How Can Federal Agencies Close the Network Visibility Gap Identified by OMB M-21-31?

TL;DR

A significant amount of our Federal Agency security dollars have gone into log infrastructure but there is yet to exist an end-to-end log capable solution to discover the lion's share of cybersecurity attacks. Furthermore, based on NIST SP 800-92r1 (and even OMD M-21-31), it is absolutely essential to have what you can consider "log-equivalent", packet-derived and/or wire-based telemetry even after compromise. Aviz Deep Network Observability (DNO) will allow Federal Agencies the non-intrusive continuous North-South, East-West, network-generated observability needed to transition to those more advanced Event Logging tiers, and this comes in alongside any SIEM or observability you already use.

Introduction

For years, federal agencies have cleared a path for log ingestion; deploying SIEMs and building and feeding log pipelines. And still, intruders spend months lurking on federal networks before being uncovered, thanks to… too many logs. In M-21-31 - OMB's seminal directive which remixed event logging for government agencies - the President acknowledged that event logging alone cannot sufficiently expose many of the intrusions occurring today. Agencies will move higher in the realm of log loggingmaturity, so we will see efforts swing away from 'more logs is more logs' and toward more confident detection.

Why Did OMB M-21-31 Change How Federal Agencies Think About Logs?

OMB M-21-31 - was born from two very visible cyberattacks that demonstrated how adversaries could infiltrate government systems and move through the environment for days - even weeks - without leaving any log events that would be helpful for federal responders. Contrary to the "run of the mill" updates where government bodies pile more bureaucratic requirements on their civilian agencies under out-dated policy mandates. M-21-31 outlines categories of how compliant civilians are expected to log events in:

• EL 1 Basic: Network activity, Passive DNS data and 72-hour worth of full packet capture
• EL 2 Intermediate: Visibility of the communications being encrypted.
• EL 3 Advanced: Visibility of the communication that takes place East/West between internal systems, as orchestration.

The deadline for having achieved these milestones passed, however the challenges facing government entities are far from solved.

Why Can’t a SIEM Alone Solve the Federal Logging Problem?

So there's one very sticky problem we run into nearly every day: all logs are not created equal. NIST SP 800–92r1 (the companion to M-21-31) hits this point hard. The logs from the device layer and the application layer often contain one major fundamental weakness - they are generated by the same machines and services that an attacker may eventually have control over, and that an attacker already controls once they compromise the environment and have gained persistence.

There are entire swathes of entries under MITRE ATT&CK (specifically under ATT&CK IDs T1070 and T1562) detailing numerous ways that an attacker will work obsessively to delete audit trails, disable logging functions, or exfiltrate targeted logging data all together while still maintaining their foothold on your network.

Once a threat has established persistent access, there are no longer secrets regarding what logs you're aggregating. He can then make the conscious choice of deciding which valuable log sources that you've trained your SIEM to "trust" most and erase those records all together rendering yourself essentially blind. Once the SIEM begins to analyze the lone data remaining (i.e. Those that didn't make it or were modified and never deleted) the network then magically looks clear. M-21–31 makes no room for doubt when stating the following in its summary: M-21–31 requires log integrity at the log platform but does not cover protection at log sources, and this is a security oversight so fundamental it's not addressed even by a sophisticated SIEM.

How Does Packet-Derived Telemetry Improve Visibility?

However, when a packet broker intercepts a traffic stream directly off the wire, you generate a data record which, at least at that point in time, doesn't reside in the network. It's generating the data simply because it saw the stream, not because the user at the endpoint is asking it to log activity. If an attacker takes over a host, knocks out the EDR, covers their tracks by zeroizing the host log - that attacker didn't even see that network data pass across the wires.

It went by, the packet broker grabbed it, piped the relevant metadata into our SIEM and observability platforms and made it beyond the reach of the attacker, long before they could possibly destroy it.

This is precisely the definition of "telemetry assured," as defined in the NIST SP 800–92 rev1, and the primary reason the definition of the federal "log" itself is starting to shift from endpoint/app activity to the more readily-tamper-resistant data flowing across our wires.

What Does OMB M-21-31 Actually Require from Your Network?

EL1. It's not simply "capture the log data", EL1 is the out-of-the-box syslog-flow traffic coming across the wire not from the machine itself and it also non-invasively listens to DNS, all at the packet level. This is not the equivalent of scraping logs from the machine itself

EL2. Encryption traffic visibility. By default, well over 99% of the traffic on your network is encrypted. Attackers hide in the encryption! EL2 is unavailable for at the TLS package level of TLS sessions, it's basically a waste of money and has nothing of substance to offer.

EL3. For all of those in this audience it is in this arena that many organizations face challenges. East-West connectivity in a virtual network-horizontal movement between private hosts, cloud resources and containers-is the most difficult and also one of the most catastrophic areas to neglect.

What Vendor-Agnostic Capability Do Both M-21-31 and NIST SP 800-92r1 Recommend?

M-21-31 and NIST 800-92r1 don't prescribe particular products, rather a capability to deliver wire-level continuous telemetry from packets, as input into the existing security and observability solutions your agency is already using. Aviz Deep Network Observability provides exactly that.

From any environment (the data center, hybrid cloud, remote and branch offices, at the edge, in the field, IoT/IT, and mobile devices/managed/unmanaged) Aviz receives traffic (through the use of a Tap or SPAN port), processes that traffic across the network fabric, and delivers as: optimized wire-level raw packets to your existing NDR, IDS and all other inspection-based tools, regardless of the devices or how they report (even if your host-based defenses are down). Packet-derived metadata in consumable, standards-based formats (including application name, DNS data, TLS posture and flow details, and session information) for any of your SIEMs, NPMs, AIOps and other observability tools.

And critically, only a single capture point is ever required for Aviz to provide either one of both of these data streams without any additional tabs, or displacing any of the tools you already trust! In one current deployment, with just one Aviz capture point and a single packet-derived metadata export out to our customer'sSplunk and Elastic instances, we were able to discover: active internal network attacks to East-West traffic flows completely undetectable by border security; that nearly 94% of the client's network's encrypted traffic was represented by stale/expired SSL certificates (that showed zero logs in current device monitoring); and active use of forbidden AI platforms from internal servers to the cloud. Discovery, facilitated entirely by Aviz's packet-derived metadata.

How Can Federal Agencies Close the Remaining Network Visibility Gap?

Agencies with paper EL1s and EL2s but no East/West visibility - they aren't failing to log, they are network visibility challenged. Logging alone is never going to achieve EL3, with zero trust success and in-band network tapping like that mandated in NIST 800-92r1. That is only if that telemetry being collected actually happened.

So M-21-31 (because actors found logging deficits valuable), where do we go?
Aviz's Deep Network Observability can add the critical visibility and telemetry needed to allow logging and zero trust to become successful with what is missing:wire speed capture. We aren't removing SIEMs or IDSs from the environment; we are bringing them the wire speed telemetry you needed.

Conclusion

OMB M-21-31 brought about a change in federal agencies' approach to logging; "A strong telemetry bedrock is now as important as increased logs," declared the guidance. Relying only on SIEM, endpoints or compliance checks won't allow agencies to identify malicious activity never "admitted" on compromise systems. A packet-derived telemetry is the network representation, uncompromised, applicable at every stage in the EL life cycle. Agencies looking for both EL3 and zero-trust now find that a Wire visibility throughout all steps is essential.