sec_06_IDP
Application-based IDPS (AIDPS)
AIDPS examines application host for abnormal events can be viewed as an extension of a proxy server, considering not only application protocol, but also file system interaction network activity changes to system configuration files dynamic memory utilization
honey pot (et al.) advantages
Attackers can be diverted to targets they cannot damage Administrators have time to decide how to respond to attacker Attackers' actions can be easily and more extensively monitored, and records can be used to refine threat models and improve system protections Honey pots may be effective at catching insiders who are snooping around a network
advantages of App IDPSs
Aware of specific users; can observe interaction between application and user Able to operate even when incoming data is encrypted
hardness testing
Conduct a real virus or worm scan against an invulnerable system
Honey pots designed to:
Distract attacker from accessing critical systems Collect information about attacker's activity Encourage attacker to stay on system long enough for administrators to document event and, perhaps, respond
honey pot (et al.) disadvantages
Legal implications of using such devices are not well defined Honey pots and padded cells have not yet been shown to be generally useful security technologies Expert attacker, once diverted into a decoy system, may become angry and launch a more hostile attack against an organization's systems Administrators and security managers will need a high level of expertise to use these systems could back-fire ...
IDPS Deployment Summary
Like decision regarding control strategies, decisions about where to locate elements of intrusion detection systems can be art in itself Planners must select deployment strategy based on careful analysis of organization's information security requirements but, at the same time, causes minimal impact NIDPS and HIDPS can be used in tandem to cover both individual systems that connect to an organization's networks and networks themselves
Packet Sniffers - A software program or hardware appliance that can intercept, copy, and interpret network traffic.
Network tool that collects copies of packets from network and analyzes them Can provide network administrator with valuable information for diagnosing and resolving networking issues In the wrong hands, a sniffer can be used to eavesdrop on network traffic To use packet sniffer legally, administrator must be on network that organization owns, be under direct authorization of owners of network, and have knowledge and consent of the content creators
Wireless Security Tools
Organization that spends its time securing wired network and leaves wireless networks to operate in any manner is opening itself up for security breach Security professional must assess risk of wireless networks A wireless security toolkit should include the ability to sniff wireless traffic, scan wireless hosts, and assess level of privacy or confidentiality afforded on the wireless network
Disadvantages of HIDPSs
Pose more MANAGEMENT ISSUES VULNERABLE both TO DIRECT ATTACKS and attacks against host operating system Does not detect multi-host scanning, nor scanning of non-host network devices Susceptible to some DENIAL-OF-SERVICE attacks Can use large amounts of disk space Can inflict a PERFORMANCE OVERHEAD on its host systems proper deployment strategies are DIFFICULT, EXPENSIVE AND TIME CONSUMING
Regression Testing
Record and retransmit packets from real virus or worm scan Record and retransmit packets from a real virus or worm scan with incomplete TCP/IP session connections (missing SYN packets)
Disadvantages of App IDPSs
Redundancy with proxy server, HIDPS May be taken in by forms of spoofing much less standard interfaces (generally custom tailored) very high implementation and support costs - obsolete features may create false positives / false negatives
port scanners - Tools used both by attackers and defenders to identify or fingerprint active computers on a network, the active ports and services on those computers, the functions and roles of the machines, and other useful information. Port scanners are also known as port scanning utilities.
Tools used by both attackers and defenders to identify computers active on a network, and other useful information Can scan for specific types of computers, protocols, or resources, or their scans can be generic The more specific the scanner is, the better it can give attackers and defenders useful information
Trap-and-Trace Systems - An application that uses a combination of techniques to detect an inbound communication and then trace it back to its source. The trap usually consists of a honeypot or padded cell and an alarm.
Use combination of techniques to detect an intrusion and trace it back to its source Trap usually consists of honey pot or padded cell and alarm Legal drawbacks to trap and trace 1. Enticement 2. Entrapment 3. Enticement is legal and ethical, whereas entrapment is not
Firewall Analysis Tools
automated remote discovery of firewall rules useful to discover and understand attack vectors evaluation of firewall configuration
signature-based IDPS advantages
+ simple (relatively) to implement + lightweight + low false positives + high true positives for known attacks
Statistical Anomaly-based IDS advantages
+ threat identification without signature update + "automatic" adaptation (or periodic adaptation) + detection of long/slow attacks
Statistical Anomaly-based IDS disadvantages
- "training" period - attacks with strong similarity to "normal" - malicious training by inside attackers - increased false positives (email, unique data transfers, mass events) - "cry wolf" syndrome
Disadvantages of NIDPSs
- Can become overwhelmed by network volume and fail to recognize attacks - Require access to all traffic to be monitored - Cannot analyze encrypted packets - Cannot (usually) ascertain if attack was successful or not - Some forms of attack are not easily discerned by NIDPSs, specifically those involving fragmented packets
advantages of HIDPSs
- Can detect local events on host systems and detect attacks that may elude a network-based IDPS Functions on host system, where encrypted traffic will have been decrypted and is available for processing Not affected by use of switched network protocols Can detect inconsistencies in how applications and systems programs were used by examining records stored in audit logs
intrusion detection functions
- Detect malicious activities/attacks - Raise Alarms - Log events - React to attacks
Detect malicious activities/attacks
- Hacking/ unauthorized access - DOS attacks - Virus/Malware
Host-Based IDPS (HIDPS) - An IDPS that resides on a particular computer or server, known as the host, and monitors activity only on that system. Also known as a system integrity verifier
- Host-based IDPS RESIDES on a particular computer or server and MONITORS activity ONLY on THAT SYSTEM - BENCHMARK AND MONITOR the status of key system files and detect when intruder creates, modifies, or deletes files - Most HIDPSs work on the PRINCIPLE OF CONFIGURATION or change MANAGEMENT - Advantage over NIDPS: can usually be installed so that it can access INFORMATION WHICH WAS ENCRYPTED when traveling over network may be combined / integrated with bastion host or application server
Measuring the Effectiveness of IDPSs
- IDPSs are evaluated using two dominant metrics: 1. NUMBER OF ATTACKS detected in a known collection of probes 2. LEVEL OF USE at which IDPSs fail - Evaluation of IDS might read: at 100 Mb/s, IDS was able to detect 97% of directed attacks - Since developing this collection can be tedious, most IDS vendors provide testing mechanisms that verify systems are performing as expected - Regression Testing - hardness testing - hypothesis testing
Statistical Anomaly-based IDS - Also known as behavior-based detection, an IDPS detection method that compares current data and traffic patterns to an established baseline of normalcy.
- The statistical anomaly-based IDPS (stat IDPS) or behaviorbased IDPS sample network activity to COMPARE TO traffic that is known to be NORMAL -When measured activity is outside baseline parameters or clipping level, IDPS will trigger an alert - stat IDPS CAN DETECT NEW types of ATTACKS - Requires much MORE OVERHEAD and processing capacity than signature-based -May generate many FALSE POSITIVES
Raise Alarms
- alert administrators - trigger defense mechanism if available
React to attacks
- disconnect attack channels - Quarantine infected systems
log events
- for Forensics and security auditing
signature-based IDPS disadvantages
- low detection for zero-day attacks - continual maintenance - high performance requirements for on-line systems - reactive
IDPS Detection Methods
- signature-based - statistical anomaly-based
Fingerprinting - The systematic survey of a targeted organization's Internet addresses collected during the footprinting phase to identify the network services offered by the hosts in that range.
- systematic survey of all available applications (open ports) on all footprinted hosts. - Fingerprinting may also reveals useful information about internal structure and operational nature of the network or business
Signature-Based IDS - Also known as knowledge-based detection or misuse detection, the examination of system or network data in search of patterns that match known attack signatures
-Examine data traffic in SEARCH OF PATTERNS that match known signatures -WIDELY USED because many attacks have clear and distinct signatures -Problem with this approach is that as new attack strategies are identified, the IDS's database of signatures must be CONTINUALLY UPDATED
advantages of NIDPSs
-Good network design and placement of NIDPS can enable organization to use a few devices to monitor large network - NIDPSs are usually passive and can be deployed into existing networks with little disruption to normal network operations - NIDPSs not usually susceptible to direct attack and may not be detectable by attackers
NIDS Signature Matching
-To detect an attack, NIDPSs LOOK FOR ATTACK PATTERNS -implemented using SPECIAL IMPLEMENTATION OF TCP/IP DRIVER: -In process of protocol stack verification, NIDSs look for INVALID DATA PACKETS
Network-Based IDPS (NIDPS) - An IDPS that resides on a computer or appliance connected to a segment of an organization's network and monitors traffic on that segment, looking for indications of ongoing or successful attacks.
-a COMPUTER OR APPLIANCE -specific network locations to monitor traffic going on a PARTICULAR NETWORK SEGMENT -When EXAMINING PACKETS, a NIDS looks for attack patterns
IDPS deployment options
-network-based - host-based - or, application-based systems
Selecting IDPS Approaches and Products
1. Technical and policy considerations What is your systems environment? What are your specific security goals and objectives? What is your existing security policy? What enhancements are needed? 2. Organizational requirements and constraints What is our budget? Does infrastructure exist? Do we have the talent? Can we buy it? What are business requirements from outside the local organization? internal audit, accreditation, record retention requirements? Public access requirements?
NIDPS deployment - The placement of the sensor agents is critical to the operation of all IDPSs, but especially for NIDPSs. NIST recommends the following four locations for NIDPS sensors, as illustrated in Figure 7-7 (S16)
Location1- Behind each external firewall, in the network DMZ. L2-Outside an external firewall. L3-On major network backbones. L4- On critical subnets.
padded cell
Padded cell: honey pot that has been protected so it cannot be easily compromised - In addition to attracting attackers with tempting data, a padded cell operates in tandem with a traditional IDPS - When the IDPS detects attackers, it seamlessly transfers them to a special simulated environment where they can cause no harm—the nature of this host environment is what gives approach the name padded cell
signatures
Patterns that correspond to a known attack
stateful protocol analysis (SPA)
The comparison of vendor-supplied profiles of protocol use and behavior against observed data and network patterns in an effort to detect misuse and attacks.
false negative
The failure of an IDS system to react to an actual attack event.
attack surface
The functions and features that a system exposes to unauthenticated users.
intrusion detection and prevention system (IDPS)
The general term for both intrusion detection systems and intrusion prevention systems.
Confidence value
The measure of an IDPS's ability to correctly detect and identify certain types of attacks
Evasion
The process by which attackers change the format and/or timing of their activities to avoid being detected by an IDPS
Alarm filtering
The process of classifying IDPS alerts so they can be more effectively managed
protocol stack verification
The process of examining and verifying network traffic for invalid data packets—that is, packets that are malformed under the rules of the TCP/IP protocol.
application protocol verification
The process of examining and verifying the higher-order protocols (HTTP, FTP, and Telnet) in network traffic for unexpected packet behavior or improper use.
Site policy
The rules and configuration guidelines governing the implementation and operation of IDPSs within the organization.
Tuning
Tuning: The process of adjusting an IDPS to maximize its efficiency in detecting true positives while minimizing false positives and false negatives.
Entrapment
action of luring an individual into committing a crime to get a conviction.
passive mode
an IDPS sensor setting in which the device simply monitors and analyzes observed network traffic.
Intrusion
an attack on information assets in which attack agent gains or attempts to gain entry into a network or system in order to disrupt or cause other harm
Intrusion prevention
defensive countermeasures which seek to prevent unauthorized network or system access
hypothesis testing
forward-looking: anticipated / unknown threats
Attack protocol - A logical sequence of steps or processes used by an attacker to launch an attack against a target system or network.
is series of steps or processes used by an attacker, in a logical sequence, to launch attack against a target system or network
known vulnerability
known vulnerability A published weakness or fault in an information asset or its protective systems that may be exploited and result in loss.
Enticement
process of attracting attention to system by placing tantalizing bits of information in key locations
signature-based IDPS rules
show custom-attack block-exe recommended-action close-client; severity major; attack-type { signature { context http-url-parsed; pattern ".*\.\[exe\]"; direction client-to-server; } }
Intrusion detection
the active screening of network and system activity for unauthorized access
Intrusion reaction
the designed steps to be undertaken in the event of a detected intrusion
Intrusion correction
the designed steps to be undertaken to restore a network or system to its normal state following an unauthorized intrusion
Footprinting - The organized research of Internet addresses owned or controlled by a target organization.
the organized research of Internet addresses owned or controlled by a target organization
back hack
the process of illegally attempting to determine the source of an intrusion by tracing it and trying to gain access to the originating system.
Scanning and Analysis Methods
useful for collecting information regarding network topology and potential vulnerabilities - but attackers can also use as information to design successful attack - Attack protocol - Footprinting - Fingerprinting Fingerprinting/Footprinting are also legitimate and valuable tools for pinpointing system and network vulnerabilities
Tools Used with IDPS
• honey pots / honey nets • padded cells • trace systems • port scanners • packet sniffers
clipping level
A predefined assessment level that triggers a predetermined response when surpassed. Typically, the response is to notify an administrator.
Alarm clustering and compaction
A process of grouping almost identical alarms that occur nearly at the same time into a single higher-level alarm
passive vulnerability scanner
A scanner that listens in on a network and identifies vulnerable versions of both server and client software
intrusion detection system (IDS)
A system capable of automatically detecting an intrusion into an organization's networks or host systems and notifying a designated authority
Noise
Alarm events that are accurate and noteworthy but do not pose significant threats to information security.
monitoring port
Also known as a switched port analysis (SPAN) port or mirror port, a specially configured connection on a network device that can view all the traffic that moves through the device.
fully distributed IDPS control strategy
An IDPS implementation approach in which all control functions are applied at the physical location of each IDPS component.
centralized IDPS control strategy
An IDPS implementation approach in which all control functions are implemented and managed in a central location
partially distributed IDPS control strategy
An IDPS implementation approach that combines the best aspects of the centralized and fully distributed strategies.
inline sensor
An IDPS sensor intended for network perimeter use and deployed in close proximity to a perimeter firewall to detect incoming attacks that could overwhelm the firewall.
Site policy awareness
An IDPS's ability to dynamically modify its configuration in response to environmental activity
intrusion prevention system (IPS)
An IDS system capable of automatically responding to a detected intrusion and preventing it from successfully attacking the organization by means of an active response.
false positive
An alarm indicating an attack when in fact there was no such attack.
pen register
An application that records information about outbound communications.
active vulnerability scanner
An application that scans networks to identify exposed usernames and groups, open network shares, configuration problems, and other vulnerabilities in servers.
log file monitor (LFM)
An attack detection method that reviews the log files generated by computer systems, looking for patterns and signatures that may indicate an attack or intrusion is in process or has already occurred.
True attack stimulus
An event that triggers an alarm and causes an IDPS to react as if a real attack is in progress.
False attack stimulus
An event that triggers an alarm when no actual attack is in progress
Alert or alarm
An indication that a system has just been attacked or is under attack
Measuring the Effectiveness of IDSs - summary
Current testing methods tend to be reactive effectiveness depends on network / system load having known regression testing suites is a plus having stated objectives to measure against is a plus having ability to hypothesize and test is a plus Desired
intrusion detection architecture
Defence-in-depth puts as many obstacles in the way of an intruder, so that it becomes harder to penetrate the network, and easier to detect.
Honey nets
Honey nets: collection of honey pots connecting several honey pot systems on a subnet
Honey pots
Honey pots: decoy systems designed to lure potential attackers away from critical systems and encourage attacks against the themselves