1. Lesson 7 Intrusion Prevention Systems

2. UTSA IS 3523 ID & Incident Response Overview Definitions Differences Honeypots Defense in Depth

3. UTSA IS 3523 ID & Incident Response Intrusion Detection Systems IDS – “Combination of Hardware and Software Designed to Detect Suspect Activity on a Network” Types of IDS Solutions and Deployments –Network, Host and Application Detection Methods –Signature, Anomaly and Behavior Based IDS Evolution – Three Evolutions of IDS Products and Solutions –Detect, Shore-Up and Proactively Block (IPS)

4. UTSA IS 3523 ID & Incident Response What Should an IDS Do Detect scans against a network –Helps determine who might attack Provide info on DoS attacks Alert on possible worm infections Alert administrator about brute force, password cracks, dictionary attacks, etc. Block Some Worms –Code Red, Nimda, SQL Slammer – If Linked to a Firewall

5. UTSA IS 3523 ID & Incident Response IDS Challenges Performance –Network Based IDS Systems must handle large throughput, i.e. large amounts of packets Reliability - false positives plague early IDS –Misnomer: “bad string development” Cost –Extensive IDS Deployments Can Be a expensive Labor intensive –IDS tuning and maintenance requires much expertise Host based IDS systems can use up lots of resources on their hosts

6. UTSA IS 3523 ID & Incident Response Intrusion Prevention Systems HW/SW that pro-actively block attacks –Little or no human intervention Normally stand alone solutions but may integrate with firewalls, switches or routers Usually less maintenance than traditional IDS Usually requires more set-up—have to know your network traffic May be network or host based Emerging sub-sector of IDS market

7. UTSA IS 3523 ID & Incident Response What an IPS Can Do Detect and Block Network Block DoS attacks in real time Completely stop nuisance attacksBlock Worm propagation

8. UTSA IS 3523 ID & Incident Response Intrusion Detection –vs- Intrusion Prevention Often viewed as a blending of firewalls and IDS Definition: A device (HW or SW) that has the ability to detect an attack and to prevent the attack from being successful. –Must handle known and unknown attack methods Will look at 4 general types of IPS –Inline NIDS –Layer Seven Switches –Application Firewall/IDS –Deceptive Applications

9. Inline NIDS From: http://www.securityfocus.com/infocus/1670 Offers the capabilities of a regular NIDS with the blocking capabilities of a firewall. Examines traffic, decides whether to send it on or not. Generally needs to know what it is looking for (e.g. signatures).

10. UTSA IS 3523 ID & Incident Response Layer Seven Switch Usually think of switching as a layer 2 function. Due to bandwidth intensive content, some switching now going on a layer seven (e.g. load balancers) where application traffic can be examined. Decisions can be made as to whether data is sent. Generally needs to know what it is looking for. One of best uses is to address DoS attacks.

11. UTSA IS 3523 ID & Incident Response Application Firewall/IDS Loaded on each server to be protected. Customized for the application to be protected. Don’t look at packets, look at API calls, memory management (for overflows), and interaction of user with OS. Can help prevent new attacks since it is not looking for signatures but rather attempted actions.

12. UTSA IS 3523 ID & Incident Response Deceptive Applications Idea has been around for a while Concept is to first watch network to determine profile of normal traffic If traffic comes along later, such as scan for a service on a system that doesn’t exist, then respond with bogus data so packets are “marked” and future traffic from attacker will be noticed and handled easily.

13. Deceptive Applications No system 10.1.1.20! From: http://www.securityfocus.com/infocus/1670

14. UTSA IS 3523 ID & Incident Response Network Commercial IPS Cisco Secure IDS (son of Netranger) ISS Proventia NetScreen IDP-500 McAfee Intrushield 4000 TippingPoint UnityOne -1200 TopLayer Mitigator IPS-2400

15. UTSA IS 3523 ID & Incident Response

16. IPS Pictures http://www.nss.co.uk/ips/edition1/nai-intrushield/fig1-Group_all.png http://www.iss.net/products_services/enterprise_protection/proventia/g _series.php

17. UTSA IS 3523 ID & Incident Response Honey Pot New Player..not quite an IDS, but results are the same Decoy System Mislead Hackers Begin Incident Response (early!)

18. UTSA IS 3523 ID & Incident Response Defense-in-Depth Key Security Concept Usually considered in shallow ways We don’t so good job implementing organization wide Very seldom do we simultaneously simplify and improve security

19. UTSA IS 3523 ID & Incident Response 5 Different Control Types Protect - firewalls/router ACLs Detect - IDSes Recover - Incident Response/Recovery Plans Deter - Laws and marketing Transfer - Insurance

20. UTSA IS 3523 ID & Incident Response Problem with Approaches Each control has binary effectiveness No security is perfect Better approach is “synergistic security” –Success hinges on redundancy of security controls

21. UTSA IS 3523 ID & Incident Response Security Synergy Baye’s Theorem: –Effectivness (TOTAL) = 1-((1-E1)*(1-E2)*(1-E3)…) #Synergistic ControlsEfficiency of Each Control 60%70%80%90% 160 708090 284919699 393.697.399.299.9 494.799.299.8100 59999.8100100

22. UTSA IS 3523 ID & Incident Response The Challenge “The real challenge is for people who can write good models for the data that comes out. The problem we have is that different enterprise networks create quite different traffic. Trying to model it and pull out interesting patterns with it while minimizing false positives and things like that, is very difficult. Bob Gleichauf Cisco Systems

23. UTSA IS 3523 ID & Incident Response Summary IDSes are still maturing IDSes are not silver bullets…they cannot overcome inherent security weaknesses But, IDSes are usually the primary “detectors” to start the incident response process Synergistic Security (Defense-in-depth) is the key