190 likes | 333 Views
Intrusion Detection. Prepared by: Mohammed Hussein Supervised by: Dr. Lo’ai Tawalbeh NYIT- winter 2007. WHAT IS SECURITY. ISO 7498-2 defines five security services Confidentiality (secrecy) Authentication (identify verification) Integrity Access control Users also would likely include
E N D
Intrusion Detection Prepared by: Mohammed Hussein Supervised by: Dr. Lo’ai Tawalbeh NYIT- winter 2007.
WHAT IS SECURITY • ISO 7498-2 defines five security services • Confidentiality (secrecy) • Authentication (identify verification) • Integrity • Access control • Users also would likely include • Preventing spam • Preventing denial of service • Privacy • …
Security Terminology • Vulnerabilities • security flaws in systems • Attacks • means of exploiting vulnerabilities • Countermeasures • technical or procedural means of addressing vulnerabilities or thwarting specific attacks • Threats • motivated adversaries capable of mounting attacks which exploit vulnerabilities
Types of violation • Attack • Attempts to exploit a vulnerability • Ex: denial of service, privilege escalation • Intrusion • Masquerading as another legitimate user • Misuse • User abuses privileges • Often called the “insider threat”
Intrusion “Any intentional event where an intruder gains access that compromises the confidentiality, integrity, or availability of computers, networks, or the data residing on them.” Credit: CERT-CC Security Improvement Module 8: Responding to Intrusions
Why Systems Are Vulnerable Contemporary Security Challenges and Vulnerabilities
Why Systems Are Vulnerable (Continued) Internet Vulnerabilities: • Use of fixed Internet addresses through use of cable modems or DSL • Lack of encryption with most Voice over IP (VoIP) • Widespread use of e-mail and instant messaging (IM)
Intrusion Detection and Computer Security • Computer security goals: • Confidentiality, integrity, and availability • Intrusion is a set of actions aimed to compromise these security goals • Intrusion prevention (authentication, encryption, etc.) alone is not sufficient • Intrusion detection is needed
Intrusion Examples • Intrusions: Any set of actions that threaten the integrity, availability, or confidentiality of a network resource • Examples • Denial of service (DoS): attempts to starve a host of resources needed to function correctly • Worms and viruses: replicating on other hosts
Intrusion Detection • Intrusion detection:The process of monitoring and analyzing the events occurring in a computer and/or network system in order to detect signs of security problems • Primary assumption: User and program activities can be monitored and modeled • Steps • Monitoring and analyzing traffic • Identifying abnormal activities • Assessing severity and raising alarm
IDS Architecture • Sensors (agent) • to collect data and forward info to the analyzer • network packets • log files • system call traces • Analyzers (detector) • To receive input from one or more sensors or from other analyzers • To determine if an intrusion has occurred • User interface • To enable a user to view output from the system or control the behavior of the system
Intrusion Detection Model Activity Data Source Operator Sensor Event Notification Analyser Event Sensor Response Alert Security Policy Manager Administrator Credit: IETF: Intrusion Detection Message Exchange Requirements (Internet Draft)
Intrusion Detection Systems • Detect intrusive behaviour in an automated fashion • Monitor activity both across networks (NIDS) and within hosts (HIDS) • Analyse activity for signs of intrusion • Signature based • Anomaly based • Respond to predetermined triggers by: • Blocking specific actions
Common Defense Strategies • Firewalls • Intrusion Detection Systems • Anti-virus technology (in hosts and in mail gateways) • Anti-spam technology (in hosts and in mail gateways) • Periodic penetration testing (enterprise nets) • Centralized patch management (enterprise nets) • Anti-DOS mechanisms (ISPs)
Defining Policy • Consider this example • A hospital deploys a database system for patient records. The system consists of a centralized DB server accessed by client systems in the hospital. Clients access the information through a network of connected PCs and via wireless PDAs • What sorts of policy statements can we make about the hardware? Software? Users?
Defining Policy • Possible statements • The DB server software will be kept up to date • Unused network services (ports) on the DB server will be disabled • Wireless access will employ strong cryptographic protocols • Users are prohibited from examining records of patients not in their care • Machine readable policy is very hard problem • Particularly for misfeasance (i.e. insiders)
Info • Case studyCourse :Intrusion detection and hacker exploits • Presented to: Dr . Lo’ai Tawalbeh • Homepage:http://www.isrc.qut.edu.au/about/people/aclark/questnet2003-ac-ids.ppt
Presented to: Dr. lo’ai tawalbeh • Course :Intrusion detection and hacker exploits