โจมตีการเฝ้าระวังความปลอดภัยเครือข่าย (Network Security Monitoring) และการป้องกัน

Network Security Monitoring (NSM) คืออะไร?

Network Security Monitoring (NSM) เป็นกระบวนการ เก็บรวบรวม (Collection), วิเคราะห์ (Analysis), และตอบสนอง (Response/Escalation) ต่อข้อมูลกิจกรรมบนเครือข่าย เพื่อ ตรวจจับการบุกรุก (Intrusion Detection) และ ภัยคุกคามภายใน (Insider Threats) ก่อนที่จะก่อให้เกิดความเสียหายรุนแรง

แนวคิดหลัก: "Prevention Eventually Fails" (การป้องกันจะล้มเหลวที่สุด) -> ต้องมี Visibility และ Detection ที่ดี (Richard Bejtlich, TaoSecurity)

ประเภทการโจมตีที่ NSM ต้องตรวจจับ (Attack Types Targeting Monitoring)

ประเภทการโจมตี	คำอธิบาย	NSM Detection Approach
Blind Spot Exploitation	โจมตีผ่านช่องว่างที่ไม่มี Sensor/Log (Unmonitored VLAN, Shadow IT, Encrypted Traffic без Decryption, IoT/OT Networks)	Network Mapping, Asset Discovery, Encrypted Traffic Analysis (ETA), Sensor Placement Optimization
Log Tampering / Evading Logging	Attacker ปิด Log, ลบ Log, แก้ไข Timestamp, Flood Logs (Log Flooding/DoS), Syslog Tampering	Immutable Log Storage (WORM, Cloud Object Lock), Remote Logging (Syslog TLS, Forwarder), Log Integrity Monitoring (FIM on Log Files), Alert on Log Volume Drop
Encrypted Channel Abuse	ใช้ TLS/SSL/SSH/VPN/QUIC/DOH สำหรับ C2, Data Exfil, Malware Delivery หลบ Signature-based IDS	SSL/TLS Inspection (Selective, Policy-based), TLS Fingerprinting (JA3/JA3S), SNI Analysis, Certificate Transparency Monitoring, Behavioral Analysis (Flow Metadata, Byte Frequency, Packet Timing)
Living off the Land (LotL)	ใช้ Built-in Tools (PowerShell, WMI, PsExec, RDP, SSH, Certutil, Bitsadmin, Rundll32, MSHTA) สำหรับ Lateral Movement, Persistence, Execution	Process Command-line Logging (Sysmon, EDR), Network Behavior Baselining (SMB, RPC, WinRM, SSH Patterns), User/Entity Behavior Analytics (UEBA)
Low-and-Slow Attacks	Data Exfiltration, Credential Brute-force, Recon แบบช้าๆ ต่ำกว่า Threshold การตรวจจับแบบ Threshold-based	Statistical Anomaly Detection (ML/UEBA), Long-term Baselining, Entropy Analysis, DNS Tunneling Detection (NXDOMAIN Rate, Subdomain Entropy, Query Length)
Supply Chain / Trusted Path Compromise	โจมตีผ่าน Vendor Update, CI/CD Pipeline, Managed Service Provider, Trusted Partner Connection	Software Bill of Materials (SBOM), Code Signing Verification, Vendor Access Monitoring (PAM), Third-party Risk Scoring, Network Segmentation for Vendor Access
Insider Threat (Malicious/Negligent)	พนักงานขโมยข้อมูล, ทำลายระบบ, ส่งข้อมูลออก (Cloud Storage, Email, USB, Print)	DLP (Network/Endpoint/Cloud), UEBA (Access Patterns, Working Hours, Data Volume), Privileged Access Monitoring (PAM Session Recording)

NSM Data Sources (Data Plane) - "Fuel" สำหรับการตรวจจับ

Full Packet Capture (PCAP): 100% Visibility, Retrospective Analysis, Forensics - ต้องการ Storage/Compute มาก (Arista, NetScout, Corelight, Moloch/Arkime, Zeek/PCAP)
Flow Data (NetFlow v5/v9, IPFIX, sFlow): Metadata (5-tuple, Bytes, Packets, Flags, Timestamps) - Scalable, Long Retention, Good for Anomaly/Volume - ไม่เห็น Payload
Logs (Syslog, SNMP Traps, API, Cloud Logs): Firewall, Proxy, DNS, DHCP, VPN, NAC, Wireless Controller, Cloud (VPC Flow Logs, CloudTrail), Applications
Endpoint Telemetry (EDR/XDR): Process, Network Connections, File, Registry, Memory - ความละเอียดสูงสุด แต่เป็น Host-centric
Threat Intelligence Feeds: IP/Domain/Hash/URL Reputation, MITRE ATT&CK Tags, Vulnerability Data (STIX/TAXII, Commercial, Open Source)

NSM Architecture Patterns

Pattern	Description	Pros	Cons
Centralized (SIEM-centric)	Logs/Flows -> Central SIEM (Splunk, Sentinel, Elastic, QRadar) -> Correlation, Alerting, Investigation	Single Pane, Mature Ecosystem, Compliance Reporting	Cost (Volume-based Licensing), Latency, Encrypted Traffic Blindness
Distributed (NDR + Sensor Grid)	Sensors (Physical/Virtual/Cloud) at Key Segments -> Local Analysis (ML/Behavioral) -> Alerts/Metadata -> Central Console	Encrypted Traffic Analysis, Real-time, Scalable, Reduced Central Load	Sensor Management Overhead, Cost per Sensor, Integration Complexity
Hybrid (Modern Best Practice)	NDR for Network Behavior/Encrypted Traffic + SIEM for Log Correlation/Compliance + XDR for Endpoint + SOAR for Automation	Best Coverage, Defense in Depth, Specialized Tools	Integration Effort, Multiple Vendor, Skill Gap, Cost
Cloud-native (Cloud Provider Native)	VPC Flow Logs -> Cloud SIEM (GuardDuty, Sentinel, Chronicle, Security Command Center) + Cloud NDR (ExtraHop Reveal(x) Cloud, Vectra Cloud)	Native Integration, Serverless, Auto-scale, Cloud Context	Vendor Lock-in, Limited On-prem/Other Cloud Visibility, Cost at Scale

NSM Tools Landscape (2024)

Open Source / Free: Zeek (Bro) (Protocol Analysis, Scripting), Suricata (IDS/IPS/NSM), Wazuh (EDR + Log + Compliance), Elastic Stack (ELK) (SIEM), Moloch/Arkime (PCAP Indexing/Search), Security Onion (Distro: Zeek+Suricata+Elastic+Playbooks), Grafana + Loki/Tempo/Pyroscope + Prometheus (Observability + Security)
Commercial NDR: ExtraHop Reveal(x), Vectra AI, Darktrace, Corelight (Zeek-based), Arctic Wolf, Stamus Networks, NetWitness
SIEM Leaders: Splunk, Microsoft Sentinel, Elastic Security, IBM QRadar, LogRhythm, Securonix, Exabeam, Devo, Panther
XDR/EDR: CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Cortex XDR, Trend Vision One, FortiEDR
SOAR: Cortex XSOAR, Splunk SOAR, FortiSOAR, Siemplify (Google), Tines, Phantom (Legacy)

การป้องกันการโจมตี NSM เอง (Protecting the Monitoring Infrastructure)

Isolate Management Plane: Dedicated Management Network (OoB), Jump Hosts/PAW, No Direct Internet Access
Harden Sensors/Collectors: Minimal OS (Container/Appliance), Disable Unused Services, Auto-update, Immutable Infrastructure
Encrypt All Channels: TLS 1.3 for API/Syslog/Log Forwarding, IPsec/MACsec for Sensor-Collector Links
Integrity & Authenticity: Signed Logs/Configs, GitOps for Config, Immutable Log Storage (WORM, Object Lock, Blockchain-anchored)
Access Control: RBAC, MFA, Just-in-Time (JIT), PAM for Admin Access, Service Accounts Least Privilege
Monitor the Monitors: Health Checks (Heartbeat, Throughput, Disk/CPU/Mem), Self-monitoring Alerts, Redundancy (HA Clusters)
Data Protection: Encryption at Rest (AES-256), Tokenization/Anonymization for PII, Retention Policies, Legal Hold
Supply Chain Security: Signed Images (Cosign/Sigstore), SBOM Verification, Vendor Risk Assessment, Air-gapped Updates Option

Metrics สำหรับวัดประสิทธิภาพ NSM (NSM Effectiveness Metrics)

Coverage: % Network Segments Monitored, % Traffic Decrypted, % Assets Visible
Detection Rate: True Positives / (True Positives + False Negatives) - ต่อ MITRE ATT&CK Technique
False Positive Rate: False Positives / Total Alerts
MTTD (Mean Time to Detect): เวลาเฉลี่ยตั้งแต่เกิด Incident จน Detect
MTTRI (Mean Time to Triage/Investigate): เวลาเฉลี่ยตั้งแต่ Alert จน Analyst เริ่มสืบสวน
Alert Fatigue Index: Alerts per Analyst per Shift
Data Quality: % Parsing Errors, % Missing Fields, Timestamp Accuracy

สรุป

Network Security Monitoring (NSM) เป็น ตาและหูขององค์กร บนเครือข่าย การโจมตี NSM มุ่งสร้าง Blind Spots, Evade Detection, Tamper Evidence, และ Abuse Trust การป้องกันต้องการ:

Comprehensive Data Sources: PCAP + Flow + Logs + Endpoint + Intel (No Single Source of Truth)
Layered Detection: Signature + Anomaly/Behavioral (ML/UEBA) + Threat Hunting + Threat Intel Matching
Encrypted Traffic Visibility: Selective Decryption + TLS Fingerprinting + Behavioral Flow Analysis
Resilient Monitoring Infrastructure: Hardened, Isolated, Encrypted, Monitored, Immutable Logs
Automated Enrichment & Response (SOAR): Reduce MTTD/MTTR, Combat Alert Fatigue
Continuous Improvement: Purple Teaming, Detection Engineering, Rule Tuning, Coverage Gap Analysis

"You can't protect what you can't see. You can't detect what you don't monitor. You can't respond to what you don't detect."