Xiphos: Passive Security Posture Assessment of Remote Networks

To counter modern cyber threats, security administrators implement “defense in depth” strategies that involve the deployment of various security controls, such as firewalls and endpoint detection and response software. Despite these efforts, the actual security posture of an organization often remains unknown until it gets compromised. In large networks, this problem is exacerbated due to the involvement of multiple (often third-party) entities responsible for configuring, managing, and monitoring the deployed security controls and policies. It is therefore important to be able to quickly assess a third-party network’s security posture in a way that i) does not require any special access to the network, to allow for rapid and independent assessment; ii) does not impact the operation of the network, to avoid any service disruption or degradation; and iii) remains invisible to any existing monitoring systems, to avoid false alerts and misdirection attempts. The goal of the proposed project is to develop Xiphos, a novel passive network monitoring system for remotely assessing the security posture of third-party networks. Xiphos will be capable of directly observing and indirectly inferring network-level indicators that reveal a range of characteristics related to the “security hygiene” of a network. These include i) the presence of security controls, such as firewalls, intrusion detection/prevention systems, and endpoint monitoring software, as well as their operational configuration; ii) the up-to-date patching status and version level of critical software, such as operating systems and web browsers, as well as the deployment and configuration of recommended security practices (e.g., two-factor authentication); and iii) anti-patterns indicative of risky behavior, such as insecure access to third-party cloud resources, direct remote desktop or SSH sessions, internal devices or services unnecessarily exposed to the Internet, and connections to well-known malicious hosts. To collect these network-level indicators, Xiphos will support a spectrum of passive network monitoring data of varying discriminatory capacity, ranging from DNS traffic and NetFlow summaries, to network packet payloads. Given the deployment complexities of deep packet inspection sensors, an important focus of Xiphos is the development of fingerprinting technologies based solely on coarse-grained network data. To that end, we will develop IP-based and DNS-based fingerprinting techniques for the identification of security controls, software configurations, and risky behavior anti-patterns. Support for fingerprinting based on different but complementary data sources is a key advantage of Xiphos, which allows for flexibility in both sensor placement, according to the available vantage point(s), as well as in assessment fidelity, according to the available network monitoring capabilities.