Guide to Network Defense and Countermeasures Second Edition

Guide to Network Defense and Countermeasures Second Edition Chapter 7 Intrusion Detection System Concepts

Objectives • Identify the components of an intrusion detection system • Explain the steps of intrusion detection • Describe options for implementing intrusion detection systems • Evaluate different types of IDS products Guide to Network Defense and Countermeasures, Second Edition

Examining Intrusion Detection System Components • Network intrusion • Attempt to gain unauthorized access to network resources • Intrusion Detection System (IDS) • Consists of more than one application or hardware device • Incorporates more than just detection • Intrusion Detection • Involves prevention, detection, and response Guide to Network Defense and Countermeasures, Second Edition

Guide to Network Defense and Countermeasures, Second Edition

Examining Intrusion Detection System Components (continued) • Components • Network sensors • Alert systems • Command console • Response system • Database of attack signatures or behaviors Guide to Network Defense and Countermeasures, Second Edition

Network Sensors • Sensor • Electronic “eyes” of an IDS • Hardware or software that monitors traffic in your network and triggers alarms • Attacks detected by an IDS sensor • Single-session attacks • Multiple-session attacks • IDS types • Host-based IDS • Network-based IDS Guide to Network Defense and Countermeasures, Second Edition

Network Sensors (continued) • Sensors should be placed at common-entry points • Internet gateways • Connections between one LAN and another • Remote access server that receives dial-up connections from remote users • Virtual private network (VPN) devices • Management program controls sensors • Sensors could be positioned at either side of the firewall • Behind the firewall is a more secure location Guide to Network Defense and Countermeasures, Second Edition

Alert Systems • Trigger • Circumstances that cause an alert message to be sent • Types of triggers • Detection of an anomaly • Detection of misuse Guide to Network Defense and Countermeasures, Second Edition

Alert Systems (continued) • Anomaly detection • Requires you to make use of profiles • For each authorized user or group of users • Describe services and resources normally accessed by users • Some IDSs can create user profiles • During “training period” • Accuracy problems • False negatives • False positives Guide to Network Defense and Countermeasures, Second Edition

Alert Systems (continued) • Misuse detection • Triggers alarms based on characteristic signatures of known attacks • IDS comes equipped with a set of signatures • Can start protecting the network immediately • Need to maintain state information • Other detection mechanisms • Traffic rate monitoring • Protocol state tracking • IP packet reassembly Guide to Network Defense and Countermeasures, Second Edition

Command Console • Provides a graphical front-end interface to an IDS • Enables administrators to receive and analyze alert messages and manage log files • IDS can collect information from security devices throughout a network • Command console should run on a computer dedicated solely to the IDS • To maximize the speed of response Guide to Network Defense and Countermeasures, Second Edition

Response System • IDS can be setup to take some countermeasures • Response systems do not substitute network administrators • Administrators can use their judgment to distinguish a false positive • Administrators can determine whether a response should be escalated • Increased to a higher level Guide to Network Defense and Countermeasures, Second Edition

Database of Attack Signatures or Behaviors • IDSs don’t have the capability to use judgment • Can make use of a source of information for comparing the traffic they monitor • Misuse detection • References a database of known attack signatures • If traffic matches a signature, it sends an alert • Keep database updated • Passive detection mode • Anomaly-based IDS • Store information about users in a database Guide to Network Defense and Countermeasures, Second Edition

Examining Intrusion Detection Step by Step • Steps • Installing the IDS database • Gathering data • Sending alert messages • The IDS responds • The administrator assesses damage • Following escalation procedures • Logging and reviewing the event Guide to Network Defense and Countermeasures, Second Edition

Step 1: Installing the IDS Database • IDS uses the database to compare traffic detected by sensors • Anomaly-based systems • Require a training period (over a week) • IDS observes traffic and compile a network baseline • Misuse-based IDS • Can use database immediately • You can provide it with your own database Guide to Network Defense and Countermeasures, Second Edition

Step 2: Gathering Data • Network sensors gather data by reading packets • Sensors need to be positioned where they can capture all packets • Sensors on individual hosts capture information that enters and leaves the host • Sensors on network segments read packets as they pass throughout the segment • Sensors on network segments cannot capture all packets • If traffic levels become too heavy Guide to Network Defense and Countermeasures, Second Edition

Step 3: Sending Alert Messages • Sensors capture packets • IDS software compares captured packets with information in its database • IDS sends alert messages • If captured packets match an attack signature or • Deviates from normal network behavior Guide to Network Defense and Countermeasures, Second Edition

Step 4: The IDS Responds • Command console receives alert messages • Notifies the administrator • IDS can be configured to take actions when a suspicious packet is received • Send an alarm message • Drop the packet • Stop and restart network traffic Guide to Network Defense and Countermeasures, Second Edition

Step 5: The Administrator Assesses Damage • Administrator monitors alerts • And determines whether countermeasures are needed • Administrator need to fine-tune the database • The goal is avoiding false negatives • Line between acceptable and unacceptable network use is not always clear Guide to Network Defense and Countermeasures, Second Edition

Step 6: Following Escalation Procedures • Escalation procedures • Set of actions to be followed if the IDS detects a true positive • Should be spelled out in company’s security policy • Incident levels • Level One • Might be managed quickly • Level Two • Represents a more serious threat • Level Three • Represents the highest degree of threat Guide to Network Defense and Countermeasures, Second Edition

Step 7: Logging and Reviewing the Event • IDS events are stored in log files • Or databases • Administrator should review logs • To determine patterns of misuse • Administrator can spot a gradual attack • IDS should also provide accountability • Capability to track an attempted attack or intrusion back to the responsible party • Some systems have built-in tracing features Guide to Network Defense and Countermeasures, Second Edition

Options for Implementing Intrusion Detection Systems • Network-based IDS • Host-base IDS • Hybrid implementations Guide to Network Defense and Countermeasures, Second Edition

Network-Based Intrusion Detection Systems • Locating an NIDS on the Network • Network-based IDS (NIDS) • Monitors network traffic • Common locations for NIDS sensors • Behind the firewall and before the LAN • Between the firewall and the DMZ • Any network segment • Management and analysis software must be installed on a dedicate computer • Positioning sensors at network perimeter • Enables IDS to sniff traffic Guide to Network Defense and Countermeasures, Second Edition

Network-Based Intrusion Detection Systems (continued) • Advantages and disadvantages of NIDS • NIDS handles a high volume of traffic • Requires dedicated hardware appliance Guide to Network Defense and Countermeasures, Second Edition

Host-Based Intrusion Detection Systems • Host-based IDS (HIDS) • Deployed on a host in the LAN • Protected by the firewall • Evaluates traffic generated by the host • Gathers system variables such as • System processes • CPU use • File accesses • Does not sniff packets as they enter the LAN Guide to Network Defense and Countermeasures, Second Edition

Host-Based Intrusion Detection Systems (continued) • Configuring an HIDS • Centralized configuration • HIDS sends all data to a central location • Host’s level of performance is unaffected by the IDS • Alert messages that are generated do not occur in real time • Distributed configuration • Processing of events is distributed between host and console • Host generates and analyzes it in real time • Performance reduction in host Guide to Network Defense and Countermeasures, Second Edition

Host-Based Intrusion Detection Systems (continued) • Choosing the host computer • Centralized configuration • RAM, hard disk memory, and processor speed requirements are minimal • Distributed configuration • Host should be equipped with maximum memory and processor speed Guide to Network Defense and Countermeasures, Second Edition

Host-Based Intrusion Detection Systems (continued) • Advantages and disadvantages of HIDSs • Advantages • Detect events on host systems • Can process encrypted traffic • Not affected by use of switched network protocols • Can compare records stored in audit logs Guide to Network Defense and Countermeasures, Second Edition

Host-Based Intrusion Detection Systems (continued) • Disadvantages • More management issues • Vulnerable to direct attacks and attacks against host • Susceptible to some denial-of-service attacks • Can use large amounts of disk space • Could cause increased performance overhead on host Guide to Network Defense and Countermeasures, Second Edition

Hybrid IDS Implementations • Hybrid IDS • Combines the features of HIDSs and NIDSs • Gains flexibility and increases security • Combining IDS sensor locations • Put sensors on network segments and network hosts • Can report attacks aimed at particular segments or the entire network Guide to Network Defense and Countermeasures, Second Edition

Hybrid IDS Implementations (continued) • Combining IDS detection methods • IDS combines anomaly and misuse detection • Database enables IDS to run immediately • Anomaly-based systems keep the alert system flexible • Can respond to the latest, previously unreported attacks • Both external and internal attacks • Administrators have more configuration and coordination work to do Guide to Network Defense and Countermeasures, Second Edition

Hybrid IDS Implementations (continued) • Shim IDS • Acts like a type of NIDS • Involves sensors being distributed around a network • Data collected by sensors is sent to a central location • Sensors are installed in selected hosts and network segments • Those that require special protection Guide to Network Defense and Countermeasures, Second Edition

Hybrid IDS Implementations (continued) • Distributed IDS • Multiple IDS devices are deployed on a network • Reduces response time • Two popular DIDSs • myNetWatchman • DShield Guide to Network Defense and Countermeasures, Second Edition

Hybrid IDS Implementations (continued) • Advantages • Combine aspects of NIDS and HIDS configurations • Can monitor network as a whole • Can monitor attacks that reach individual hosts • Disadvantages • Need to get disparate systems to work in coordinate fashion • Data gathered by multiple systems can be difficult to absorb and analyze Guide to Network Defense and Countermeasures, Second Edition

Evaluating Intrusion Detection Systems • Survey various options and match them to your needs • Review topology of your network identifying • Number of entry points • Use of firewalls • Number of network segments • Evaluating IDSs can be time consuming Guide to Network Defense and Countermeasures, Second Edition

Freeware NIDS: Snort • Ideal for monitoring traffic on a small network or individual host • Does not consume extensive system resources • Intended for installation on a computer at network perimeter • Comes with a collection of rule files • Separate rules exist for • Port scans • Back door attacks • Web attacks Guide to Network Defense and Countermeasures, Second Edition

Commercial HIDS: Norton Internet Security • Firewall designed to protect a home-based standalone computer • Or a computer on a small network • Contains a limited number of intrusion detection features • Block port scans • Block attack attempts on ports used by known Trojan programs • Can be trained to identify normal network use • Alert messages appear as pop-up windows Guide to Network Defense and Countermeasures, Second Edition

Guide to Network Defense and Countermeasures Second Edition