NIST SPECIAL PUBLICATION 1800-26

---

Data Integrity:

Data Integrity:

Detecting and Responding to Ransomware and Other Destructive Events

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jennifer Cawthra

Michael Ekstrom

Lauren Lusty

Julian Sexton

John Sweetnam

FINAL

This publication is available free of charge from https://www.nccoe.nist.gov/projects/building-blocks/data-integrity/detect-respond.

NIST SPECIAL PUBLICATION 1800-26

Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jennifer Cawthra

National Cybersecurity Center of Excellence

NIST

Michael Ekstrom

Lauren Lusty

Julian Sexton

John Sweetnam

The MITRE Corporation

McLean, Virginia

FINAL

December 2020

U.S. Department of Commerce

Wilbur Ross, Secretary

National Institute of Standards and Technology

Walter G. Copan, Undersecretary of Commerce for Standards and Technology and Director

Volume A

• Executive Summary
  • Challenge
  • Solution
  • Benefits
  • Share Your Feedback
  • Technology Partners/Collaborators

Volume B

• 1 Summary
  • 1.1 Challenge
  • 1.2 Solution
  • 1.3 Benefits
• 2 How to Use This Guide
  • 2.1 Typographic Conventions
• 3 Approach
  • 3.1 Audience
  • 3.2 Scope
  • 3.3 Assumptions
  • 3.4 Risk Assessment
    • 3.4.1 Risk
    • 3.4.2 Security Control Map
  • 3.5 Technologies
• 4 Architecture
  • 4.1 Architecture Description
    • 4.1.1 High-Level Architecture
    • 4.1.2 Architecture Components
      • 4.1.2.1 Integrity Monitoring
      • 4.1.2.2 Event Detection
      • 4.1.2.3 Logging
      • 4.1.2.4 Mitigation and Containment
      • 4.1.2.5 Forensics/Analytics
      • 4.1.2.6 Reporting
• 5 Security Characteristic Analysis
  • 5.1 Assumptions and Limitations
  • 5.2 Build Testing
  • 5.3 Scenarios and Findings
    • 5.3.1 Ransomware via Web Vector and Self-Propagation
      • 5.3.1.1 Scenario
      • 5.3.1.2 Resolution
      • 5.3.1.3 Other Considerations
    • 5.3.2 Destructive Malware via USB Vector
      • 5.3.2.1 Scenario
      • 5.3.2.2 Resolution
      • 5.3.2.3 Other Considerations
    • 5.3.3 Accidental VM Deletion via Maintenance Script
      • 5.3.3.1 Scenario
      • 5.3.3.2 Resolution
      • 5.3.3.3 Other Considerations
    • 5.3.4 Backdoor Creation via Email Vector
      • 5.3.4.1 Scenario
      • 5.3.4.2 Resolution
      • 5.3.4.3 Other Considerations
    • 5.3.5 Database Modification via Malicious Insider
      • 5.3.5.1 Scenario
      • 5.3.5.2 Resolution
      • 5.3.5.3 Other Considerations
    • 5.3.6 File Modification via Malicious Insider
      • 5.3.6.1 Scenario
      • 5.3.6.2 Resolution
      • 5.3.6.3 Other Considerations
    • 5.3.7 Backdoor Creation via Compromised Update Server
      • 5.3.7.1 Scenario
      • 5.3.7.2 Resolution
      • 5.3.7.3 Other Considerations
• 6 Future Build Considerations
• Appendix A List of Acronyms
• Appendix B Glossary
• Appendix C References
• Appendix D Functional Evaluation
  • D.1 Data Integrity Functional Test Plan
  • D.2 Data Integrity Use Case Requirements
  • D.3 Test Case: Data Integrity DR-1
  • D.4 Test Case: Data Integrity DR-2
  • D.5 Test Case: Data Integrity DR-3
  • D.6 Test Case: Data Integrity DR-4
  • D.7 Test Case: Data Integrity DR-5
  • D.8 Test Case: Data Integrity DR-6
  • D.9 Test Case: Data Integrity DR-7

Volume C

• 1 Introduction
  • 1.1 Practice Guide Structure
  • 1.2 Build Overview
  • 1.3 Typographical Conventions
• 2 Product Installation Guides
  • 2.1 Active Directory and Domain Name System Server
    • 2.1.1 Install Features
    • 2.1.2 Create a Certificate Authority
    • 2.1.3 Configure Account to Add Computers to Domain
    • 2.1.4 Add Machines to the Domain
    • 2.1.5 Configure Active Directory to Audit Account Activity
    • 2.1.6 Configure Reverse Lookup Zones
  • 2.2 Microsoft Exchange Server
    • 2.2.1 Install Microsoft Exchange
  • 2.3 Windows Server Hyper-V Role
    • 2.3.1 Production Installation
  • 2.4 MS SQL Server
    • 2.4.1 Install and Configure MS SQL
    • 2.4.2 Open Port on Firewall
    • 2.4.3 Add a New Login to the Database
  • 2.5 Microsoft IIS Server
    • 2.5.1 Install IIS
    • 2.5.2 IIS Configuration
  • 2.6 Semperis Directory Services Protector
    • 2.6.1 Configure Active Directory for Semperis DSP
    • 2.6.2 Install Semperis DSP
    • 2.6.3 Roll Back Changes with Semperis DSP
    • 2.6.4 Configure Reporting with Semperis DSP
    • 2.6.5 Configure Email Alerts with Semperis DSP
  • 2.7 Glasswall FileTrust^TM for Email
    • 2.7.1 Install Prerequisites
      • 2.7.1.1 Install the IIS web server
      • 2.7.1.2 Install Microsoft SQL 2014 Enterprise
      • 2.7.1.3 Install Microsoft Visual C++ 2015
    • 2.7.2 Install the Glasswall FileTrust Server Component
      • 2.7.2.1 Install Glasswall Hub
      • 2.7.2.2 Install Glasswall Integration Service
      • 2.7.2.3 Install Glasswall Administrator Console
      • 2.7.2.4 Add the Server’s Certificate
      • 2.7.2.5 Install the Smtp Analysis Agent
      • 2.7.2.6 Distribute the Glasswall License File
    • 2.7.3 Configure Glasswall FileTrust
      • 2.7.3.1 Create a New Administrator Account
      • 2.7.3.2 Configure Notifications and Policies
      • 2.7.3.3 Configure Inbound SMTP Policy
      • 2.7.3.4 Create a Receiver Group
      • 2.7.3.5 Create a ThreatCensor Policy Set
      • 2.7.3.6 Create a Processing Rule
    • 2.7.4 Configure Intelligence Sharing
  • 2.8 Micro Focus ArcSight Enterprise Security Manager
    • 2.8.1 Install the ArcSight Console
    • 2.8.2 Install Individual ArcSight Windows Connectors
    • 2.8.3 Install Individual ArcSight Ubuntu Connectors
    • 2.8.4 Install a Connector Server for ESM on Windows 2012 R2
    • 2.8.5 Install Pre-Configured Filters for ArcSight
      • 2.8.5.1 Install Activate Base
      • 2.8.5.2 Install Packages
    • 2.8.6 Apply Filters to a Channel
    • 2.8.7 Configure Email Alerts in ArcSight
      • 2.8.7.1 Configure a New Destination
      • 2.8.7.2 Configure a New Rule
  • 2.9 Tripwire Enterprise
    • 2.9.1 Install Tripwire Enterprise
    • 2.9.2 Install the Axon Bridge
    • 2.9.3 Install the Axon Agent (Windows)
    • 2.9.4 Install the Axon Agent (Linux)
    • 2.9.5 Configure Tripwire Enterprise
      • 2.9.5.1 Terminology
      • 2.9.5.2 Tags
      • 2.9.5.3 Rules
      • 2.9.5.4 Tasks
  • 2.10 Tripwire Log Center
    • 2.10.1 Install Tripwire Log Center Manager
    • 2.10.2 Configure Tripwire Log Center Manager
    • 2.10.3 Install Tripwire Log Center Console
  • 2.11 Cisco Identity Services Engine
    • 2.11.1 Initial Setup
    • 2.11.2 Inventory: Configure SNMP on Routers/Network Devices
    • 2.11.3 Inventory: Configure Device Detection
    • 2.11.4 Policy Enforcement: Configure Active Directory Integration
    • 2.11.5 Policy Enforcement: Enable Passive Identity with AD
    • 2.11.6 Policy Enforcement: Developing Policy Conditions
    • 2.11.7 Policy Enforcement: Developing Policy Results
    • 2.11.8 Policy Enforcement: Enforcing a Requirement in Policy
    • 2.11.9 Policy Enforcement: Configuring a Web Portal
    • 2.11.10 Configuring RADIUS with your Network Device
    • 2.11.11 Configuring an Authentication Policy
    • 2.11.12 Configuring an Authorization Policy
  • 2.12 Cisco Advanced Malware Protection
    • 2.12.1 Dashboard Configuration
    • 2.12.2 Installing the Connector on a Windows Server
    • 2.12.3 Installing the Connector on a Windows 10 Machine
    • 2.12.4 Scanning using AMP
    • 2.12.5 Configure AMP Policy
  • 2.13 Cisco Stealthwatch
    • 2.13.1 Configure Stealthwatch Flow Collector, Stealthwatch Management Console, Stealthwatch UDP Director and Stealthwatch Flow Sensor
    • 2.13.2 Change Default Stealthwatch Console Passwords
    • 2.13.3 Configure the Stealthwatch Management Console Web Interface
    • 2.13.4 Configure the Stealthwatch UDP Director, Stealthwatch Flow Collector and Stealthwatch Flow Sensor Web Interfaces
  • 2.14 Symantec Analytics
    • 2.14.1 Initial Setup
    • 2.14.2 Capturing Data
  • 2.15 Symantec Information Centric Analytics
    • 2.15.1 Installing MS SQL 2017
    • 2.15.2 Install Windows Services
    • 2.15.3 Installing Symantec ICA
    • 2.15.4 Configuring Symantec ICA for Analysis
      • 2.15.4.1 Installing Integration Packs
      • 2.15.4.2 Create a View
      • 2.15.4.3 Open an Existing View
      • 2.15.4.4 Viewing Detailed Analyzer Data
  • 2.16 Integration: Cisco Identity Services Engine and Cisco Stealthwatch
    • 2.16.1 Configuring Certificates for pxGrid
    • 2.16.2 Configuring Stealthwatch to Quarantine through ISE
  • 2.17 Integration: Tripwire Log Center and Tripwire Enterprise
  • 2.18 Integration: Symantec ICA and ArcSight ESM
    • 2.18.1 Export the CSV File from ArcSight Console
    • 2.18.2 Import the CSV File to Symantec ICA
    • 2.18.3 Create a Mapping between ArcSight events and Symantec ICA
    • 2.18.4 View ArcSight Events in the Analyzer
  • 2.19 Integration: Micro Focus ArcSight and Tripwire
    • 2.19.1 Install Micro Focus ArcSight
  • 2.20 Integration: Micro Focus ArcSight and Cisco AMP
    • 2.20.1 Create API Credentials for ArcSight to access AMP
    • 2.20.2 Install Micro Focus ArcSight
    • 2.20.3 Create a Parser for Cisco AMP REST events
  • 2.21 Integration: Micro Focus ArcSight and Cisco ISE
    • 2.21.1 Configure Cisco ISE to Forward Logs
    • 2.21.2 Select Logs for Forwarding
  • 2.22 Integration: Micro Focus ArcSight and Semperis DSP
    • 2.22.1 Configure Semperis DSP to Forward Logs
  • 2.23 Integration: Micro Focus ArcSight and Symantec Analytics
    • 2.23.1 Configure Symantec Analytics to Forward Logs
    • 2.23.2 Install Symantec Analytics Package for ArcSight
  • 2.24 Integration: Micro Focus ArcSight and Glasswall FileTrust
    • 2.24.1 Install Micro Focus ArcSight
  • 2.25 Integration: Micro Focus ArcSight and Cisco Stealthwatch
    • 2.25.1 Install Micro Focus ArcSight
    • 2.25.2 Configure Cisco Stealthwatch
• List of Acronyms