Taishaun_OwnensCNS-533_Lab
- 1. Enterprise Security Infrastructure Controls and Regulatory Compliance IS-533 LABIS-533 LAB Purpose The primary purpose of this lab is to expose the students to network security monitoring and the level of details that security standards sometimes require. The secondary purpose of this lab is to assist in the creation of the final standard for logging. The lab has been created in three parts: Part 1: Create two client virtual machines to monitor with Security Onion Part 2: Create a Security Onion virtual machine and install Splunk Part 3: Test network settings and explore Security Onion via Splunk Depending on the type of system you will be using, these labs may take some time to complete. Specifically, the installation and then update of Security Onion will take over 30 minutes on some systems. Plan accordingly. Please post any questions to the Course Discussion Forum. These instructions were written as the lab was built, so there may be errors. Posting to the forum will allow everyone to adjust the lab. Requirements Download VMware for your system at the CDM - VMware software store http://e5.onthehub.com/WebStore/ProductsByMajorVersionList.aspx?ws=b2c0cd57-97e2-de11-a13b-0030487d8897&vsro=8&JSEnabled=1 Download the 32 bit version of the Ubuntu Desktop for your test systems. Do not apply any updates. Once Security Onion is configured and running, this will be traffic that can be observed. The Desktop version will be easier to download other software such as Nmap and Nessus. The Ubuntu systems will be configured using NAT within VMware Workstation/Fusion http://www.ubuntu.com/download Download Security Onion and note that it is a 64 bit distribution. If the laptop/desktop being used for this lab cannot run it within VMware Workstation/Fusion, follow the install guide for downloading and installing the Security Onion packages onto the 32 bit version of Ubuntu Desktop. http://code.google.com/p/security-onion/wiki/Installation http://sourceforge.net/projects/security-onion/files/12.04.3/ IS-533 Lab Page 1 of 15
- 2. Enterprise Security Infrastructure Controls and Regulatory Compliance Part 1 Virtual Machine Setup Each dialog window has a button to proceed through the configuration of the virtual machines (VM). The instructions assume that once the appropriate fields are entered or selected, the student will click on the appropriate button. Open VMware Workstation/Fusion and create two VMs First VM 1. Navigate the menu and select Create New Virtual Machine 2. Choose Custom IS-533 Lab Page 2 of 15
- 3. Enterprise Security Infrastructure Controls and Regulatory Compliance 3. Accept the Hardware Compatibility defaults 4. Choose Installer disc image file (iso) and navigate to the folder where you downloaded the iso image and select it 5. Complete the Easy Install User Information 6. Enter the computer name - ubuntu-1 or anything you will remember (so you can distinguish between the systems in Security Onion 7. Accept the Processor defaults IS-533 Lab Page 3 of 15
- 4. Enterprise Security Infrastructure Controls and Regulatory Compliance 8. Accept the Memory defaults 9. Choose Use network address translation (NAT) 10. Accept the I/O Controller defaults 11. Select Create New Virtual Disk 12. Accept the Default Type 13. Accept the Default for the size - Note: For the lab you will not need more than the default size provided 14. Accept the Disk file name 15. Click Finish to begin the O/S install - Note: Depending on the speed of your system, the install may take longer. 16. Upon completion of the VM creation, Logon and launch Terminal 17. Type ifconfig and press enter a. Enter the First VM's IP address here: 192.168.60.128 18. Follow these steps to create your second VM a. Enter the second VM's IP address here: 192.168.60.130 19. Test Internet browsing IS-533 Lab Page 4 of 15
- 5. Enterprise Security Infrastructure Controls and Regulatory Compliance Part 2 Security Onion Setup 1. Navigate the menu and select Create New Virtual Machine 2. Choose Custom 3. Accept the Hardware Compatibility defaults 4. Choose the Security Onion Installer disc image file (iso) and navigate to the folder where you downloaded the iso image and select it IS-533 Lab Page 5 of 15
- 6. Enterprise Security Infrastructure Controls and Regulatory Compliance 5. Use the down arrow to display the Version choices and select Other Linux 2.6.x kernel 64- bit 6. Enter "Security_Onion" for the Virtual Machine Name 7. Accept the Processor defaults 8. Accept the Memory defaults (Use 1024MB if possible) 9. Choose Use network address translation (NAT) (VMware automatically defaults to NAT) 10. Accept the I/O Controller defaults 11. Select Create New Virtual Disk 12. Accept the Default Type IS-533 Lab Page 6 of 15
- 7. Enterprise Security Infrastructure Controls and Regulatory Compliance 13. Change the Maximum disk size to 20 GB if possible 14. Accept the Disk file name 15. Click Finish Note: The installation of Security Onion will not start until the VM is powered on. 16. Click VM on Tool Menu and Select Settings 17. Click Add and if prompted by Security Notification, accept it 18. Click Add 19. Click Network Adapter and click Next IS-533 Lab Page 7 of 15
- 8. Enterprise Security Infrastructure Controls and Regulatory Compliance 20. Ensure that NAT: Used to share the host's IP address is selected 21. Click Finish 22. Click OK to exit Virtual Machine Settings 23. Click Power on this virtual machine 24. Select install - start the installer directly Note: Depending on the amount RAM and speed of the system, Security Onion may take some time to load 25. Double-Click on Install Security SecurityOnion 12.04 icon 26. Choose language 27. Click Continue without selecting any options on Preparing to install SecurityOnion 28. Select Erase disk and install SecurityOnion 29. Confirm time settings 30. Confirm Keyboard layout 31. Enter User Information Note: For this lab, select Log in automatically to save time updating Security Onion. This lab will be done on an isolated network. This setting is normally not selected as a good security practice. 32. Click Restart Now Note: If you didn’t select auto-logon, you will need to logon to continue 33. Double-click on the Terminal Emulator icon on the Desktop 34. Type sudo apt-get update && sudo apt-get dist-upgrade 35. Type your password IS-533 Lab Page 8 of 15
- 9. Enterprise Security Infrastructure Controls and Regulatory Compliance 36. Type Y to continue 37. Type sudo reboot 38. Enter the password you entered during the install Note: If you didn’t select auto-logon, you will need to logon to continue 39. Double-click on the Setup Icon on the Desktop to begin configuring Security Onion 40. Enter the password you entered during the install 41. Click Yes, Continue 42. Click Yes, configure /etc/network/interfaces 43. Click on eth0 for the management interface 44. Click on DHCP 45. Check the box next to eth1 for the interface used for sniffing 46. Click Yes, make changes and reboot! Note: If you didn’t select auto-logon, you will need to logon to continue 47. Double-click on the Setup Icon on the Desktop to continue configuring Security Onion 48. Click Yes, to continue 49. Click Yes, skip network configuration! 50. Select Advanced Setup 51. Select Standalone 52. Enter a Sguil username 53. Enter an email address for Snorby 54. Enter a password that will be used for Sguil, Squert, Snorby and ELSA (ELSA won't be used for this lab) 55. Confirm your password 56. Select Snort 57. Select Emerging Threats GPL 58. Select eth1 59. Click Yes, enable the IDS engine 60. Click Yes, enable Bro 61. Click Yes, enable http_agent 62. Click Yes, enable Argus 63. Click Yes, enable Prads 64. Yes, enable full packet capture 65. Accept the default for the pcap files 66. Accept the default disk usage size IS-533 Lab Page 9 of 15
- 10. Enterprise Security Infrastructure Controls and Regulatory Compliance 67. Click No, disable ELSA 68. Click Yes, proceed with the changes 69. Click OK to complete the setup 70. Click OK to acknowledge the Security Onion configuration 71. Click OK to acknowledge support options 72. Security Onion is now configured 73. Open a browser in Security Onion and go to www.splunk.com Note: Splunk Enterprise 6 was released while creating this lab. There is an option for downloading older versions. These instructions were written for the version below. 74. Click Free Download 75. Click on Splunk-5.0.5-179365-linux-2.6-amd64.deb or the 32 bit version 76. Register with Splunk 77. Note: Splunk will not send emails except to "thank you" for downloading it. Remember the password that is created with this step. 78. Click on Splunk-5.0.5-179365-linux-2.6-amd64.deb splunk-6.2.1-245427-linux-2.6-amd64.deb or the 32 bit version 79. Click on Save file 80. When the download is complete, close the browser and Double-click on Terminal Emulator 81. Type cd Downloads 82. Type sudo dpkg -i splunk-6.2.1-245427-linux-2.6-amd64.deb Enter your password 83. Type sudo /opt/splunk/bin/splunk start 84. Press Enter down until License agreement has been completed 85. Type Yes to agree with the license 86. sudo /opt/splunk/bin/splunk enable boot-start 87. Close the Terminal window 88. Open the browser 89. Navigate to localhost:8000 90. Enter admin and changeme to login 91. Create a Splunk admin password 92. Click on Manager (top right on menu) 93. Click on Apps 94. Click on Find more apps online 95. In the search field type Security Onion 96. Click on Read more IS-533 Lab Page 10 of 15
- 11. Enterprise Security Infrastructure Controls and Regulatory Compliance 97. Click on the Documentation tab 98. Scroll down to Required Splunk Apps: 99. Right-click on each of the Apps, and select Open in new tab 100. Click the Download button and accept the license agreements when prompted 101. Save each file (they will be save to the Downloads folder) 102. Navigate back to the Manager 103. Click on Apps 104. Click on Install app from file 105. Browse to the %user%Downloads folder and select a file 106. Click Upload 107. Do this for each App - Ignore the restart message until all Apps are installed 108. Click on the Download for Security Onion and install it 109. Click Restart Splunk IS-533 Lab Page 11 of 15
- 12. Enterprise Security Infrastructure Controls and Regulatory Compliance Part 3 1. Double-click on the Terminal Emulator icon 2. Type sudo wireshark 3. Enter your password 4. Choose OK to accept the warning about running Wireshark as root Note: There is a secure configuration for running Wireshark that should be undertaken for production systems. 5. Start capturing on Eth0 6. In the Filter box, type ICMP and click Apply 7. In one of the Ubuntu systems, open a terminal and ping the other one 8. Insert a print screen of your Wireshark capture here: 9. Browse to http://localhost:8000 10. Login using Admin and the password you defined 11. Navigate to the Security Onion App 12. Insert a Print Screen of the Overview page here: IS-533 Lab Page 12 of 15
- 13. Enterprise Security Infrastructure Controls and Regulatory Compliance IS-533 Lab Page 13 of 15
- 14. Enterprise Security Infrastructure Controls and Regulatory Compliance 13. Open the Snorby page from Security Onion. If there is an error, correct the URL to https://localhost:444 14. Add an exception to your browser's security 15. Login using the email address and password you provided during the install 16. Insert a print screen of the Snorby Dashboard here: 17. Exit Wireshark without saving the capture 18. Open the Squert page. If there is an error, correct the URL to https://localhost/squert/login.php 19. Insert a print screen of the Squert Dashboard here: IS-533 Lab Page 14 of 15
- 15. Enterprise Security Infrastructure Controls and Regulatory Compliance 20. Start your Ubuntu virtual machines 21. Apply the security updates on both systems 22. Observe the changes to the Overview, Snorby and Squert Dashboards 23. This completes the lab. Make sure each virtual machine is closed down cleanly. IS-533 Lab Page 15 of 15