LT - Evil Empire: SIEM FTW - EggDropx & CheezMan

go

ahead hey love that [ __ ] if you can name that too and then get a shirt and a towel I was hoping they would sell least one we have low standards in this talk no so welcome to our [ __ ] show we successfully trolled besides Las Vegas cuz we're here [ __ ] yeah so originally this this talk title was too controversial for beide so we had to change it uh for Mor so of course we added the offensive language five more times in the slide deck after we change the title so he's welcome so we're going top one of infos seex Best Kept Secrets until now mic's not on you're C and crappy

hello unlike so I know what you're thinking right you're thinking what the hell did I come to and what am I looking at just what is a Sim right it's pretty sad honestly this make people can do a logview talk but that's [ __ ] awesome so what does Sim mean lots of different [Applause] meanings babbe Maybe um this is Doug's favorite but I had to edit it out because I don't get arrested so Grandpa went with this Google Images are scary if you're not careful really we our our images are stolen by the way and there's a slide the end with all the references uh white on white fonts so you're welcome this is dog's

favorite your story you may also be asking yourself who the [ __ ] are these ass hats up here right who are we so you can follow me on Twitter for like offensive [ __ ] so I've been doing Inc a while and I do I have a day job sec I have a night job kind of n SEC on weekends I run the the hacker conference in Michigan I'm sure you can't figure out which one um I know what you're thinking right I'm [ __ ] like Batman right like security by day security by night I am like Batman right really like this one but you got to give what you get I'm Doug or cheese or Chris calls me

a lot of things I don't like to say old man balls yeah um I've been doing it and security for for quite a while um he calls me grandpa I am fairly old but um it's true and the truth is we're not cool enough to be red teamers so we rock the defense right we're Blue Team guys all day Doug likes to diddle himself to uh to log review we require ourselves to sleep tonight because well we're just not cool contesters and you might be wondering why you came to this talk which we're glad you did honestly not sure why but whatever but if you laugh at least once which I heard of you then you made our day so we're

going to explore the Magical World and the history of security logs and log review and the idea that log review can actually be useful because all sarcasm and Chris is squaring aside we do believe that it is important we're not going to make you read logs in this talk cuz you're in this so you probably don't read log and that's the problem we're not going to make you read much else either we have over 300 slides and about that many words so rock and roll and if you're easily offended you may want to pretend to make a really important phone call about 5 minutes ago it gets worse so yay you're here and thank you

we love these sides and donuts and we thank them for letting us come here this isn't rocket science right a lot of you sucks we all know that but you should really do it anyways you know it's hard you shouldn't so let's look back at how we got to where we are today and hopefully towards the and a glimpse into a brighter future um we call the first era anarchistic and in that era long ago like EUR long ago like old man long ago yeah true there there were no logs and the IT world was a dark and scary place which was pretty cool like Doug's dad a little scary a little cool and to quote bicho from Green Day

probably one of the most experts on both infosec and punk rock back in the ' 80s and early 90s the scene was about the closest thing to Anarchy I've ever seen and it scared me but some of the anarchists we showed you earlier did not mature and then somehow they got on the internet I know think what the hell is the internet right I know we got to teach you guys to knew this [ __ ] so we think back to when the interweb of this wet dream that Al Gore hadn't had yet right when it just this experiment using the equivalent of tin cans and long string everything was duct tap and bubblegum [ __ ] jamm

together it took a [ __ ] ton of analog tubes to solve basic math problem right it's a big [ __ ] mess and slow stuff you could actually watch porn download on your screen it was so slow I mean it took forever oh this would be good look at this [ __ ] hell yeah hell yeah a [ __ ] I haven't upgraded 28 yet so I apologize I know you don't know what that is you're too old but it's what IED that um but but later we'll be renegotiating our PPP connection so we'll get the whole image we'll have it by tomorrow five bucks so white bearded awesome Unix cman guys they knew locks

existed however they only used them to troubleshoot a known issue okay you know the [ __ ] that Network losers do all right BBs vandalism is all the rage and this lure of weers and slowly down little porn ATT tracked all these people otherwi wouldn't use the internet that was before all the wonderful peer-to-peer things that give you malware and security was not existent especially log R viiew it was when physical security was good enough your sneaker net IPS was pretty simple you just locked the door and security cat would say Suck it you turn off your modem or your ISP drops and hope for no fire and then things got real and all of

the unwashed masses were given internet this when that all hell broke loose which Lees Age Two or we call it monolithic there were logs but no one cared or bothered to look at them and life was pretty good still and the thoughts of the age were logy was pointless most systems were on the internet right we didn't have time to loger we're busy right we're busy [ __ ] Tetris you're old what we doing yeah Tetris is good I mean pong was better wrong and it was pointless it had no value free with every beer and we didn't have time we have better things to do right we're busy we're busy right and who really wants to do

reblogg all day with all kinds of other cool [ __ ] you could do which led to this myth the IT people are lazy right it's like Bigfoot it's not really a myth right it's real it's true it's [ __ ] true but if it people are lazy Mite people are [ __ ] total fat asses I mean look at them you go to gym sorry you fat [ __ ] so by now the internet had loan up and all the really wead hackers would to face your website that was scary and and I mean they moved on from analyzing the BBS right yeah You' been stillone or they took all the animated gips off my

old geoc City's page I was one of the saddest people you ever cared no more dinosaur right yeah or the little uh mailbox for email where the UNF goes in no and and so I was really sad inside when they messed up my go cities that was nice thank you and and I was so just down I could get out of bed just to restore from backup assuming you had backups of course you don't because you're a piece of [ __ ] and then I would have to cry and cry like like like any good system administrator would Ser caretaker would cry himself to six that's true cu the idea of making money from hacking right

really wasn't on the radar of most people this idea of an impc as a job was more of this cult right it wasn't really a real thing and some of the newsmakers of the day right had some flexible morals or they were just sick bastards which is where D comes in and some people oh I missed one but it did some pretty impressive hacks for the time before they wrote some books and sold out but but they W really motivated by the allmighty dollar they were doing it for cash necessarily not so later and if you're as old as me or perhaps older nobody's that one if if you've lived a good life and you live as

long as me there there was colde red I remember it and Nima until NT Service Pack 68 was it that fixed that you know good times and you know again website def bement oh no it's sad but then kind of everyone went back to sleep I think info is cyclical right everybody freaks out does some things and we're all just kind of like yeah whatever which L us to the third age of vog review realistic yeah I think this is actually DG's homeo Yes sounds good though and there was log review in this age and it it sucked it like really sucks unable you should just kill yourself sucked I like being forced to listen to

music of a certain kind so okay so puppy don't so show pant I mean do you remember opening like your CIS log files in Excel over 100 Meg and watch little progress bar to that [ __ ] yeah it was awesome old school and that made your eyes bleed right right and almost nobody loves that except Doug's dad he loves that I asked you not to use that joke it's not a joke so we're going to S here for a minute no no no no no so if you like that old school log review honestly my head is off to you but I I I admired that kind of detail oriented sickness but I got some issues

with ad and it's s on wir so I'll break that finger sorry yes you will so I I used to fall asleep waiting for word pad to open my i 4 logs right waiting and waiting it's horrible because [ __ ] notepad had a 6qu kilobit limit right so you had to use wordpad which takes [ __ ] forever but when you did invest in log review it was for compliance that's you get any value cuz they that little check box on that big list of garbage that they give you you know right next to the icmp relay time stamp [ __ ] but that you don't want people to know what time up here and that's bad

right or where your business is or what time you're open or your website apparently right and since log riew is pointless and it kind of sucks right just automate the [ __ ] out of it right that was the idea was just automate it you don't actually spend time time on it which let us to this fourth age craptastic boom and miraculously s was created and Angel sang and and it it also kind of sucked too but but less no offense to Carlo here okay that was his idea thanks this is this is the the point in the show when I would like to talk to you about simbe and I would like to talk

about you and me and all the Zab byes and yotabites which are hard to say of log sitting out on disk in your environment that you may or may not be touching so vendors are they all purely evil well let you make up your own mind if they're evil or not I would like to exclude the Bight sponsors I no okay but despite all the bitching and moaning though and all seriousness we are fanboys of the Sim you remember Sim right suck it and eat me we're fans of that so good products with proper planning actually monitored by people infoset professionals yeah they give a flying [ __ ] it's very key and they are

hard to find cuz you have people that are trainable that will care okay but there's also the people that are in this field who just do not care and do not do any of us any favors if you're if you're one of those I mean we all struggle with that the ups and downs I don't even talk about okay next slide but if you find this be right it's wonderful it is we all have our own defition what wonderful is but find those people that can do this work is a great thing right enjoyable dog enjoys every ship so but finding those people that are both good and truly care and want to do things right in a structured approach

are probably or perhaps arguably as rare as as a no Nobel admin who still has a job certainly not as rare as that or five of race perhaps that rare that rare raise your hand if you're administering groupwise right now no don't they're all dead like you but but honestly doing it right it is hard it takes some work and you have to continue to learn and if you're here you're probably one of the good guys or Chris right we tend to be lazy we talked earlier right we didn't get this this job for the outdoors time right takes a lot of blood I asked him to take this out this is's trying toot lot of it security

Sweat Right a lot of hard work I asked the hotel for eyewash okay they do have some in the lob it comes later and then you should drink because maybe this will erase some of these terrible images that Chris is pluming into why help but the worst ones I'm going to punch you in the dick later wow so I mean in all seriousness if you look at the world around you there are many things that are going wrong and if you have been into this field for say I don't know oh I forgot um I apologize he's not drunk this but some of the images are so disturbing I forget what my line is supposed to be

but okay that old man line right there yeah thank you I mean yeah me and Chris love we do I I love puppies and long walks on the beach dude this is me and this is our road trip down here actually we stopped by Chicago We're from Michigan and we drove here okay that is insanity my car smells like [ __ ] we made it alive and that is a miracle so thank God but but hon if you're in infosec it is hard to stay positive if you've been in this industry more than 30 seconds thereabouts and people with skills are hard to find if not impossible if they ever existed at all so lead you these douchebags right

I'm not saying there's douche bags out here there's a lot of douche bags around that's we getting up with this mentality of set it and forget it chicken right you know they want to fix this with automatic alerting these alerts that just pop up and say oh [ __ ] like code Red's still around for some reason or you have a confer infection in 2013 for some reason nobody has those U I did but I ignored them that Bo so you gather your metrics important things you know all the stuff you see and all the things that work so well with IDs IPS set it and forget it you have which management LS they prefer the

green ones yes because they know have to read it right cor to this like we're rocking right up to 2010 then we stop we doing any at all pro tip would be try to kind of sway the fact so the red comes out so Doug produces his garbage where he works right either because he's lazy he doesn't know how to do it right I can tell he lazy be both kind so but if you don't know ask for help I mean I love the infosite community people most of them are here to help you and you have to start somewhere right because how many of you actually got to where you are today with no assistance

whatsoever okay I doubt it and and if you are one of those gurus sitting on a Mountaintop screaming this talk which you might not be but if you were you'd be in Tibet jacking off thinking about how amazing you are because you are God's gift to this field the infos Pros while ignoring the fact you have no friends true story Doug has no friends I used to have one and if you're lazy get the intern to do it right they're either not paid at all or very little and they'll do it they don't [ __ ] know any better that always works good or even better yet just go [ __ ] and kill yourself just get over

with right so the keable key good God the KY to a usable Sim I'm another drink is quality log management right manage your logs before you try to correlate them it's pretty important to doing Sim you just have a bunch of garbage things like baselining I mean doing your homework beforehand I know that's the hard part no one likes it course is kicking me cuz your [ __ ] [ __ ] up go so garbage in garbage out right and you should build rules that are appropriate to your organization so that means you need to understand your environment build the specific use cases you need to solve an identified Problem whatever that might be you probably have

a lot of them if you're like me right if you identify problems around things that are important to you right so where you read compliance finds we like compliance because it's the reason most of us in this field have jobs jobs are pretty there's other reasons but and any reason you can think it right it doesn't really matter what it is if you feels important to know who's downloading porn or who's playing Candy Crush all day cool write a sign for it right and and that you know won't tell you what data is you know leaving your organization or important things you probably should be caring about but you do what HR tells you cuz

you know who pH right you want to add content as needs arise um you're going to need ir and it's very difficult time consuming challenging you got to build the plan and you actually have to test the plan you know can't just sit in binders on your in your flipper bin it takes time right alerts are great but give them to respond to with it you have no plan to actually do something about it your dug these little man balls just sitting around looking at popups right and then eventually if the noise signal to noise ratio is too high you just end up ignoring all the important things and you get this vendor sock in a box [ __ ] right like buy

this thing and now you don't need a sock and you can just firey everybody and buy this garbage right instead of giving up right when this out of box [ __ ] doesn't work you this half millionar margarita machine good we're about to find out so back to the point if we actually have one we like to break it down to you in a language that even a pentester can understand I don't have a light bright it's a cheap shot but sometimes The Blue Team you know we we're insecure what so okay I'm going to teach you some new math right you got a crappy Sim but you do you do have infc ninjas like

Chris on to have pretty ninja you can tell yes right you got [ __ ] yeah uh next equation which is a choice I've lived with you got crappy Sim and clueless staff you still got [ __ ] yes uh great Sim clueless St yet Doug the come dumpster that was another one I be toed but here we go so great Sim great Sim but nobody watching it the whole set up forget it you're really a disgrace right you spend this money and stuff you actually have people there you don't care right that's that's a theme the not caring the not caring and killing yourself with themes we're pro suicide okay now this is control this is my favorite but it is

as rare as hen's teeth right you have a great Sim you got Chris and and his gang of ninjas um [ __ ] you right it it come see me straight up come see me this this this magical world does exist this one hey get away my [ __ ] okay so that brings us to our final age which is my favorite oh no okay let give ahead crack so but you do have to choose one of those math equations choose well Choose Wisely okay so our final fifth age I call it super cal futuristic and there will be something better in this age it will also suck and you will pay too much because

vendors can get green and it's shiny has glowing [ __ ] on it y as you'll see in a minute which is all you need to buy to sell sh right and your ceso right told you to get some of that [ __ ] they saw on the cover of some random magazine that spam you every 5 minutes to go write articles for their piece of [ __ ] made whole or maybe they went to one of the many fabulous black hat parties right and and heard about this new thing that's going to change the world it could be impenetrable that's a word yeah thanks wow go ahead self-restraint what um so the executive Symposium your boss just

got back from you know they were talking about like I don't know 400 million unique pieces of hour that they found you know the the semantic maffy show they're like you're going to die names 4 million no okay so stop right there because 400 million that's a lot that's some [ __ ] all right it's a snake sale then like doesn't understand Packers an infuscation and how forign million piece of Mal really just [ __ ] not right they should go kill themselves right or or right they come aots just as bad a so you know get back from the EC Council ow ow um your T is going to ask you hard questions that that may be unanswerable

how how do you defend yourself from all that malware or keeping your users from clicking on how would you detect that though I don't know that's why you were in government so instead it's true luckily luckily for you today Tits McGee who's a Salesman for AP1 Incorporated right said their new Appliance the new um now defun piece of [ __ ] can totally detect this all right it does AV IDs Pepsi Next Generation firewall y it does it all and that's tasty and you know all that crap you buy right from one vendor because it's cheaper to buy all sh from one person so they get an actual useful stuff that stuff that's what we're talking about here so as as

Steve wnc or Steve Jobs used to sayate jobs all right so one more thing right this is where wait I got to put on my marketing kind enough toow me okay our vision going Hill on this for the future of sim and our own greed we like money and food we we are thrilled Beyond repair today to introduce our own Appliance and it is a magic unicorn Sector 9 winner boom that [ __ ] happened now we are not Gardner we're forced to research but we'll take your money to get on our list y we'll get your reports we have lots of TPS reports to share um we're not in analyst firm nor have we

been yet evaluated by one but our we wrote this business plan last night we're um at casino at well it wasn't really a Casino as much as Thunder Down Under but on the back of nap it didn't really work out the way we expected but n out of 10 proctologists love our product true story soory you know you get fed of people trying you get sick and tired of people trying to sell you things which you may or may not need you know fud sales marketing and we we decided to do something about it very little but something great as is the it way but we are really excited to De view the suppliance for you today and we

believe is going to revolutionize the Sim Market but let's go over some industry standard features it will cars log data from any Source network devices any OS it offers correlation like this awesome I chart here there's some important data in there you should somewhere it can chew up Big Data because we love the buzzword in this industry spit it out in AAL ways that you can share with your leadership you've got pie charts bar charts ey charts uh cord charts and if if you're into Sanskrit we can do that too we just had that module last night boom and we have real actionable intelligence that is tailored to your environment and we're big fans of proof

of concept letting people use the stuff before they buy it I know it's it's rare but we'd like to share with you some of the SMS alerts that we've done for some of our customers this is one this is so highly tailored to your environment not only will the text some kind of [ __ ] fing D garbage it'll actually hook you up and get you the [ __ ] out of it you're a non-extradition country when it all goes bad you have an exit plan or if you prefer you don't like your boss it'll go ahead and hang the news around his neck and blame him for the [ __ ] and if the emails don't actually

exist it'll actually create them and postate them so you're good so promotion right that's that's [ __ ] job grp really mature to be all passive aggressive and do the I Told You So thing right that always works maybe so we we're going to do a live demo of the demo gods and all that of our software which is the secret sauce of any Sim but last night this penum Pro box I'm going to show you in a minute I was trying to get security onion no no no not it's our unique oh yeah patent pended totally best of breed proprietary solution we changed the background wallpaper on a security onion drro now we own that [ __ ]

added that Alien Vault open source Sim and okay all right reality maybe this isn't the best Sim and it may not do anything at all but does your leadership really know or do they care okay they don't yeah it it is sad because it's true quite often it's true and people are easily confused confus they don't understand how infos applies to your organization unless you unless you've done a good sales job inside which is hard because it means talking to people and we're lazy so it's hard so we don't do it and we don't always get the love we need in info SEC right well me and you do that's private well that's later so

but there's two things arsim does which so far no one else has done yet okay this ninja 3000 TM it's just trademark it Mako real smoothies with your [ __ ] touch my keyboard wait are the lights working all right okay and it has gamer style lighting yeah because why should the gamers have all the fun right I mean if you go to your data center you want all to not stand in front the slide oh you want upper management to be impressed by the relative size of your lights and how many you have so it's all about the size can you talk in that it's sound activated it's amazing [ __ ] who dou

[ __ ] and it's got reos see Doug build it so it's kind of flaky oh oh oh bring [ __ ] all right so uh the blender comes standard with every purchase okay no extra charge also um I get a little frustrated as Chris said I'm inan government sector budgets are like non-existent so do do you love per device licensing we don't have any of that garbage no there are no limits to the amount of data that you can store no device count issues with how many devices you can have reporting to this I do love Splunk but you know the free version it's like 500 May wow I can't even just do my firewall Cy logs

for a day in that okay right and also along the lines of No Limits you can make as many smoothies as you want okay we're not going to charge you by the outs or something if you're a large company small company it doesn't matter make smoothies forever no extra charge how many people do we Speare away I bunch I think it's your attitude yeah working on all right so we had a few problems with initial prototypes okay the first box I built I discovered that yogurt and do not mix but we're working on the next gen which you've heard of water cooling for gamers right for overclocking we are going to have a yogurt cooled

CPU it's going to be Doug's hot yogurt all over this oh yeah that's the other joke I try to VI yeah I see you SK to the [ __ ] too yes so there's some bloves around this Appliance right it's [ __ ] epic SC magazines holding September cover Force even Anonymous wants to get their hands on the thing okay that's true and Gardner has created a new quadrant for us next year's Sim report okay you're going to see that hope if if we if we can scrap up enough vure C cuz unlike all these other posers crappy garbage right the nja 2000 will actually preemptively Protec all future APS guaranteed or no money back you may have the hype before but

this is the real deal this is this is futuristic stuff okay we're predicting things we don't even know about yet how does that work boom right we added full in dat encryption at no extra cost we're talking like everything you can imagine like all your TOS NSA prism can suck it all their nation states can suck it right we protect against all tapping right whether it's wired wireless cell Whispers in the bathroom smoke signals y basics for encoded faxes thermal paper or now damn so and decoda ring sent via USPS which of course never gets there but oh well with us your conss are safe but we're not done yet with features okay you've heard of

UTM which uh can stand for many things you wrote the slide apparently we're into really offensive acronym so I'm going to call this ultimate testicular manipulation it's that bad whoa and and so yeah I mean it's the Jack Wild tr's best of nothing solution right that always works if you need it it's in there let us know we can write a custom code for you in about I don't know a few years maybe tried to do it but not really we got an intern it's good and and it makes smoothies right and it has more and better lights and I'd like to show you a few bits of actionable intelligence from some more of our proof of concept

customers bam right it actual warn you yeah when you want to L on yogurt that's next level [ __ ] so all you've heard the term return on security investment how was that for the bottom line

right so I I know what you're thinking just shut up and make me a smoothie I would love

to let me know you're done first you put in the vanilla yogurt fres freshly szen all right I don't know about you but I like some buy orange juice in my [Music] smoothies and we told you the [ __ ] show your so I I like the uh old berry medley I really hope not start hey your legs are out broke I pray the demo Gods yeah okay sorry kicking all right okay let's go

yeah all right can I have some volunteers no good choice no was free [ __ ] we got Chris Chris did not want to wait in line at Walmart to buy Rum so this is alcohol free sorry he veto that [ __ ] D's no fun [ __ ] government employees and uh I'll be making another bad don't feel like falling the stuff back to the hotel yeah I don't know lunch will be served after this this is a clean blender true story this music so I apologize I'm so old I remember Ben Hill nostalgic all right so can I ask you does it taste like winning tastes like security tastes like th all right so tastes like wait no no

so how much you didn't ask the price yet okay and I know you hate it when you you know the vendor won't give you the price after the third date and you look like you [ __ ] laid in the tanning bed for 8 years that's such a tease yeah so forget that [ __ ] yep today only you can buy this Appliance for $100 cash money and we have another Special Value for you if you buy it today I don't want to talk about that you wrote the slide [ __ ] but it's tonight only okay if you want that special and it gets worse and so if if you get yourself a ninja

3000 a winner is you true story so we thank you for coming to our talk uh I did hear some laughter um Chris will be outside afterwards by the dumpster accepting unmarked bills or sticky Thum Drive CR card dumps yeah as a payment and we like to thank you um Shameless plug yes free beer so if you like again just me Doug thanks for coming we had 10 minutes any questions about Doug's hot yogurt no well I apologize for wasting 1550 minutes of your life but there is lunch okay lunch is right after this lunch is on Doug done thank you get the [ __ ] [Applause] out watch