BSidesAtlanta 2019 - Ryan Wilson - Continuous Monitoring
Channel: BSidesATL
Date: 24/06/2019

Continuous monitoring sounds intimidating, needing fancy and expensive sensors and software (hardware network taps? SIEM? SOAR?) to make it work. Cost sometimes puts these tools out of the realm of the possible for cybersecurity analysts and analysts in-training wanting to secure home and small business setups. If willing to invest time instead of money, we can use free and inexpensive tools to achieve the same end. I’ll provide an overview of a continuous monitoring system built on open-source tools (e.g. Docker, OpenVPN, Apache NiFi) and cheap hardware sensors (OpenWRT routers!) to collect data. I’ll then focus on how I use Google’s cloud storage, cloud processing, and a custom tradecraft documentation tool (similar to Jupyter Notebook) for capturing the Python and PowerShell scripts used for analysis. I’ll share what worked and what didn’t work in developing and operating this system. Specifically, I’ll highlight what data I’m collecting from my sensors and systems, how I collect it (using OpenWRT, Python, and Powershell), where I’m storing it, and how I analyze it. I’ll demonstrate how to fit these pieces together for implementing and monitoring some of the CIS Top 20 Controls. 

Ryan is a cybersecurity professional, instructor, and entrepreneur. He has served the U.S. Government with his expertise for over 10 years. More recently, he has started consulting with small businesses and families to help them protect themselves from the cyberspace things that keep them up at night. When not nerding around (he really likes programming!), he loves shaping his children (a.k.a. parenting), kayaking, camping, and biking. And he recently achieved a childhood dream of computerizing his Christmas light display and syncing them to music with his Raspberry Pi. Soli Deo Gloria.