Presentation is loading. Please wait.

Presentation is loading. Please wait.

Security Technology: Intrusion Detection, Access Control and Other Security Tools Chapter 7.

Similar presentations


Presentation on theme: "Security Technology: Intrusion Detection, Access Control and Other Security Tools Chapter 7."— Presentation transcript:

1 Security Technology: Intrusion Detection, Access Control and Other Security Tools Chapter 7

2 Intrusion “Intrusion is a type of attack on information assets in which the instigator attempts to gain entry into a system or disrupt the normal operation of system with, almost always, the intent to do malicious harm.”

3 Definitions  Intrusion prevention: activities that deter an intrusion  Writing &implementing a good enterprise information security policy  Planning & executing effective information security programs  Installing & testing technology-based countermeasures  Conducting & measuring the effectiveness  Employee training and awareness activities  Intrusion detection: procedures and systems that identify sys intrusions  Intrusion correction:  Activities finalize the restoration of operations to a normal state  Activities seek to identify the source & method of attack for prevention

4 Intrusion Detection Systems  Commercially available in late 1990  Works like a burglar alarm  Detects a violation and sounds alarm  Extension – Intrusion prevention systems  Detect and prevent intrusion  Generally accepted combination  Intrusion detection and prevention system (IDPS)

5 IDPS Terminology  Alarm or alert: indication that attack is happening  Evasion: attacker change the format and/or timing of activities to avoid being detected  False attack stimulus: event triggers alarm – no real attack  False negative: failure of IDPS to react to attack  False positive: alarm activates in the absence of an actual attack  Noise: alarms events that are accurate but do not pose threats  Site policy: rules & configuration guidelines governing the implementation & operation of IDPS

6 IDPS Terminology  Site policy awareness: ability to dynamically modify config in response to environmental activity  True attack stimulus: event that triggers alarms in event of real attack  Tuning: adjusting an IDPS  Confidence value: measure IDPS ability correctly detect & identify type of attacks  Alarm filtering: Classification of IDPS alerts  Alarm clustering and compaction: grouping almost identical alarms happening at close to the same time

7 Why Use an IDS  Prevent problem behaviors by increasing the perceived risk of discovery and punishment  Detect attacks and other security violations  Detect and deal with preambles to attacks  Document existing threat to an organization  Act as quality control for security design & administration  Provide useful information about intrusions that take place

8 Types of IDS  Network based  Focused on protection network information assets  Wireless  Network behavior analysis  Host-based  Focused on protection server of host’s information assets

9 Network-Based  Resides on computer or appliance connected to an a segment of orgs. network  Monitors network traffic on the segment  Monitors packets  Monitoring port (switched port analysis)  Monitors all ingoing and outgoing traffic  Looks for attack patterns  Compares measured activity to known signatures  Protocol verification – packet structure  Application verification – packet use

10 Advantages and Disadvantages Advantages Needs few devices to monitor large network Little or no disruption to normal operations May not be detectable by attackers Disadvantages Overwhelmed by network volume Requires access to all traffic Cannot analyze encrypted packets Cannot ascertain if an attack was successful Some forms of attack are not easily discerned Fragmented packets Malformed packets

11 Wireless NIDPS  Monitors and analyzes wireless network traffic  Looks for potential problems with the wireless protocols (layers 2 and 3)  Cannot evaluate & diagnose issue with higher level layers  Issues associated with implementation  Physical security  Sensor range  Access point and wireless switch locations  Wired network connections  Cost

12 Wireless NIDPS  Can detect conditions in addition to traditional types of IDSPS  Unauthorized WLAN and WLAN devices  Poorly secured WLAN devices  Unusual usage patterns  The use of wireless network scanners  DoS attacks and condition  Man-in-middle attacks  Unable to detect  Passive wireless protocol attacks  Susceptible to evasion techniques  Susceptible to logical and physical attacks on wireless access point

13 Host-Based  Resides on a particular computer or server & monitors traffic only on that system  Also known as system integrity verifiers  Works on principle of configuration and change management  Classifies files in categories & applies various notification actions based on rules  Maintains own log file  Can monitor multiple computers simultaneously

14 Advantages  Reliable  Can detect local events  Operates on host system where encrypted files already decrypted and available  Use of switched network protocols does not affect  Can detect inconsistencies in how application and system programs were used

15 Disadvantages Pose more management issues Configured and maintained on each host Vulnerable both to direct attacks and attacks against the host operating system Not optimized to detect multi-host scanning

16 Disadvantages Not able to detect scanning of non-host devices (routers and switches) Susceptible to Denial of Service attacks Can use large amounts of disk space – audit logs Can inflict a performance overhead on host systems

17 Application Based  Examines application for abnormal events  Looks for files created by application  Anomalous occurrences – user exceeding authorization  Tracks interaction between users and applications  Able to tract specific activity back to individual user  Able to view encrypted data  Can examine encryption/decryption process

18 Advantages & Disadvantages  Advantages  Aware of specific users  Able to operate on encrypted data  Disadvantages  More susceptible to attack  Less capable of detecting software tampering

19 IDS Methodologies  Types determined by where placed for monitoring purposes  IDS methodologies based on detection methods  Two dominate methodologies  Signature-based (knowledge-based)  Statistical-anomaly approach

20 Signature Based  Examines data traffic in search of patterns that match known signature  Foot printing and fingerprinting activities  Specific attack sequences  DOS  Widely used  Signature database must be continually updated  Attack time-frame sometimes problematic  Slow and methodical may slip through

21 Statistical Anomaly Based  Based on frequency on which network activities take place  Collect statistical summaries of “normal” traffic to form baseline  Measure current traffic against baseline  Traffic outside baseline will generate alert  Can detect new type of attacks  Requires much more overhead and processing capacity  May not detect minor changes to baseline

22 Log file Monitors  Similar to NIDS  Reviews logs  Looks for patterns & signatures in log files  Able to look at multiple log files from different systems  Large storage requirement

23 Responses to IDS  Vary according to organization policy, objectives, and system capabilities  Administrator must be careful not to increase the problem  Responses active or passive

24 Which One?  Consider system environment  Technical specification of systems environment  Technical specification of current security protections  Goals of enterprise  Formality of system environment and management culture

25 Which One?  Consider Security Goals and Objectives  Protecting from threats out organization?  Protecting against inside?  Use output of IDS to determine new hardware/software needs  Maintain managerial over one-security related network usage

26 Which One?  Security policy  Structure  Job descriptions of system user  Include reasonable use policy  What are you going to do if violation occurs

27 Which One?  Organization Requirements and Constraints?  Outside Requirements  Resource Constraints  Features and Quality  Tested Product  User Level of Expertise  Product Support

28 Strengths of IDS  Monitoring & analysis of system events & user behaviors  Testing security states of system configuration  Base lining security state of the system & track changes to baseline  Pattern recognition  Auditing and logging  Alerting  Measuring performance

29 Limitations of IDS  Compensate for weak or missing security mechanisms  Instantly report or detect during heavy operations  Detect newly published attacks  Effectively respond to sophisticated attackers  Automatic investigate  Keep attacks from circumventing them  Deal effectively with switched networks

30 Control Strategies  Centralized  Partially distributed  Fully distributed

31 Centralized  All IDS control functions are implemented and managed in a centralized location  1 management system  Advantages  Cost and control  Specialization  Disadvantage

32 Fully Distributed  Opposite of centralized  All control functions applied at the physical location of each IDS component  Each sensor/agent is best configured to deal with its own environment  Reaction to attacks sped up

33 Partially Distributed Control  Individual agents respond to local threats  Report to a hierarchical central facility  One of the more effective methods

34 Honey Pots / Honey Nets / Padded Cell Systems  Honey Pots  Decoy systems  Lure potential attackers away from critical systems  Encourages attacks against themselves  Honey Net  Collection of honey pots  Connects honey pots on a subnet  Contains pseudo-services the emulated well-known services  Filled with factious information

35 Honey Pots / Honey Nets / Padded Cell Systems  Padded Cell  Protected honey pot  IDS detects attacks and transfers to simulated environment  Monitors action of attacker

36 Trap and Trace Systems  Detect intrusion and trace incident back  Consist of honey pot or padded cell & alarm  Similar to concept of caller ID  Back-hack  Considered unethical  Legal drawbacks to trap and trace  Enticement and entrapment

37 Scanning and Analysis Tools  Help find vulnerabilities in system, holes in security components, and unsecure aspects of the network  Allow system admin to see what the attacker sees  May run into problems with ISP  Port scanners – what is active on computer  Firewall analysis tools  Operating system detection tools  Vulnerability scanners  Packet sniffers

38 Access Control Tools  Authentication – validation of users identity  4 general ways carried out  What he knows  What he has  Who he is  What he produces


Download ppt "Security Technology: Intrusion Detection, Access Control and Other Security Tools Chapter 7."

Similar presentations


Ads by Google