SIEM helping DLP to show the clear and accurate picture of events happening behind the scene

From the Target breach to the latest Sony breach, data leakage has proved to be the most expensive  and serious loss to their stakeholders. While DLP solutions provides a preventive mechanism to organizations' confidential and sensitive data from going out (or leaked) to unauthorized destinations. SIEM goes beyond and presents the correct and accurate picture to us, by telling the reason of particular Data Leakage. Its help us in stitching and correlating two discrete events (obviously in this case at least one event from DLP) from  different log sources and present us with the correct and apparent picture about the event that happened just before the data leakage event. So, in a way it tells us the cause and motivation of the alert triggered by DLP system.

If we look at the kill chain stages (which are the intrusion stage attempts usually followed by Advanced Persistent Threat) then data ex-filtration will be the last stage. So our aim should be to detect the intrusion in an early stage rather then detecting at later stage.

When we use SIEM + DLP then probability for an alert to be True positive is more than when we only use DLP.

We can only get the motivation and cause of the attack, when we can correlate and chain more than one events. And that is only possible when we can integrate DLP with SIEM. So in this way, each previous event tells the story to the next followed event. We can consider the below scenarios that may happen just before the DLP generated any alert. So in the below diagram, we can track the different event of attacks, detected by different security devices being monitored by SIEM to tell the complete story.

While, if we only uses DLP, then we will only get DLP alerts that have less information about the cause and motivation of APT.

So, it is always better to use DLP tools with SIEM that helps SIEM to get more information about any Data Leakage alert generated by DLP tools.

Different scenerios or example of confidential data leakage

Threat Agent	Example or Scenarios	Action for Prevention
Document printing	A sales representative planning to quit tries to print out customer records from the SAP database for future use. This could cause a data breach that must be reported publicly.	The printing activity from the SAP application should be blocked.
External storage device	A contractor attempts to save source code to an iPod or USB drive.	The action should at a minimum be monitored and most likely blocked depending on policy.
Copy/Paste	A non-HR employee attempts to copy employee data from the Oracle HR database into a Word document. This could lead to a violation of employee privacy	The paste should be blocked
Screen capture	An administrator tries to copy an on-screen display of sensitive data using the “print screen” command	The “print screen” action should be blocked
Web mail or web posting (forums, blogs, wikis)	An accountant tries to send controlled financial information in an email (body or attachment) from a personal web mail account, or mistakenly posts it to an external web site	As soon as the user attempts to send the message or post the content, it should be blocked (before it is leaked)
Inappropriate internal transfer	A sales engineer attempts to send multiple customer records to a support engineer. The company has a policy on straining customer data transfer outside each specific domain to a single record at a time	The system should detect the mail or instant message with multiple records, and block the transfer
Encryption	An executive sends merger documents to legal counsel. Policy dictates it should be encrypted, but the message is being sent in plain text	The email and documents should be encrypted before transfer
Guest laptops	A visitor uses a laptop to connect to the corporate LAN and attempts to forward sensitive information via web mail or email	The message should be blocked
Mobile PDAs	An executive uses his BlackBerry and mistakenly forwards an email containing sensitive product roadmap dates	The message should be blocked from leaving the enterprise
Roaming users	While at a conference, a developer tries to transfer source code from a laptop to a USB drive or CD	Usage policies should remain in force, even though the system is disconnected

Probable Reason for antivirus signature/ definition update failure

• Their was no connection available between workstation and update server.

• IP address of the update server is blocked on firewall  that is present between antivirus and update server.

• License of the antivirus is expired.

• Some other antivirus is already installed on the workstation that is not allowing the antivirus to update ( the one which you are trying to update).

• If your organization has some proxy that filter all outbound traffics then it may be possible that your antivirus proxy setting is not configured properly.

• Some malware is their that is creating some problem in update process.

• Workstation or system was in shutdown state. 

Certain signs of intrusion that can be detected by IDS/ IPS:

• System's failure in identifying valid user

• Active access to unused logins

• Logins during non-working hours

• New user accounts other than the accounts created

• Modifications to system software and configuration files using Administrator access and the presence of hidden files

• Gaps in system audit files, which indicate that the system was idle for that particular time, the gaps actually indicate that the intruder has attempted to erase the audit tracks

• The system's performance decreases drastically, consuming CPU time

• System crashes suddenly and reboots without user intervention

• The system logs are too short and incomplete

• Timestamps of system logs are modified to include strange inputs

• Permissions on the logs are changed, including the ownership of the logs

• System logs are deleted

• Systems performance is abnormal, the system responds in unfamiliar ways

• Unknown processes are identified on the system

• Unusual display of graphics, pop-ups, and text messages observed on the system

• Sudden increase in bandwidth consumption is an indication of intrusion.

• Repeated probes of the available services on your machines.

• Connection requests from IPs other than those in the network range are an indication that an unauthenticated user (intruder) is attempting to connect to the network.

• Unexplained modifications in file size are also an indication of an attack.

• Presence of rogue suid and sgid files on your Linux system that do not match your master list of suid and sgid files could indicate an attack.

• Missing files are also sign of a probable intrusion/attack.

Where to place your DHCP Server in your organization's netwkork infrastructure

To determine where to locate your DHCP servers, consider whether you are deploying a distributed, centralized, or combined DHCP infrastructure.

• For a distributed DHCP infrastructure, locate a DHCP server on each subnet. Because distributed infrastructures use a DHCP server on each subnet, they require a greater number of servers than centralized networks. For example, a network that includes 30 subnets and that is using a true distributed topology requires at least 30 DHCP servers, and possibly more to provide for redundancy.

• In a centralized DHCP infrastructure, DHCP servers are placed in a central location. A centralized DHCP topology requires the deployment of DHCP/bootstrap protocol (BOOTP) relay agents. Additional hardware resources are not generally required for DHCP relay agents; in most cases, the routers that are positioned between each subnet can assume this role, as defined in RFC 1542. If the routers cannot relay DHCP messages, configure a computer running Windows Server 2003 to act as a DHCP/BOOTP relay agent. For more information about configuring relay agents, see "Enabling DHCP Support for Multiple Subnets".

• Combining both distributed and centralized DHCP infrastructures provides the maximum efficiency for your network. In a combined DHCP infrastructure, the locations for DHCP servers are based on the physical characteristics of the local area network (LAN) or wide area network (WAN) infrastructure, and not the logical groupings defined by the Active Directory logical structure. DHCP servers are not required for every subnet if the connecting routers support DHCP/BOOTP relay agents.