Craig Bird - Network Forensics: the importance of network visibility for security operations

### Overview In this talk, Craig Bird, a pre-sales consultant for RSA specializing in cybersecurity portfolio products and Security Operations Center (SOC) solutions, discusses the crucial role of network visibility and network forensics in enterprise defense. Drawing from experiences across 50 to 100 SOC environments, Bird highlights how organizations with large budgets and modern preventative tools continue to experience breaches. He argues that the overwhelming focus on prevention leaves a significant detection gap, emphasizing that monitoring, packet capture, and forensic session analysis are essential to spotting intrusions and understanding threat impact.

### Key Topics - **Prevention vs. Monitoring Imbalance**: Security budgets disproportionately favor preventative defenses (e.g., antivirus, firewalls), yet attackers still bypass these controls. Citing reports such as Mandiant's APT1 report (noting an average detection time of roughly 356 days), Bird emphasizes that organizations must accept the inevitability of breaches and invest in network monitoring and response. - **Threat Hunting and Control Validation**: Visibility allows defenders to uncover plain text credentials, policy-violating software (such as BitTorrent), and outbound anomalous traffic (e.g., unexpected POST requests without user agents or referrers, or unexpected destinations like Russia). It also serves as a ground truth check on the real-world efficacy of perimeter filtering. - **NetFlow vs. Full Packet Capture**: While NetFlow is useful for basic timing, performance, and volume tracking, it cannot answer detailed post-breach questions (such as precise start times, active status, or exact data taken). Full packet capture provides ground truth across the wire, though it presents immense scaling challenges, with daily capture volumes quickly reaching multiple terabytes or hundreds of terabytes on multi-gigabit interfaces. - **Session Analysis and Metadata Reconstruction**: Sifting through raw PCAP in tools like Wireshark across thousands of packets is inefficient at scale. Grouping traffic into session views, parsing protocol metadata (IP addresses, ports, hostnames, services), and reconstructing communications (such as emails, links, and payloads) streamlines investigation and reveals malicious activity.

### Technical Details Bird walks through an evaluation investigation involving a large enterprise with best-of-breed defenses, a managed SIEM, and an active SOC, capturing 32 terabytes across five days on a single choke point: - **Metadata Pivoting**: Filtering on top-level domains quickly revealed suspicious external requests querying `.su` and `.cc` TLDs with pseudo-randomly generated domain string prefixes, matching patterns detailed in a Dell SecureWorks white paper. - **User and Host Attribution**: Because the organization used proxy architecture with NTLM authentication to Blue Coat devices instead of Kerberos ticketing, the team extracted the user account and Active Directory workstation names directly from the wire. - **Reconstruction and Lateral Movement**: While external SSL sessions lacked man-in-the-middle decryption (showing only proxy CONNECT requests to the malicious hostnames), internal inspection revealed anomalous RPC and SMB traffic from the compromised endpoint to internal file and domain servers. A buffer overflow pattern was identified in the RPC traffic, leading to compromise of the destination servers. Data from user desktop and document backups was transferred back over SMB to the compromised endpoint and exfiltrated over the encrypted channel.

### Takeaways Preventative controls alone leave vast portions of the threat landscape uncovered. Security operations teams require deep visibility and session-level network forensics to validate defenses, investigate internal lateral movement, establish user accountability, and determine the true scope and impact of an intrusion. Bird concludes by highlighting the importance of reading foundational material, specifically citing the book *Network Forensics* for security practitioners.