Continuous Monitoring on a Budget: OpenWRT, Python, Documented Analytic Tradecraft, and the Cloud

No ratings

Presented at BSidesAtlanta 2019 by

Ryan Wilson

Continuous monitoring sounds intimidating, needing fancy and expensive sensors and software (hardware network taps? SIEM? SOAR?) to make it work. Cost sometimes puts these tools out of the realm of the possible for cybersecurity analysts and analysts in-training wanting to secure home and small business setups. If willing to invest time instead of money, we can use free and inexpensive tools to achieve the same end. I’ll provide an overview of a continuous monitoring system built on open-source tools (e.g. Docker, OpenVPN, Apache NiFi) and cheap hardware sensors (OpenWRT routers!) to collect data. I’ll then focus on how I use Google’s cloud storage, cloud processing, and a custom tradecraft documentation tool (similar to Jupyter Notebook) for capturing the Python and PowerShell scripts used for analysis. I’ll share what worked and what didn’t work in developing and operating this system. Specifically, I’ll highlight what data I’m collecting from my sensors and systems, how I collect it (using OpenWRT, Python, and Powershell), where I’m storing it, and how I analyze it. I’ll demonstrate how to fit these pieces together for implementing and monitoring some of the CIS Top 20 Controls.