2

We have a SOC which "monitors" our network activity, it basically collects all logs from all our firewalls and creates reports.

We have a huge network with hundreds of servers and upto 2000 users, and all our subnets/branches are firewalled. These firewalls feed into arcsight at the SOC which in turn come back to us as reports.

These reports contain all source:port and dest:port info from all our subnets.

I checked this data and see that a lot of these ports are classified as "trojan", "threat" etc. At the same time a lot of these are required for daily uses.

What then are the best practices deal with this?

4

Verify that the reported host runs a legitimate application on the port.

For example, port 8080tcp is the default alternative port for HTTP. It is used by many legitimate applications.

Look up what the destination host is supposed to be running in your configuration management database (you do have a CMDB, do you?). When it is supposed to run, for example, an Apache Tomcat application server (which uses port 8080), this is intended behavior and harmless. Verify that the Tomcat server is actually working. When it does, it means that the port is in use and can not be used by any malware without having to kill the Tomcat process, and that would cause whoever needs it to complain. Add a filter rule to your reporting system to prevent further reports about that server and port 8080 to show up. Such filter rules are important because any false-positives which show up in your reports just distract from any actual positives. You might also want to add a rule to your reporting system which generates an alert when that ip:port combination does not show up anymore. It would either mean that the server is down or that it was repurposed to no longer run that application and you need to update your filter rules and your CMDB.

However, When you find that port open on a host which isn't supposed to run anything which might use 8080, that's worth investigating. Log into the server, run netstat and check what application opened that port. Then use your own judgment to decide if it is legitimate or not.

  • I am from the "security" team and haven't come across an CMDB yet, is it something which would be something under the "server" team? It just didn't strike me that once the port is in use by an app, any malware can't use it, thanks for that. – allwynmasc Aug 4 '16 at 6:11
  • @allwynmasc When your job is to ensure security in your network you need to know what's going on in it. When you don't know what each server is supposed to be doing, you can't tell when it starts to do something it's not supposed to be doing. The server admins should have a CMDB or some other kind of documentation about what they deployed on which of your hundreds of servers. The security team needs access to that information. – Philipp Aug 4 '16 at 7:34
  • Hi just a side question here, we only allow minimum ports to access the internet from inside the network like port80 and 443. So does that mean any trojans using any other ports to communicate outside will just lie there and not cause any harm? Also how come the malware developers do not use port80 and 443 itself as it's obvious those are open ones, but then there's browsers which use port80 all the time, does that mean any malware using port80 will never be able to do so because the browser process will always keep port80 "busy"?. – allwynmasc Sep 16 '16 at 7:09
  • 1
    @allwynmasc In case I wasn't clear enough: a webserver which runs on a host keeps port 80 busy. A webbrowser running on a host does not. A browser connects to port 80 on other hosts. The browser also opens a port for receiving the reply from the webserver (keeping that port "busy" while waiting for the reply), but that's a random port from the ephemeral port range (49151 - 65535). – Philipp Sep 16 '16 at 9:38
  • 1
    @allwynmasc Can you open Firefox, Internet Explorer and Chrome at the same time? Can you download files with all of them at the same time? If they can, so can a trojan. – Philipp Sep 16 '16 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.