Chapter 7 — Network and communications security: data and telemetry
Lesson map
Lesson 07 published. Map, example, EX025.
flowchart TD
N0["Learning outcomes"]
N1["7.1 What telemetry tells us"]
N2["7.2 Central collection"]
N3["Lab — VPN login failures"]
N4["7.3 Reading the result"]
N5["7.4 Thresholds and context"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX025"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 What telemetry tells us"]
N2["7.2 Central collection"]
N3["Lab — VPN login failures"]
N4["7.3 Reading the result"]
N5["7.4 Thresholds and context"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX025"]
[Learning outcomes]
|
v
[7.1 What telemetry tells us]
|
v
[7.2 Central collection]
|
v
[Lab — VPN login failures]
|
v
[7.3 Reading the result]
|
v
[7.4 Thresholds and context]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX025]
Learning outcomes
You will (1) identify useful network telemetry; (2) centralise logs; (3) analyse VPN login failures.
7.1 What telemetry tells us
Telemetry is data that devices produce about their own activity: firewall allow and deny logs, VPN login records, wireless association logs, DNS queries and device health. Each answers different questions. Deny logs show blocked attempts; VPN records show who connected, from where and whether they failed; DNS logs show what names were looked up. Amina lists which questions Castleford most needs answered, such as "are field officers' accounts being guessed?", and chooses telemetry that answers them. Telemetry that answers no question is not collected, which saves storage and review time.
7.2 Central collection
Logs kept only on devices are lost when the devices overwrite them or fail. Amina helps Rosa send logs from firewalls, the VPN gateway and the wireless controller to a central collector using syslog, whose message format is defined in RFC 5424. The collector keeps ninety days of logs, synchronises time across devices and is accessible only to Rosa and the support company's named engineers. Central logs make it possible to follow an event across several devices. The collector's own disk use is also monitored so it never fills unnoticed.
Lab — VPN login failures
"""Count failed VPN logins per account in synthetic records and flag accounts over a threshold (stdlib only)."""
import collections
recs = [("j.hale", "fail"), ("j.hale", "ok"), ("m.ortiz", "fail"), ("m.ortiz", "fail"), ("m.ortiz", "fail"),
("m.ortiz", "fail"), ("m.ortiz", "fail"), ("m.ortiz", "fail"), ("s.kerr", "ok"), ("admin", "fail"),
("admin", "fail"), ("admin", "fail"), ("admin", "fail"), ("admin", "fail"), ("admin", "fail"), ("admin", "fail"),
("r.nash", "fail"), ("r.nash", "ok"), ("s.kerr", "ok"), ("j.hale", "ok")]
fails = collections.Counter(u for u, r in recs if r == "fail"); oks = collections.Counter(u for u, r in recs if r == "ok")
for u in sorted(set(u for u, _ in recs)):
flag = "FLAG" if fails[u] > 5 else ""
print(f"{u:9} fail {fails[u]:2} ok {oks[u]:2} {flag}")
print("flagged:", [u for u in fails if fails[u] > 5])
Run with python3 lab_vpnlog.py. Verified output:
admin fail 7 ok 0 FLAG
j.hale fail 1 ok 2
m.ortiz fail 6 ok 0 FLAG
r.nash fail 1 ok 1
s.kerr fail 0 ok 2
flagged: ['m.ortiz', 'admin']
7.3 Reading the result
In the synthetic records, two accounts exceed five failures: an account named "admin", with seven failures and no successes, and m.ortiz, with six failures and no successes. The "admin" account should not exist on the VPN at all, since administrators use named accounts; repeated failures on it suggest someone outside is guessing common names. The m.ortiz failures might be a forgotten password or guessing. Amina recommends removing the "admin" account, contacting the user about m.ortiz and keeping multi-factor authentication on all VPN accounts.
7.4 Thresholds and context
A threshold such as "more than five failures" is a starting point, not a rule of nature. Too low, and normal mistakes cause alerts; too high, and slow guessing is missed. Amina suggests reviewing flagged accounts weekly and adjusting the threshold based on what reviews find. She also notes that context matters: failures from an unusual country or at night are more concerning than a few failures from a known office address in the morning, so the review should look at both counts and context.
Worked example
Two accounts exceed the threshold; the generic "admin" VPN account is removed and the user of m.ortiz is contacted.
Synthetic case. Records are synthetic.
Errors and limits
Fixed thresholds without review either flood staff with alerts or miss slow guessing.
Exercises
- EX025 — Flagged accounts. Which accounts does the lab flag? Rubric: 3 = admin (7) and m.ortiz (6);; 2 = two;; 1 = one;; 0 = none.
- EX026 — Generic account concern. Why are failures on a generic "admin" VPN account concerning? Rubric: 3 = should not exist; suggests outside guessing;; 2 = guessing;; 1 = vague;; 0 = none.
- EX027 — Log retention. How long are central logs kept? Rubric: 3 = ninety days;; 2 = 90 days;; 1 = forever;; 0 = none.
- EX028 — Context factors. Name one context factor that makes failures more concerning. Rubric: 3 = unusual location or time;; 2 = location;; 1 = vague;; 0 = none.
Synthesis
Central telemetry and simple analyses reveal account guessing and other problems early.
Continue studying — chapter 07 of 18
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →