need that information to be complete.
2438190	2442210	So the balance comes from using the active site, surgically probing.
2443610	2457230	Other things that are unique, for example, you can detect what are the guest machines of a certain host machine of VMware or any virtual machine.
2457270	2458950	You are able to tie them together.
2459130	2464150	It's easier to detect not-enabled devices and wireless access points using this technology.
2464150	2474130	Basically, any piece of information that can be gathered either passively or actively can be gathered using this technology.
2476050	2479730	You can build your asset management.
2479730	2485310	You can do physical network topology because you are able to take the information that comes from the passive site,
2485310	2489890	combine it with the information you are able to take from the switches and combine them into physical network topology
2489890	2495030	where you show where the hosts are actually connected, the switch connectivity and the routers.
2495030	2497290	This is something that you can actually work with.
2497850	2504130	You have a real-time change detection. You operate in real-time because you have that from the passive site.
2504130	2511930	You don't require any agents to be installed on the machines because your monitoring point provides you with all the information in the world that you have.
2514450	2516490	I already talked about this.
2517710	2523550	One of the things that I like about this is that you are able to triangulate between user, host and location.
2523550	2536270	One of the biggest problems of managing and securing enterprise network is the inability to locate or the inability to say who is the exact user that is actually doing this and where actually his machine is being located at.
2536270	2543990	So when you have the physical location information, when you have the host name and you have the user name of the actual user that's actually been using this,
2543990	2553010	it's very easy to come to someone and say, you are the one that actually did this and that because you have all the information that triangulates that user to his machine.
2553950	2563370	From using only surgical probing, this technology does not pose any kind of risk to production environment
2563370	2571290	because you do not need to use a lot of packets in order to probe elements on the network for getting the information from.
2571290	2579350	And therefore, all the information is being either harvested passively or by using surgical active packets.
2579350	2582970	So the number of packets they actually insert into the network is very low.
2582970	2588790	The packets are RFC compliant and there is no risk of using those against production environments.
2590910	2600350	Some limitations. The only limitation that this technology actually have is that you can't really scan a network for 65,000 something ports.
2600510	2606490	So you might not uncover all the services that are actually working on that system.
2606610	2611030	Some usages. I'm being brief because I need to finish.
2611670	2615030	You have clear visibility into your infrastructure.
2615030	2624350	Everything that is on the network is being detected from storage devices to host machines to network-enabled, not-enabled devices to wireless access points, everything.
2624350	2634690	The accuracy level of the technology, let's say when we're doing OS detection, is less than 0.25% of false positives.
2634690	2646710	The ability to locate any device on the network, see its properties, see its whereabouts, understand what is being done in real time is something that you need as a context.
2647070	2650890	And when you have physical network topology, you can locate everything.
2651030	2659870	And when you have all this information that allows you to see whatever everybody or that particular element is doing, you are able to understand what is happening.
2659870	2662690	And if there is a problem on the network, you are able to locate it easily.
2662690	2668350	So let's say that you are an admin and there is a new patch for a certain service.
2669650	2677330	Usually what you'll do is you'll scan your network and understand where it is and try to understand what are the services that need to be patched first.
2678090	2688190	When you have current and real-time information, what you only need to do is just to have a search under your inventory for the open port.
2688630	2689970	You get the list instantly.
2689970	2694590	So you save the IT hassle of going and looking for that type of information.
2694590	2697490	You instantly have the information that you need in order to work against.
2697490	2699690	And that saves you a considerable amount of time.
2700570	2704550	You can take the information and feed it to other systems.
2705870	2709250	For example, you can do target-based vulnerability assessment.
2709250	2716390	One of the biggest problems of vulnerability assessment tools is that they need to do active network discovery.
2716390	2725870	So what you do is you're able to take a list of your Windows machines or Windows 2000 machines and instantly feed it to a vulnerability assessment tool.
2725870	2733490	And that vulnerability assessment tool may need to do only the Windows 2000-based test against those machines.
2733490	2734730	And that's it for it.
2734730	2746030	So you actually are able to make those tools work better and solve the 80-20 problem for them by feeding them with contextual information about the network.
2746030	2753330	There's also the ability to baseline the knowledge about the elements that operate on the network because you see them all the time.
2753330	2759470	So you're able to actually say what's unauthorized and what's not authorized because you see everything.
2760010	2772610	Until this point, if you're using an active tool, like this gentleman had said, if I do a scan once in 24 hours, I can't do anything with the information because I don't see the changes.
2772610	2779530	There are some users that might bring their laptops from home and take it in between, and I'll never know that they're actually existing.
2782910	2791510	I think the most important thing about the technology, about the dynamic infrastructure discovery technology, is that you finally have control.
2791510	2799890	You can achieve control of what you have because you understand what you have, you understand the layout, you understand you have strong auditing capabilities,
2799890	2807910	and you understand to use it for the first time and not just saying, okay, I have partial information, I have complete information, I have control, I have everything that I need.
2809190	2812650	Questions? Yes, the gentleman here.
2816060	2820760	This is working. If you want more details, I'll give it to you at the end of the presentation.
2821580	2822540	Other questions?
2827280	2830760	If you'll talk to me after the presentation, I'll answer the question.
2831580	2832460	Yes.
2843650	2847230	The only switches that you actually know that they exist are your core switches.
2847230	2856290	I mean, in all the companies that I was talking to or working at or consulting to, what they know is they have a firewall that connects them to the Internet,
2856290	2859610	and they have those nice core switches because they cost them a lot of money.
2859850	2865930	And usually when you hook this up to the core switch, you get all the information that you need from the core switch and you go from there.
2865930	2874650	Sure, it's something that you need to install on X number of places in a distributed manner in order to see the complete visibility
2874650	2877790	because it needs to see traffic between Layer 2 to Layer 3.
2877950	2881510	But at the end of the day, you still see complete visibility.
2881510	2886970	Say that you want to have an IDS system, an IPS system, they all have the same problem.
2887770	2895190	But this system actually can take traffic from multiple networks into one place and not just see one network at a time.
2897730	2903350	If you have a Layer 3 barrier that you cannot pass, you need to install another system.
2907970	2913990	Well, when you have a management server, you are able to connect everything and all the dots and you have complete information about everything.
2915590	2916550	Yes.
2962620	2969760	You must use SNMP to take information from the switches because there is no other way to understand where the elements are if you are not using SNMP.
2969760	2976440	The idea is that you don't need to know the connectivity and you build the connectivity automatically using other algorithms.
2976440	2982460	There are several researchers that were talking about how you build your topology by just taking the information from the switches
2982460	2987020	and trying to connect the switches without using proprietary protocols.
2987020	2991780	Some of them have some holes in it. Some of them are incomplete.
2991780	2995220	But at the end of the day, you can learn a lot from those researchers.
2996980	3003380	What I did with this technology is you must understand where the elements actually are connected to.
3003380	3008220	And what you are able to do is just to say, okay, if this element is something that, for example, is unknown,
3008220	3012640	I am able to say which switch and which switch port is actually being connected to.
3012640	3017820	You can use that information and you can say, okay, now I won't go and tell the SSH and kill this port.
3017920	3020640	The idea is to have the visibility.
3021080	3025640	There are some switches that can send you an SNMP trap, for example,
3025640	3034440	when the information about the source MAC that is being registered to the port changes.
3035700	3040580	Not all of them are able to do that. The new Cisco 2950 are able to do that.
3040580	3044600	But at the end of the day, if you want to start to do log aggregation, be my guest.
3044600	3050820	I mean, there are other products that do log aggregations and other open source tools.
3050820	3055080	But if you don't know what you are doing with the information, then it's just a big pile of logs.
3057600	3058400	Yes?
3063380	3064600	You said what?
3065920	3068800	Yes, it is possible in several cases to detect subs.
3070200	3076860	Basically, the issue is that if you have a port which you see multiple MAC addresses and is not connected to any other switch,
3076860	3079100	then guess what? You have a hub.
3079100	3084760	Of course, it might be a 4 port or a 6 port or a 16 port, but no more than that.
3084860	3086180	A hub is merely a guess.
3086180	3091120	But if you don't have any other switch connected to that port, you basically have a hub there.
3092700	3093860	Of course.
3093860	3101480	You must be connected as close as possible to the access layer in order to do anything in networking and security these days.
3101920	3102820	Yes?
3118960	3122400	If you are using TTL, it means that you are going to fail.
3122540	3126700	That's something very easy to change and you don't want to use that.
3126700	3129920	Look at the example that I put here.
3130700	3133300	You have two ways of doing that.
3133300	3136500	You have a bridge mode and you have a NAT mode.
3136700	3140700	Both of them, you need to have different ways in understanding that you have VMware.
3140700	3146000	I mean, it's very easy to understand that an element is a VMware machine just by looking at the MAC address and it's VMware, right?
3146200	3152320	But the thing that you need to do is that you need to actually understand where it is being connected to
3152320	3155660	and that's other algorithms that I'm using to do that.
3157160	3160160	Okay, so they need to... yeah, one other question.
3165670	3166550	No.
3167910	3171950	This works against whatever you put and if you have VLANs, that's not a problem.
3172210	3176030	If this wasn't working with VLANs, then I guess it was a major problem.
3176270	3179190	It is working with VLANs with everything they have on the network.
3180950	3186390	So, I would like to thank you that you have stayed with me through all of the problems that we had today.
3186390	3189050	Starting late, replacing laptops.
3190950	3193810	And staying up until 5 minutes to 9 p.m.
3193810	3196410	Thank you very much for having me here. I enjoyed this.