Logging ALL THE THINGS Without All the Cost With Open Source Big Data Tools
Zach Fasel explores logging all the things without all the cost with open source big data tools at DEF CON 22, examining log-aggregation and practical defenses.
Summary
Architecture and Background
Logging ALL THE THINGS Without All The Cost With Open Source Big Data Tools Zack Fasel Managing Partner, Urbane Security Many struggle in their job with the decision of what events to log in battle against costly increases to their licensing of a commercial SIEM or other logging solution. Leveraging the open source solutions used for "big-data" that have been proven by many can help build a scalable, reliable, and hackable event logging and security intelligence system to address security and (*cringe*) compliance requirements.
Vulnerability Analysis
We’ll walk through the various components and simple steps to building your own logging environment that can extensively grow (or keep sized just right) with just additional hardware cost and show numerous examples you can implement as soon as you get back to work (or home). Zack Fasel is a Founding Partner at Urbane Security, a solutions-focused vendor-agnostic information security services firm focusing on providing innovative defense, sophisticated offense and refined compliance services.
Exploitation and Demonstrations
Heading up Urbane's Research and Security Services divisions, Zack brings his years of diverse internal and external experience to drive Urbane's technical solutions to organizations top pain points. His previous research and presentations at conferences have spread across numerous domains including Windows authentication flaws, femtocells, open source defensive security solutions and unique network and application attack vectors.
Remediation and Defensive Strategies
When not selling out, he can be found lost in the untz unce wubs, dabbling in instagram food photography, or eating scotch and drinking gummy bears (that's right, right?). More information on him can be found at zfasel.com and on Urbane Security at UrbaneSecurity.com.
Related talks
Main Stage·41 min
Kai Zhong
Kai Zhong introduces 411, an open-source alert management framework built on top of Elasticsearch to curate high-fidelity security alerts and minimize alert fatigue.
PROIDEA Events·40 min
Szymon Kozak
Szymon Kozak examines CONFidence 2019: "SIEM według potrzeb: Elasticsearch, Energy Logserver, Wazuh...".
37th Annual FIRST Conference·31 min
Analysts investigate attack surfaces and defenses concerning Breaking the SIEM Confinement.


