The Black Hat Asia Network Operations Center (NOC) Report
Description
The Black Hat Asia Network Operations Center (NOC) team discusses the infrastructure, tools, and collaborative efforts required to secure one of the world's most unique networking environments. The report highlights how major security vendors integrate their technologies to monitor malicious activity and maintain network stability during the conference.
Behind the Scenes: Securing the Black Hat Asia Network
Operating a network at a major cybersecurity conference like Black Hat is a unique challenge. Unlike a corporate office where IT aims to block every threat, the Black Hat Network Operations Center (NOC) must facilitate a playground for hackers while simultaneously protecting sensitive registration data and maintaining stability. This post explores the technical architecture and collaborative strategies discussed in the Black Hat Asia NOC report.
The Challenge: A 'Needle in a Needle Stack'
In a typical enterprise, a sudden spike in exploit attempts or malware traffic is a clear indicator of a security incident. At Black Hat, it is simply a Tuesday. Attendees are there to learn, demonstrate, and test the latest vulnerabilities. The NOC team refers to this as looking for 'needles in needle stacks.' The difficulty lies not in finding the malicious traffic, but in differentiating between 'functional' malice (a demo in a briefing room) and 'actual' malice (someone targeting the conference infrastructure itself).
To manage this, the NOC team adopts a 'logo-less' philosophy. Engineers from Arista, Cisco, Palo Alto Networks, and Corelight work side-by-side, integrating their tools to create a cohesive defense-in-depth strategy that transcends traditional vendor rivalries.
Building the Foundation: Arista's Network Infrastructure
The network begins with Arista, providing the wired and wireless backbone. At Black Hat Asia, this involves 48 Access Points and 11 switches. Because time is limited during setup, Arista leverages Zero-Touch Provisioning (ZTP) via CloudVision (CVQ). Hardware is plugged in, connects to the cloud, and automatically pulls down the necessary configurations.
A key architectural decision is the use of network TAPs. By tapping the traffic flowing through the switches, Arista can provide a mirror image of all network packets to the security vendors without impacting the speed or reliability of the primary data path. This ensures that the security stack has full visibility into every packet entering or leaving the venue.
Visibility and Response: Corelight and Palo Alto Networks
Once the traffic is tapped, Corelight's sensors ingest the raw packets. Corelight specializes in Network Detection and Response (NDR), converting raw data into Zeek-based logs that provide high-level context about network connections, DNS queries, and file transfers. These logs are the 'lifeblood' of the NOC's threat-hunting operations.
These logs flow directly into the Palo Alto Networks Cortex XSIAM (Security Information and Event Management) platform. XSIAM serves as the centralized 'brain' of the operation, where threat hunters from all participating companies can collaborate.
Palo Alto's role also includes physical defense via Next-Generation Firewalls (NGFW). While they allow 'funky' traffic in training rooms, they implement strict inspection and decryption for the registration area. This ensures that while attendees are free to experiment, their personal information remains protected behind a layer of heavy inspection.
Advanced Monitoring with Cisco
Cisco brings a broad suite of tools to the NOC, focusing on both performance and security. One standout tool used is ThousandEyes, which provides 'hop-by-hop' visibility into the internet path. During one conference, the team used ThousandEyes to diagnose latency issues, discovering that traffic meant for a local server was being routed through France and Ireland before returning to Singapore.
Cisco also manages the identity and mobile devices used by conference staff. Using Mobile Device Management (MDM), they secure the iPads used for registration, ensuring that the devices themselves do not become a weak link in the security chain. Furthermore, Cisco's XDR (Extended Detection and Response) platform integrates with Splunk and other tools to provide a comprehensive visualization of the threat landscape.
The Human Element: Configuration is King
Despite the millions of dollars in hardware and software, human error remains a factor. The NOC report highlighted an incident where Corelight sensors detected plaintext credentials flowing across the network. The root cause? A simple missed checkbox during the configuration of a new software component. This highlights a critical lesson for all security professionals: even the best tools are only as effective as their configuration. Continuous monitoring is required to verify that security controls are functioning as intended.
Conclusion
The Black Hat Asia NOC is more than just a support function; it is a collaborative research project. By bringing together the best-of-breed tools from Arista, Cisco, Palo Alto Networks, and Corelight, the team creates a blueprint for how modern organizations can achieve deep visibility and rapid response. The key takeaway for any security leader is the value of integration. When your network, firewall, NDR, and XDR platforms talk to each other, the 'needle in the needle stack' becomes much easier to find.
For those interested in the full data set and humorous stories from the network, the NOC report remains a must-watch presentation for anyone looking to understand high-stakes network defense.
AI Summary
This presentation provides a detailed overview of the Network Operations Center (NOC) at Black Hat Asia, featuring representatives from Cisco, Arista, Palo Alto Networks, and Corelight. The core theme of the talk is the 'logo-less' collaboration between competing security vendors to provide a stable and secure environment for a conference where attendees are actively practicing offensive techniques. Jonathan from Arista explains the physical and logical networking layer, which involves deploying approximately 48 Access Points (APs) and 11 switches throughout the venue. In the Asia and London shows, Arista utilizes the venue's existing infrastructure, connecting their APs back to a central stack. They employ Zero-Touch Provisioning (ZTP) via CloudVision to configure hardware rapidly upon arrival. A critical component of their setup is the use of TAPs, which aggregate and copy all network traffic for analysis by security partners. Jimmy from Palo Alto Networks describes their two-fold role: providing network security through Next-Generation Firewalls and security operations via the Cortex XSIAM platform. Unlike a traditional enterprise environment, the Black Hat NOC intentionally allows most traffic—including exploits and malware—to pass through to facilitate training and demonstrations. However, they heavily protect and decrypt traffic in high-value areas like registration, where personal data resides. The team uses the phrase 'looking for needles in needle stacks' to describe the challenge of identifying truly malicious intent amidst a sea of intentional exploit traffic. Mark from Corelight details the OpenNDR (Network Detection and Response) aspect. Corelight sensors consume raw packets provided by Arista, transforming them into enriched logs and full packet captures (PCAP). These logs are forwarded to various platforms, including Palo Alto's XSIAM and Cisco XDR, to support cross-vendor threat hunting. This visibility allows the team to distinguish between classroom activities and external attacks. Jessica from Cisco discusses the evolution of their role, which now includes identity management, mobile device management (MDM) for registration iPads, and visibility via ThousandEyes. She shares an anecdote about using ThousandEyes to diagnose latency issues where traffic was being routed inefficiently through Europe before reaching AWS. She also highlights the importance of human intuition, recounting an incident where Corelight detected plaintext credentials because an engineer had missed a configuration checkbox. In the concluding Q&A, the speakers address modern security concepts like CASB (Cloud Access Security Broker). They explain that while CASB is vital for enterprises, its utility is limited in a guest Wi-Fi environment where the NOC has no control over the endpoints. The session emphasizes that the NOC serves as a testing ground for vendor integrations, ultimately benefiting the broader security community.
More from this Playlist
Dismantling the SEOS Protocol
