Intrusion Prevention, Detection & Response

IDS vs IPS

IDS = Intrusion detection system IPS = intrusion prevention system

IDS

Monitors a system for Malicious activities. Policy violations

not all policy violations are malicious.

IDS Categories

Two categories of IDS: A network-based IDS monitors network data

packets for malicious activity. Example: Snort, Comodo-firewall

A host-based IDS analyzes any combination of system calls, applications logs, file modifications, and other host activities. Example: Tripwire, WinPatrol, Anti-Virus software

Passive vs Reactive IDS

Passive IDS

Logs the possible intrusion, and sends an alert. The alert could be an e-mail to SA staff; or posting

the alert on a monitored console (or both). This is how Tripwire behaves.

Reactive IDS

The reactive IDS, (aka IPS), would respond to an intrusion with a pre-configured defense strategy in real time.

Snort, e-mail filters, and many anti-virus packages can be configured to be reactive.

Revised Taxonomy

Revised Taxonomy for IDS vs IPS IDS is either Passive or Reactive.

An IPS prevents intrusions.

IPS (Revised Taxonomy)

Passwords Login Server (example: Kerberos) Firewalls : Consists of a combination of

hardware and software. Access controls applied to hardware, software,

and data. Physical security

IPS (Revised Taxonomy)

In Summary, the IPS is a barrier. The IDS is needed when the IPS barrier is

breached.

IPS : Firewall

A combination of software and hardware used to implement security policies governing the network traffic between two or more networks.

A firewall is a system used to enforce network traffic security policy.

IPS: Firewall System

1. Design the system

2. Acquire the hardware and software

3. Acquire training, documentation and support

4. Install and configure the system

5. Test the system

6. Maintain the system (sustainability cycle)

IPS : Other Systems

Implement Access controls Physical security Login Server

IPS Access Controls

Windows Professional provides access control lists.

Unix/Linux has a simple access control system: User, Group, World + read, write, execute

Princeton study showed that complex access controls lead to mis-configuration. Proper training is essential.

IPS : Physical Security

Previously covered: Locks on doors, limited access, keycards, proximity

badges, etc

IPS : Login Server

Kerberos is a common login server that goes beyond the user-id & password authentication process.

Kerberos was developed at MIT

Kerberos

Intrusion Detection Data: Characterization Information

Collect characterization information, CI. Characterization information must be monitored

regularly

IDS : Characterization Info

System logs File checksums System performance metrics provided by

system monitoring applications Expected activities by users and applications

CI : System Logs

System logs require

1) access controls

2) back-up

3) encrypted.

Unix/Linux/var/log

MS Windowssystemroot\WINDOWS\System32\Config\*.evt

Enable event logging and use the event viewer (eventvwr.msc)

System Log Files

• Log files can grow and use up space.

• Log files should periodically be backed-up then removed to make space for new log information.

Checksums

Tripwire creates a database of checksums for a list of specified files (data, source, binary, etc).

The data base of checksums acts as a baseline for comparison.

Common checksum algorithms:

MD5

SHA

CRC

System Performance Metrics

Server/computer system metrics Network activity metrics

System Resource CI

Report the top resource users (examples: top, sysstat)

CPU time usage

Memory usage (example: free)

Number of active processes (by all user-ids, including system ids)

Number of active open files

Number of files

IO data transfer

Disk space usage and free space

IO transfer rate

Other devices used by processes

Login sessions

Login attempts

Network Resource CI

Connection attempts Connection duration Number of connections Source & destination of data packets Bandwidth usage (by user and total) Transfer rates Error counts

E-mail CI

Number of sent messages Number of received messages Mail message sizes read/unread message count

Consider logs of other possible communication devices like telephones and company issued cell phones.

System Security Logging & Auditing Documentation

Document the characterization information to collect

log files

network CI

computing system CI, etc.

Document which events should produce an alert

Document system and application updates

Document roles and responsibilities of SA staff.

Document a sustainability cycle

Document an intrusion detection response

Intrusion Response Team

Create a security response team Document the responsibilities of the intrusion

response team members Document a contact list for the team Update the documentation regularly

(sustainability cycle) Document what to do in an emergency.