7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -0/17- OfficeServ 7400 Enterprise IP Solutions Quick Install Guide - Data Server – IDS Mar, 2006 OfficeServ Lab1 Samsung Electronics Co., Ltd.

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -1/17- IDS functions Real-time detection and response to network based attacks –backdoor, DoS, DDoS, anomalous network access, etc. Using web management Support almost all kinds of protocol used in Internet Intrusion detection according to risk level –High, medium, low Correspond to intrusion detection –Log audit –IP blocking as linked with firewall Report to admin using about detected attacks –5 categories : Intrusion Type, Source IP, Destination IP, Port, Port scan Rule update

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -2/17- IDS Rule Update Sourcefire VRT Certified Rules –Official rules of snort.org( –Three ways to obtain these rules: Subscribers (a charge) –Online web subscriber –Receive real-time rules updates as they are available Registered users (Free) –Online web subscriber –Can access rule updates 5days after release to subscription users Unregistered users (Free) –Receive a static ruleset at the time of each major Snort Release –CANNOT use for GWIM (limited to commercial use!)

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -3/17- IDS Rule Update Open Community Rulesets –Submitted by members of the open source community –Release to users without basic tests not to ensure that new rules will not break Snort –Distributed under the GPL –Freely available to all open source Snort users

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -4/17- Using Snort. Three main operational modes –Sniffer –Packet logger –Network Intrusion Detection System –(Forensic Data Analysis Mode)

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -5/17- WAN LAN Management PC Internal Network Untrusted Network Mail Server Internet Network Environment Trusted Terminal Important File Server Send an attack packet pattern or packet pattern similar to attack Send a packet pattern similar to attack

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -6/17- 1.A server containing important data exists in the internal network of GWIM. 2.An attack pattern of packets come from the PC terminal in the untrusted /24, /24 network which has an external anonymity. 3.The PC terminal ( ) used in a remote area supports an easy maintenance with OfficeServ In other words, a misdetection by IDS is taken into account. 4.The mail server supports SMTP with an IP ( ). Assumption

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -7/17- Filtering Setup 1.From the [Firewall]  [Management] menu, select the ‘Enable’ item and click the ‘OK’ button.

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -8/17- Configuration 1. Move to the [IDS]  [Configuration] menu, and select a device which interface is WAN and the protocol monitors only for a static network, and select whether to restrict an access from the outside according to the level when using the [IDS]  [Block Config] function. ※ The higher a level for detecting intrusion is set, the more processing load increases and the more log messages are left in the system. An access corresponding to Medium Level is notified by only a mail and an access to the remote area is not restricted. When running in the [IDS]->[Block Config] menu, IDS is executed at only a level set in the window.

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -9/ Select a required IDS rule and click the [OK] button. The window below has been applied as default: ※ For further information on each rule, refer to

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -10/17- 1.From the [IDS]  [Management] menu, click the [Run] button to execute IDS. ‘Block time’ is used to set a timeout value to release a restriction of access. If Run is executed, the blocking function of a remote data terminal which generated a type of intrusion detected by IDS is performed. However the blocking function is based on the level set in [IDS]  [Configuration]. Management ※ If IDS is running, block module is running. By default IPS is running.

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -11/17- Block Config IP Address of a Maintenance PC Hosts of the Network Where the Administrator is Located Hosts of an Untrusted Network 1.In the [IDS]  [Block Config] menu, set whether to restrict an access to the remote data terminal or network which generated a type of intrusion detection set in [IDS]  [Configuration]. 2.You can view IP information on the remote data terminal which performs a restriction of access by detecting as a intrusion type in IDS. In the following window, you can view the results of the misdetected IP address of a maintenance PC:

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -12/ To register trusted IPs, enter an IP address of a maintenance PC. This allows the maintenance PC restricted to the access to the ‘Blocked IPs’ to enable accessibility. shows a registration of only a PC and shows a registration of all network hosts to which an administrator IP belongs.

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -13/ If you select the [IDS]  [Log Analysis] menu, the window below appears that analyzes the left messages whose intrusion type is detected by IDS according to source address, destination address, risk level, service port information and intrusion type. Basically, all categories are set ‘all’, but you can select and check a desired log. Log Analysis Default ‘all’

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -14/ If you set as shown in below to check a log corresponding to the security level ‘med’ among logs that a host with an IP ‘ ’ accesses the IP ‘ ’, http(80) port, you can view the results as shown in.

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -15/17- Mail Config 1. Click the [IDS]  [Mail Config] menu to send the result message on intrusion detected by IDS to the set mail address by mail. Mail Server IP Address SMTP Port Information Mail Address Set to send a mail at 5 p.m. every day

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -16/17- Rule Update 1. If you click [Rule Config] from the left menu, you can update a ruleset. To update a ruleset click ‘browse’ button and select the desired rule file on your PC. GWIM IDS spec (based v1.25) 

7400 Samsung Confidential & Proprietary Information Copyright 2006, All Rights Reserved. -17/17- Thank you !