DATA ANALYSIS FOR NETWORK CYBER-SECURITY ((NEW))

In three sections, this book examines the process of collecting and organizing data, various tools for analysis, and several different analytic scenarios and techniques. New chapters focus on active monitoring and traffic manipulation, insider threat detection, data mining, regression and machine learning, and other topics.

DATA ANALYSIS FOR NETWORK CYBER-SECURITY

As data analysis techniques are becoming more widely adopted, cybersecurity analytics is seen as a more advanced field straddling the line between cybersecurity and data. IT pros covering many aspects of cybersecurity may now have titles like cybersecurity engineer or cybersecurity specialist.

Excellent computer and internet skills are a must when you want to learn about cybersecurity. Any sort of job experience, internships, or high school or college classes involving information technology, like computer programming, digital marketing, software development, and computer forensic analysis, can be helpful too. You can also benefit from past experience or education on topics like computer hardware, computer science, vulnerability assessment, system threats, information security, and statistics. A background in criminal justice or any kind of investigative work may even help when you study cybersecurity, as can experience in telecommunications, national security, fraud, financial security, and law enforcement. Knowledge of operating systems, cloud networks, wireless networks, and mobile devices may also be necessary.

The master of science (MS) in cybersecurity with emphasis in data analytics prepares individuals for demanding positions in public and private sectors analyzing, managing, operating, or protecting critical computer systems, information, networks, infrastructures and communications networks.

The data analytics emphasis focuses on developing and applying data analytics skills to fulfill significant needs in the business community. Students will integrate business concepts as well as key methods and tools for large-size data modeling, analysis and solving challenging problems involving "Big Data."

Watch out for any suspicious activity associated with management protocols such as Telnet. Because Telnet is an unencrypted protocol, session traffic will reveal command line interface (CLI) command sequences appropriate for the make and model of the device. CLI strings may reveal login procedures, presentation of user credentials, commands to display boot or running configuration, copying files, and more. Be sure to check your network data for any devices running unencrypted management protocols, such as:

Traditional SIEM does a good job of addressing threats as they pop up. With cybersecurity analytics, your network security can detect threats before they impact your system. This is because the system observes network behavior and data flows, looking for potential threats.

With CI/CD, code changes are deployed in a testing or production environment after the initial build of an application. Analyzing network events pertaining to each of these iterations requires an enormous amount of data processing and storage. Cybersecurity analysis uses cloud infrastructure to meet these intense storage and processing needs.

With big data security analytics, you can automatically collect information regarding all the endpoints on your network, as well as the behavior of individual users, groups of users, and subnetworks, including software-defined wide-area network (SD-WAN) connections. Big data analytics can also aggregate these large storehouses of data and analyze them to identify threats.

You are a network security administrator for the medium sized business XYZcorp. You often use network flow data to uncover anomalous security events. This challenge provides some sample aggregated data on flows, and uses answers from the anomalous events to construct the flag.

So how do we detect this? Similar to the previous section, there is a recurring theme: model different types of network activities separately. If you can identify distinct groups in the network traffic, then try to analyse them separately. It is easier to detect outliers if your data is identically distributed.

The initial host that the attacker controls may not have access to the data that the attacker wants. The attacker then has to explore and navigate through the network, through different hosts and accounts until he reaches the final objective. This might be something we can detect given the right vantage points

The volume, velocity, and variety of the data is increasing by the day! We are able to capture thousands of security events each month, but what can we do with all this data? This is where data analysis comes into the picture. It can help us analyze very large amounts of data to perform critical function, including:

In order to analyze this data and extract meaningful information from it, we need to learn the right skills. In this blog post, we are going to explore how we can use data analysis in order to help with Cyber Security. This blog post will introduce you to a brand-new learning lab on Cisco Secure Network Analytics that will show you what Python Pandas is all about. Read more below to find out!

At Cisco, we have a solution called Secure Network Analytics (formerly known as Cisco Stealthwatch). It helps us gain visibility on the network, perform network traffic analysis, and detect anomalies.

Secure Network Analytics is a visibility and network traffic analysis solution that uses telemetry from the enterprise network. As an administrator, you get end-to-end visibility into traffic and a total visibility across every security touchpoint. Moreover, Secure Network Analytics runs multi-layered machine learning models and advanced behavioral analytics, which allows us to always know who is on our network and what they are doing.

Python Pandas is an open-source Python library for data analysis and data wrangling. What makes Pandas so unique is that it transforms data into a Python object with rows and columns called a DataFrame that looks very similar to a table. This proves to be much easier to work with instead of the usual lists and dictionaries that we commonly see in Python. Look how easy the example below is:

Using Pandas, you can easily clean up the data and transform the data types into the desire data types that you can work with. Moreover, you can perform statistical analysis on the columns and transform columns by grouping them by a certain parameter. Overall, it helps us in quickly cleaning up the data, visualize and analyze the data. Below is an example of how to clean the data and the visualize it:

Pandas proves to be a great library for analyzing the vast amounts of data that we collect on our networks. Using Pandas, we can quickly clean up, visualize and analyze the data. We have created a Learning Lab where you can try out Pandas yourself using data collected from Cisco Secure Network Analytics

In the learning lab, we use a dataset that is derived from a Cisco Secure Network Analytics flow search query export. Because Secure Network Analytics has a database with all transactions (flows) that happened in the network, you can perform precise search queries. This precision can be crucial during forensic research into cyber attacks.

By the close of 2016, "Annual global IP traffic will pass the zettabyte ([ZB]; 1000 exabytes [EB]) threshold and will reach 2.3 ZBs per year by 2020" according to Cisco's Visual Networking Index. The report further states that in the same time frame smartphone traffic will exceed PC traffic. While capturing and evaluating network traffic enables defenders of large-scale organizational networks to generate security alerts and identify intrusions, operators of networks with even comparatively modest size struggle with building a full, comprehensive view of network activity. To make wise security decisions, operators need to understand the mission activity on their network and the threats to that activity (referred to as network situational awareness). This blog post examines two different approaches for analyzing network security using and going beyond network flow data to gain situational awareness to improve security.

Network flow data is aggregated packet header data (but no content capture) for a communication between a source and a destination. Communications are distinguished by the protocol-level information in the header and the proximity in time (i.e., a flow contains aggregated header information for all packets that use the same protocol settings within a designated time window). There are several reasons that network flow data is a useful format for analyzing network traffic:

• The lack of specific details regarding the content of a specific piece of traffic makes the collection of network flow highly concise. Network flow enables analysts to record the presence of a communication in a very small footprint, which means the data can be collected economically across a large network and stored for months to years (and also limits or eliminates personally identifying information [PII]).

• Network flow contains sufficient indicative information to allow network defenders to perform a variety of analyses to search for threats or context information that can help defenders understand what is going on. For example, when examining web traffic, network flow data would contain the source and destination IP addresses involved, the amount of data sent, the number of packets, and the time duration of the communication. Most web traffic from server to client is quick, with high byte volume and relatively modest numbers of packets (since the server is sending relatively full packets to the client). If traffic from server to client involves more modest byte volumes and higher numbers of packets over a longer timeframe, then it can be questioned as to whether it is normal web traffic. If such abnormal flows occur in patterns outside of normal workday patterns, then suspicions would be raised further. On the other hand, network defenders and analysts must have enough context to identify key websites for users and make sure that they are not blocked. Network flow can also be used to identify a likely source of a spam email within a five-minute window of its arrival on a network and implement remediation. For example, a rolling block can reduce spam traffic by as much as 75 percent by rapidly blocking out the source IP address, even for short periods of time.

041b061a72