Module 4.1: Intrusion Detection and Prevention Systems, and Other Security Tools

midterms

Intrusion

• Occurs when an attacker attempts to gain entry into or disrupt the normal operations of an organization’s information systems

Intrusion Detection and Prevention Systems

• Detects a violation of its configuration and activate alarm

• Many enable administrators to configure systems to notify them directly of trouble via email or pagers

• Systems can also be configured to notify an external security service organization of a “break-in”

TRUE

• Why would you use an Intrusion Detection and Prevention System (IDPS)?

• Primary purpose is to identify and report an intrusion; can quickly contain attack and prevent/mitigate loss or damage, detect and deal with preambles to attacks

• Data collection allows the org to examine what happened after an intrusion and why

• Serves as a deterrent by increasing fear of detection

• Can help management with quality assurance and continuous improvement

Network-based IDPS (NIDPS)

(Types of IDPS)

• Resides on a computer or an appliance connected to a segment of an organization’s network; looks for indications of attacks

• When examining packets, It looks for attack patterns within network traffic

• Installed at a specific place in the network where it can monitor traffic going into and out of a particular network segment

Wireless NIDPS

(Types of IDPS)

• Monitors and analyzes wireless network traffic

• Issues associated with it include physical security, sensor range, access point and wireless switch locations, wired network connections, cost, AP and wireless switch locations

Network Behavior Analysis Systems

(Types of IDPS)

• Identify problems related to the flow of traffic

• Types of events commonly detected include DoS attacks, scanning, worms, unexpected application services, and policy violations

• Offer intrusion prevention capabilities that are passive, inline, and both

Host-based IDPS (HIDPS)

(Types of IDPS)

• Resides on a particular computer or server (host) and monitors activity only on that system

• Benchmarks and monitors the status of key system files and detects when intruder creates, modifies, or deletes files

• Advantage over NIDPS: can access encrypted info traveling over network and make decisions about potential/actual attacks

• Most work on the principle of configuration or change management

• Can detect local events on host systems and detect attacks that may elude a network-based IDPS

Signature-based Detection

(IDPS Detection Methods)

• Examines network traffic in search of patterns that match known signatures

• Widely used because many attacks have clear and distinct signatures

• Problem with this approach is that new attack patterns must continually be added to IDPS’s database of signatures
  - Slow, methodical attack involving multiple events might escape detection

Anomaly-based Detection

(IDPS Detection Methods)

• Sometimes called behavior-based detection, collects statistical summaries by observing traffic known to be normal

• When measured activity is outside baseline parameters or clipping level, IDPS sends alert to administrator

• This can detect new types of attacks, but requires much more overhead and processing capacity than signature-based detection

• May generate many false positives

Stateful Protocol Analysis (SPA)

(IDPS Detection Methods)

• Process of comparing known normal/benign protocol profiles against observed traffic

• Stores and uses relevant data detected in a session to identify intrusions involving multiple requests/responses; allows IDPS to better detect specialized, multisession attacks (also called deep packet inspection)

• Drawbacks: analytical complexity; heavy processing overhead; may fail to detect intrusion unless protocol violates fundamental behavior; may interfere with normal operations of protocol

Log File Monitors

(IDPS Detection Methods)

• Reviews log files generated by servers, network devices, and even other IDPSs for patterns and signatures

• Patterns that signify attack may be much easier to identify when entire network and its systems are viewed as a whole

• Requires considerable resources since it involves the collection, movement, storage, and analysis of large quantities of log data

IDPS Response Behavior

• IDPS response to external stimulation depends on the configuration and function; many response options are available: Can be active or passive

• Active response: Collecting additional information about the intrusion, modifying the network environment, taking action against the intrusion

• Passive Response: Setting off alarms or notifications, collecting passive data through SNMP traps

• Many IDPSs can generate routine reports and other detailed documents

• Failsafe features protect IDPS from being circumvented

Honeypots

• Decoy systems designed to lure potential attackers away from critical systems

• They are designed to divert attacker from accessing critical systems, collect information about attacker’s activity, encourage attacker to stay on a system long enough for admins to document the event and perhaps respond

Honeynets

• Several honeypots connected together on a network segment

Padded Cell System

• Protected honeypot that cannot be easily compromised

• In addition to attracting attackers with tempting data, a padded cell operates in tandem with a traditional IDPS

• When the IDPS detects attackers, this system seamlessly transfers them to a special simulated environment where they can cause no harm

Trap-and-Trace Systems

• Uses a combination of techniques to detect an intrusion and trace it back to its source

• Trap usually consists of a honeypot or a padded cell and alarm

Active Intrusion Prevention

• Some organizations implement active countermeasures

• One tool (LaBrea) takes up unused P address space to pretend to be a computer and allow attackers to complete a connection request, but then holds connection open

Scanning and Analysis Tools

• Are typically used to collect information that an attacker needs to launch a successful attack

• Attack protocol is a logical sequence of steps or processes used by an attacker to launch an attack against a target system or network

• These tools are valuable to the network defender since they can quickly pinpoint parts of the systems or network that need a prompt repair to close vulnerabilities

Footprinting

• Process of collecting publicly available information about a potential

Fingerprinting

• Systematic survey of target organization’s internet addresses collected during the footprinting phase to identify network services offered by hosts in that range

• Reveals useful info about the internal structure and nature of the target system or network to be attacked

Port Scanners

• Tools used by both attackers and defenders to identify/fingerprint computers active on a network and other useful information

• Can either perform generic scans or those for specific types of computers, protocols, or resources

• The more specific the scanner is, the more useful its info is to attackers and defenders

Firewall Analysis Tools

• Several tools automate remote discovery of firewall rules and assist the admin/attacker in analyzing them.

• Administrators who feel wary of using the same tools that attackers use should remember:
  - To defend a computer/network well, admins must understand ways it can be attacked

• A tool that can help close an open or poorly configured firewall will help the network defender minimize risk from attack

Operating System Detection Tools

• Ability to detect a target computer’s OS is very valuable to an attacker

• Once OS is known, the attacker can easily determine the vulnerabilities to which it is susceptible

• Many tools use networking protocols to determine a remote computer’s OS

Vulnerability Scanners

• Active vulnerability scanners examine networks for highly detailed information and initiate traffic to determine security holes

• Passive vulnerability scanners listen in on network and identify the vulnerable versions of both server and client software

• Passive vulnerability scanners have the ability to find client-side vulnerabilities typically not found in active scanners

Packet Sniffers

• Network tool that captures copies of packets from network and analyzes them

• Can provide network admin with valuable info for diagnosing and resolving networking issues

• In the wrong hands, it can be used to eavesdrop on network traffic

Wireless Security Tools

• An organization that spends its time securing a wired network while ignoring wireless networks is exposing itself to a security breach

• So security professionals must assess the risk of wireless networks

• These toolkits should include the ability to sniff wireless traffic, scan wireless hosts, and assess the level of privacy or confidentiality afforded on the wireless network