1 / 30

Intrusion Prevention, Detection & Response

Intrusion Prevention, Detection & Response. IDS vs IPS. IDS = Intrusion detection system IPS = intrusion prevention system. IDS. Monitors a system for Malicious activities. Policy violations not all policy violations are malicious. IDS Categories. Two categories of IDS:

lovie
Download Presentation

Intrusion Prevention, Detection & Response

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Intrusion Prevention, Detection & Response

  2. IDS vs IPS • IDS = Intrusion detection system • IPS = intrusion prevention system

  3. IDS • Monitors a system for • Malicious activities. • Policy violations • not all policy violations are malicious.

  4. IDS Categories • Two categories of IDS: • A network-based IDS monitors network data packets for malicious activity. • Example: Snort, Comodo-firewall • A host-based IDS analyzes any combination of system calls, applications logs, file modifications, and other host activities. • Example: Tripwire, WinPatrol, Anti-Virus software

  5. Passive vs Reactive IDS

  6. Passive IDS • Logs the possible intrusion, and sends an alert. • The alert could be an e-mail to SA staff; or posting the alert on a monitored console (or both). This is how Tripwire behaves.

  7. Reactive IDS • The reactive IDS, (aka IPS), would respond to an intrusion with a pre-configured defense strategy in real time. Snort, e-mail filters, and many anti-virus packages can be configured to be reactive.

  8. Revised Taxonomy • Revised Taxonomy for IDS vs IPS • IDS is either Passive or Reactive. • An IPS prevents intrusions.

  9. IPS (Revised Taxonomy) • Passwords • Login Server (example: Kerberos) • Firewalls : Consists of a combination of hardware and software. • Access controls applied to hardware, software, and data. • Physical security

  10. IPS (Revised Taxonomy) • In Summary, the IPS is a barrier. • The IDS is needed when the IPS barrier is breached.

  11. IPS : Firewall • A combination of software and hardware used to implement security policies governing the network traffic between two or more networks. A firewall is a system used to enforce network traffic security policy.

  12. IPS: Firewall System • Design the system • Acquire the hardware and software • Acquire training, documentation and support • Install and configure the system • Test the system • Maintain the system (sustainability cycle)

  13. IPS : Other Systems • Implement • Access controls • Physical security • Login Server

  14. IPS Access Controls • Windows Professional provides access control lists. • Unix/Linux has a simple access control system: • User, Group, World + read, write, execute • Princeton study showed that complex access controls lead to mis-configuration. Proper training is essential.

  15. IPS : Physical Security • Previously covered: • Locks on doors, limited access, keycards, proximity badges, etc

  16. IPS : Login Server • Kerberos is a common login server that goes beyond the user-id & password authentication process. • Kerberos was developed at MIT

  17. Kerberos

  18. Intrusion Detection Data: Characterization Information • Collect characterizationinformation, CI. • Characterization information must be monitored regularly

  19. IDS : Characterization Info • System logs • File checksums • System performance metrics provided by system monitoring applications • Expected activities by users and applications

  20. CI : System Logs • System logs require 1) access controls 2) back-up 3) encrypted. • Unix/Linux /var/log • MS Windows systemroot\WINDOWS\System32\Config\*.evt • Enable event logging and use the event viewer (eventvwr.msc)

  21. System Log Files • Log files can grow and use up space. • Log files should periodically be backed-up then removed to make space for new log information.

  22. Checksums • Tripwire creates a database of checksums for a list of specified files (data, source, binary, etc). The data base of checksums acts as a baseline for comparison. • Common checksum algorithms: MD5 SHA CRC

  23. System Performance Metrics • Server/computer system metrics • Network activity metrics

  24. System Resource CI • Report the top resource users (examples: top, sysstat) • CPU time usage • Memory usage (example: free) • Number of active processes (by all user-ids, including system ids) • Number of active open files • Number of files • IO data transfer • Disk space usage and free space • IO transfer rate • Other devices used by processes • Login sessions • Login attempts

  25. Network Resource CI • Connection attempts • Connection duration • Number of connections • Source & destination of data packets • Bandwidth usage (by user and total) • Transfer rates • Error counts

  26. E-mail CI • Number of sent messages • Number of received messages • Mail message sizes • read/unread message count • Consider logs of other possible communication devices like telephones and company issued cell phones.

  27. System Security Logging & Auditing Documentation • Document the characterization information to collect log files network CI computing system CI, etc. • Document which events should produce an alert • Document system and application updates • Document roles and responsibilities of SA staff. • Document a sustainability cycle • Document an intrusion detection response

  28. Intrusion Response Team • Create a security response team • Document the responsibilities of the intrusion response team members • Document a contact list for the team • Update the documentation regularly (sustainability cycle) • Document what to do in an emergency.

More Related