January 2022 Summaries

Operation and SRE teams now have access to an official Elastic Stack Terraform provider that allows them to configure the Elastic Stack across various infrastructures, including Elastic Cloud and on-premises setups. This provider offers full control over components like Elasticsearch and Kibana, enabling infrastructure management through infrastructure-as-code methodologies. It facilitates the automated and controlled application of peer-reviewed infrastructure changes. The blog post provides an example of setting up an Elastic Cloud deployment and configuring it with an index lifecycle policy using the Terraform provider, highlighting its ability to manage Elasticsearch resources such as index templates and ILM policies. The Elastic Stack Terraform provider can be used to efficiently configure Elastic Cloud deployments with multiple data tiers, and the provided example demonstrates creating an ILM policy that matches these tiers, ensuring efficient data management. The post emphasizes the utility of the Terraform provider in streamlining the setup and management of Elastic Stack resources, offering readers guidance on starting with Elastic Cloud and using the Terraform provider effectively.

Elastic researchers have discovered a vulnerability in the Windows Protected Process Light (PPL) mechanism that can allow malware to disable security products. This flaw, which had not been patched, has been addressed in Elastic Security to better protect users. Gabriel Landau provides a detailed analysis of how sandboxing and access tokens can be exploited by hackers to infiltrate Windows-based systems, and a demonstration is included to show how these methods can disable anti-malware products. The article also discusses how anti-malware vendors can mitigate these risks using Windows' trusted labels feature. Users are encouraged to update to the latest version of Elastic Security and utilize the quick start training to effectively find threats like malware and ransomware. For those new to Elastic Cloud, a free 14-day trial or a self-managed version of the Elastic Stack are available.

In 2022, the financial services industry is experiencing significant transformation as both traditional firms and digital-native startups adapt to a digital-first world, driven by trends in cloud adoption, fintech integration, personalization, and AI utilization. Financial institutions are increasingly turning to cloud services for agility and cost reduction, despite initial hesitations due to security concerns, with major players like Nasdaq and Wells Fargo leading the charge. Fintechs are carving out niches in banking, payments, and insurance, often collaborating with established institutions to modernize and streamline operations, as seen with J.P. Morgan's partnership with Thought Machine. Personalization is becoming a critical focus, with digital banking users in the US expected to exceed 200 million, necessitating sophisticated data integration to enhance customer experiences while ensuring privacy and security. Meanwhile, AI and machine learning applications are expanding across the sector, improving processes from fraud detection to customer service, although adoption is tempered by data privacy regulations. As these trends unfold, a robust data strategy becomes essential for financial institutions to navigate the evolving landscape.

The Elastic Security Intelligence & Analytics Team conducted a detailed investigation into the FORMBOOK information-stealing campaign, emphasizing its use of the MSHTML exploit chain and its evolution into a broader phishing campaign. The research highlighted the rapid release of proof-of-concept codes following the identification of vulnerabilities, underlining the necessity for proactive threat hunting and patch management. The FORMBOOK campaign was notable for linking testing and production phases through shared infrastructure, shifting tactics to traditional phishing as patches mitigated the MSHTML exploit's effectiveness. Elastic's analysis provides comprehensive insights into the campaign's phases and indicators of compromise, helping organizations detect and defend against such threats. Further research is ongoing as more about FORMBOOK's impact is uncovered, with Elastic offering resources to bolster cybersecurity defenses.

Elasticsearch 7.15 introduces a vector tile search API that enhances the efficiency of rendering geospatial data by generating vector tiles from data stored in Elasticsearch. This API addresses previous challenges in visualizing high volumes of geospatial data by implementing vector tiles and improving map tiling through a fixed grid system, simplifying geometries according to scale, and reducing data transfer. Vector tiles, encoded using Google protobuffers, provide a more efficient file format than GeoJSON and can represent aggregated views of data for easy rendering in map applications. The API allows users to define query parameters to control the information encoded in vector tiles and supports integration with Elastic Maps, as well as third-party applications like OpenLayers and Mapbox. The API also facilitates the building of a tile map service (TMS) and custom applications, ensuring secure deployment practices and enabling the use of vector tiles in web and mobile applications.

Elastic Security engineers have developed a more efficient method for detecting network beaconing from Cobalt Strike, a tool often used in cyber intrusions. Researchers Derek Ditch, Daniel Stepanic, and Andrew Pease provide guidance on using Elastic's fleet policy to collect, configure, and analyze Cobalt Strike beacon payloads from endpoints, addressing the challenges posed by the beacon's extensive metadata. Recognizing the complexity and time consumption in identifying persistence mechanisms from advanced threats, the team's analysis offers valuable insights for security analysts and threat hunters, including indicators of compromise (IoCs) to kickstart investigations. The articles aim to ease the identification process for those without an Elastic Cloud cluster by offering a free 14-day trial.

Elasticsearch 7.16 introduces significant improvements in scalability, focusing on enhancing speed, reducing memory demands, and stabilizing clusters. The release addresses three main challenges: streamlining authorization processes, reducing shard requests during the pre-filter phase, and decreasing memory footprint. The new authorization strategy allows for faster request handling by optimizing authorization checks, reducing the impact on performance as clusters grow. Additionally, the pre-filter phase now sends fewer network requests, minimizing redundancy and reducing CPU and memory usage. Memory optimizations involve restructuring field builders, significantly lowering memory costs per field, which collectively saves substantial heap space across large clusters. These enhancements lead to reduced search latency, increased throughput, and lower resource usage, especially benefiting frozen nodes. The overall improvement in cluster state management diminishes CPU throttling on master nodes, making Elasticsearch more efficient in handling large-scale data operations. These updates are expected to enhance performance and scalability in various data tiers, with further advancements anticipated in future releases.

Elasticsearch 7.16 introduced a new range enrich policy that enhances contextual data analysis by allowing matches of numbers, dates, or IP addresses in incoming documents to corresponding ranges in the enrich index. This feature is particularly useful in security applications, where matching IP ranges can refine detection rules, and it can also be applied to other contexts, such as managing on-call schedules for engineers. By logging incidents and associating them with scheduled engineers, organizations can better analyze and understand staffing patterns and incident responses. This capability is demonstrated through a fictional example involving engineers Bob, Alice, Dan, Matt, and Lizzie, with their various work schedules logged into Elasticsearch, enabling enriched analysis of who was on call and who handled incidents. The policy facilitates not only individual document enrichment but also broader searches and aggregations, offering insights into staffing and incident management.

Elastic's integration with Microsoft Azure Spring Cloud enables seamless data ingestion for monitoring Spring Boot applications, enhancing operational efficiency and developer productivity. This integration addresses the significant challenge of end-to-end monitoring identified by a Microsoft survey, allowing DevOps and SREs to monitor logs and application metrics across environments by automatically shipping them to Elastic. The collaboration offers a unified observability experience, enabling users to correlate Spring Boot application data with other observability data for comprehensive monitoring. Elastic's functionalities, including machine learning, distributed tracing, and automated dashboards, facilitate detailed performance analysis and anomaly detection, while the common schema supports extended detection and response (XDR) capabilities. This integration allows organizations to efficiently modernize their Java applications in the cloud while maintaining a focus on customer value through improved visibility and cyber resilience.

Elastic Maps played a crucial role in tracking and visualizing the impact of the Cumbre Vieja eruption on La Palma by using its time slider feature, which enables the animation of datasets to show changes over time. The eruption, which began after a series of seismic events, led to widespread destruction, displacing thousands, destroying homes, and affecting the island's ecosystem and economy. Elastic Maps facilitated the integration of real-time data from various sources, including drone imagery and seismic activity, to create detailed maps that illustrate the evolution of lava flows and the impact on buildings and infrastructure. This data-driven approach not only helped in understanding the current situation but also provided insights that could aid authorities in preparing for future natural disasters. The visualization tools in Kibana, alongside Elastic Maps, allowed for a comprehensive exploration of the event, offering valuable information for experts and authorities to mitigate future risks.

Elastic Security has confirmed the presence of a new destructive malware campaign targeting Ukraine, dubbed Operation Bleeding Bear, which was initially detailed by Microsoft and the Ukrainian National Cyber Security Coordination Center. The malware is known for its multi-stage operations, including wiping the Master Boot Record, disabling Windows Defender, and corrupting files, while employing techniques like process hollowing. Elastic Security provides protection against such threats through advanced malware detection and Ransomware Protection capabilities, and the team continues to monitor developments. The article offers a detailed analysis of the malware, highlighting behaviors and defensive strategies, including specific Indicators of Compromise (IoCs) and a guide for locating and mitigating threats using Elastic Security and the MITRE ATT&CK framework. Existing Elastic Security users can leverage these insights within the product, while new users are encouraged to explore quick start guides and a free 14-day trial of Elastic Cloud.

Elastic Security has confirmed a new destructive malware attack targeting Ukraine, known as Operation Bleeding Bear. Microsoft recently released details about this multi-stage malware campaign, which has been highlighted by Ukraine's National Cybersecurity Coordination Center. Elastic's users are protected against such attacks due to their advanced malware detection and ransomware protection capabilities, with Elastic Security continuing to monitor these developments. The attack underscores the importance of preventive measures against ransomware and destructive malware. The full article provides an analysis of the malware involved, behavior patterns for detection, and detailed recommendations for protection, including indicators of compromise and mitigation instructions using Elastic Security and the MITRE ATT&CK® framework. Current Elastic Security users can access these capabilities, while new users are encouraged to explore quick-start guides and avail a free 14-day trial of Elastic Cloud.

The adoption of DevSecOps, a methodology that integrates security into every stage of software development, is increasingly essential for organizations seeking to enhance efficiency and mitigate security risks in a fast-paced digital environment. This approach promotes a culture of shared responsibility among development, security, and IT operations teams, thereby facilitating quicker identification and resolution of vulnerabilities. Despite the challenges of merging distinct team cultures, DevSecOps fosters knowledge sharing and collaboration, making security a priority alongside new feature development. High-level executives, such as CIOs or CISOs, are crucial in driving this transition by setting frameworks and ensuring teams have the freedom to adapt processes within established guardrails. The success of DevSecOps is evident in examples such as the US Navy's recent program, which emphasizes cultural integration and has achieved significant security compliance within a short period. As software release cycles accelerate, the need for developers to possess core security skills and for organizations to embrace this integrated approach is becoming increasingly urgent.

Open Banking has revolutionized the financial industry by allowing customers to share their data with third-party providers, leading to the growth of FinTech and the development of new financial solutions and infrastructure. This movement, characterized by banks offering API access to customer financial data, has resulted in significant data generation and demand for secure data access. Despite its benefits, such as improved financial decision-making and portfolio visibility, adoption is hindered by trust issues, with many consumers wary of data security. To enhance trust and facilitate Open Banking's success, banks must implement secure, scalable digital architectures with API-driven platforms and AI analytics, reducing fraud risks and ensuring compliance with regulatory requirements. Companies like Elastic are aiding this transition by offering observability and security features that enhance fraud prevention and analytics, helping financial institutions navigate the complexities of Open Banking while maintaining customer trust.

Version 6.8.23 of the Elastic Stack was released on January 13, 2022, featuring an update to Log4j version 2.17.1 for both Elasticsearch and Logstash. This patch release is recommended for users to upgrade to enhance security and performance. For detailed information on the changes included in this release, users are encouraged to consult the release notes specific to each product in the Elastic Stack, which comprises Elasticsearch, Kibana, Beats, and Logstash.

Version 7.16.3 of the Elastic Stack has been released, featuring an updated version of Log4j (2.17.1) for both Elasticsearch and Logstash. This patch release is recommended for users to upgrade to ensure the latest enhancements and security updates. Detailed changes and improvements in this release can be found in the 7.16.3 release notes, covering components such as Elasticsearch, Kibana, Beats, Logstash, Elastic Enterprise Search, Elastic Observability, APM, and Elastic Security solutions.

Following the discovery of the Log4Shell vulnerability in Log4J2, Elastic Security and Observability tools provide a comprehensive approach to defending networks by integrating security analytics with application performance monitoring (APM), logs, and metrics. The blog post by James Spiteri explains how these tools can offer deep visibility and assist security analysts in conducting root cause analysis of potential exploits. It walks through a hypothetical scenario where a Java application is exploited, detailing the steps taken by a security analyst team to investigate alerts, identify a suspicious Java process, and confirm the presence of a Log4Shell exploit using various features within Kibana, such as correlated logs and traces, Osquery, and the APM view. The investigation highlights the power of combining observability and security data within the same platform, although it acknowledges the challenges of instrumenting applications to this extent. Elastic aims to simplify the process and improve accessibility for organizations seeking similar insights.

Shay Banon, founder of Elastic, is reassuming his role as Chief Technology Officer (CTO) to focus on innovation and product development, while Ash Kulkarni, previously Chief Product Officer, has been promoted to CEO. This leadership transition is part of a strategy to enhance Elastic's focus on innovation and execution as the company continues to expand its cloud-first approach and leverage its search platform to capitalize on a $78 billion total addressable market. Banon and Kulkarni express strong commitment to Elastic's growth, emphasizing a culture of empathy, transparency, and innovation. They aim to strengthen relationships with cloud partners such as Google Cloud, Microsoft Azure, and AWS to fuel Elastic Cloud's growth, supported by a vibrant community of over 600,000 users and a robust customer base of more than 17,000 organizations. Both leaders are enthusiastic about the potential to advance Elastic's positions in Observability, Security, and Enterprise Search, underscoring the foundational role of Elasticsearch in driving future opportunities.

Elastic Stack has announced the release of its 8.0.0-rc1, the first release candidate following the last beta release, aimed at gathering user feedback for improvement before its general availability. Users are encouraged to participate in the Pioneer Program by testing various components like Elasticsearch, Kibana, Beats, Logstash, and APM, and reporting any bugs found. This release is not intended for production use, and compatibility with future versions, including the eventual 8.0.0 general availability release, is not guaranteed. The Elastic community is available for support regarding upgrades, and users are encouraged to explore and download the new release, with comprehensive release notes provided for each component of the Elastic Stack.

The blog post discusses the enhancements made to Elastic Security's Linux malware protection with the release of version 7.16, focusing on the addition of memory protection and the use of machine learning to improve the detection of malware. The integration of machine learning allows for a more dynamic and reliable approach to identifying significant byte sequences, as opposed to the traditional method of writing signatures based on human analysis. The article highlights recent vulnerabilities, such as those in Open Management Infrastructure and VMware vCenter Server, to demonstrate the urgent need for effective malware protection. Elastic Security's new capabilities cover over 150 malware families across various categories, utilizing machine learning models to generate high-efficacy signatures. The post also explains the technical process of generating these signatures using tools like Capstone disassembly and VTGrep, alongside machine learning models trained on static attributes of binaries. Furthermore, the Linux malware scanner has been added to VirusTotal for community validation, and the blog invites users to engage with these tools by offering insights into the development process and encouraging feedback through a free trial of Elastic Cloud.

In 2022, public sector data strategies are set to evolve significantly, driven by insights from the pandemic and a deliberate focus on data utilization. Key trends include enhancing digital experiences as online interactions become more prevalent, with governments and schools seeking to improve digital service delivery. This shift is further supported by the Executive Order on Transforming Federal Customer Experience, which aims to rebuild trust through better online tools and technologies. Additionally, there is an increased emphasis on shared data resources to break down bureaucratic silos, as well as a reliance on data for bolstering infrastructure resilience against cyber threats, exemplified by the Executive Order on Improving the Nation’s Cybersecurity. Public sector leaders are also exploring data tool consolidation to optimize resources and reduce technological debt while investing in data upskilling to empower the workforce and enhance decision-making capabilities. These developments reflect a broader commitment to harnessing data as a strategic asset, with platforms like Elastic playing a crucial role in delivering real-time insights and streamlined workflows.

Government data strategies are evolving to enhance decision-making and public service delivery through improved role-based data sharing and data re-use, yet challenges persist due to departmental silos and privacy compliance. A hypothetical state government scenario illustrates how key stakeholders such as line of business departments, IT teams, and data science resources can collaborate to address these challenges. Using tools like Elastic's data classification and normalization methods, data can be tagged and organized into a common schema, facilitating compliant data sharing across departments. This approach allows for role-based access and field-level document control, ensuring that sensitive information remains protected while enabling efficient data analysis across different clusters. The Elastic platform not only supports day-to-day IT and security operations but also aids in long-term data analytics by allowing data science teams to perform trend modeling through accessible historical data. Despite the complexities of inter-departmental data sharing, Elastic offers solutions to navigate these challenges, ensuring that government data stakeholders remain aligned and informed.

Osquery Manager, now generally available for Elastic Agent with the Elastic 7.16 release, enhances endpoint telemetry by integrating Osquery data with the Elastic Stack for improved detection and investigation capabilities. By deploying Osquery across environments, users can perform live and scheduled queries to gather data from operating systems, enabling real-time incident response, threat hunting, and monitoring for vulnerabilities. Osquery's integration with Elastic Security allows for crafting security alerts and monitoring anomalous activities, such as processes running without binaries on disk, which could indicate malicious activity. The tool also supports isolating compromised hosts, providing time for investigation while maintaining communication with the Elastic Stack. Additionally, scheduled query packs help establish baselines for normal operating conditions, and Elastic Machine Learning can be used to identify anomalies, such as unexpected applications on Windows systems, enhancing security operations. A free 14-day trial of Elastic is available for those interested in exploring these capabilities, with feedback welcomed on the Elastic Discuss forum and the Elastic Stack Community on Slack.