Lawrence Berkeley National Laboratory 1 James Rothfuss Computer Protection Program Manager Lawrence Berkeley National Lab Internet2 Security at Line Speed Workshop August 12, 2003 Protection of an Open Computing Environment

Lawrence Berkeley National Laboratory 2 Presentation will cover: Types of Protection Berkeley Lab Philosophy Bro NETS

Lawrence Berkeley National Laboratory 3 Classical Notion of Security Secure Restrict Control Hide

Lawrence Berkeley National Laboratory 4 Often “Classical Security” is not appropriate The tools can be so secure that their value is marginal Consider: When the goal is RESEARCH, a missed scientific breakthrough may be more costly and damaging than the worst “hacker” incident

Lawrence Berkeley National Laboratory 5 Classified Protection Commercial Academic Classified Protection Commercial Academic Protective measures can be different without be less effective

Lawrence Berkeley National Laboratory 6 Service Protection vs Information Protection

Lawrence Berkeley National Laboratory 7 Weapons Research Usenet newsgroups Yahoo Open Research Online Store Banking Service Protection Information Protection Primary protection concerns

Lawrence Berkeley National Laboratory 8 Protective measures are based on the known attacks. System weaknesses are identified and protected. “Threat” Based Protection “Vulnerability” Based Protection Antivirus Intrusion Detection Firewalls Patching BroNETS

Lawrence Berkeley National Laboratory 9 Open by default, restrict as necessary Protect rather than Secure Utilize both Threat and Vulnerability Protection Strive for Dynamic Protection Underling LBNL Philosophies Protecting an Open Environment is NOT EASY Quality People are extremely important

Lawrence Berkeley National Laboratory 10 LBL Intrusion Detection - Bro Analyzes network traffic for attacks and policy violations Operational 24x7 since 1996 (> 4 billion connections monitored & archived) Coupled with border router, provides an adaptive firewall Currently LBNL, NERSC, UCB, JGI, ESNET, ICSI … “Threat” Based Protection

Lawrence Berkeley National Laboratory 11 Taps GigEther fiber link passively, sends up a copy of all network traffic. Network How Bro Works

Lawrence Berkeley National Laboratory 12 Kernel filters down high-volume stream via standard libpcap packet capture library. Network libpcap Packet Stream Filtered Packet Stream Tcpdump Filter How Bro Works

Lawrence Berkeley National Laboratory 13 “Event engine” distills filtered stream into high-level, policy-neutral events reflecting underlying network activity –E.g., connection_attempt, http_reply, user_logged_in Network libpcap Event Engine Packet Stream Filtered Packet Stream Tcpdump Filter Event Stream Event Control How Bro Works

Lawrence Berkeley National Laboratory 14 “Policy script” processes event stream, incorporates: –Context from past events –Site’s particular policies Network libpcap Event Engine Policy Script Interpreter Packet Stream Filtered Packet Stream Tcpdump Filter Event Stream Event Control Real-time Notification Record To Disk Policy Script How Bro Works

Lawrence Berkeley National Laboratory 15 How Bro Works “Policy script” processes event stream, incorporates: –Context from past events –Site’s particular policies … and takes action : Records to disk Generates alerts via syslog or paging Executes programs as a form of response Network libpcap Event Engine Policy Script Interpreter Packet Stream Filtered Packet Stream Tcpdump Filter Event Stream Event Control Real-time Notification Record To Disk Policy Script

Lawrence Berkeley National Laboratory 16 Bro policy scripts Written in a specialized language for networks –Network types (IP addresses, connections, protocol, etc.) –Typed constanst, variables –Network operators (comparison, ranges, etc.) –Control statements (IF/THEN, etc.) –Regular expressions Can –Generate alerts –Reset connections –Call exterior programs

Lawrence Berkeley National Laboratory 17 Teasers Stepping Stone Detection (Telnet to SSH to Host) Non-standard port backdoor detection Work with Force Ten and Juniper for tighter “firewall” integration. Real Experiences –Max Butler (aka, MaxVision) –Worms (Code Red, Nimda) –Three lettered agency “gray hat” –Boyz from Brazil

Lawrence Berkeley National Laboratory 18 V. Paxson, Bro: A System for Detecting Network Intruders in Real-Time. Proceedings of the 7th USENIX Security Symposium, San Antonio, TX, January A later version appears in Computer Networks, 31(23- 24), pp , 14 Dec Y. Zhang and V. Paxson, Detecting Backdoors, Proc. 9th USENIX Security Symposium, August Y. Zhang and V. Paxson, Detecting Stepping Stones, Proc. 9th USENIX Security Symposium, August M. Handley, C. Kreibich and V. Paxson, Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics. Proc. 10th USENIX Security Symposium, August S. Staniford, V. Paxson and N. Weaver, How to 0wn the Internet in Your Spare Time, Proc. 11th USENIX Security Symposium D. Donoho, A. G. Flesia, U. Shankar, V. Paxson, J. Coit, and S. Staniford, Multiscale Stepping-Stone Detection: Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay, Proc. RAID D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford and N. Weaver, The Spread of the Sapphire/Slammer Worm, technical report, February Ruoming Pang and Vern Paxson, A High-level Programming Environment for Packet Trace Anonymization and Transformation, Proc. ACM SIGCOMM 2003, to appear. R. Sommer and V. Paxson, Detecting Network Intruders Using Contextual Signatures, in submission. Want to know more?

Lawrence Berkeley National Laboratory 19 “Vulnerability” Based Protection Network Equipment Tracking System NETS

Lawrence Berkeley National Laboratory 20 Current Method of Vulnerability Based Protection Range of Protection Analyze network Guess at “reasonable” firewall rules Hope the rules stay current (assume a static network) Safety Security Protection Capability Performance Access Static Point of Optimum Protection

Lawrence Berkeley National Laboratory 21 Continuous Optimization Constant analysis of network Protection measures adapt Safety Security Protection Capability Performance Access Dynamic Point of Optimization Optimum balance between protection and access

Lawrence Berkeley National Laboratory 22 Current NETS Prototype Oracle Database DNS forward Port Locator ARPwatch DNS reverse DHCP Server Logs Policies & Business Rules Reports Scan Dispatcher Targeted Systems LBLnet Control Future

Lawrence Berkeley National Laboratory 23 NETS Vision Fully automated vulnerability discovery and elimination Network information continuously collected Systems continuously scanned Network vulnerabilities detected as they appear Vulnerabilities immediately resolved Automatically Blocked Automatically alert owners/sys admins Automatically remove blocks when vulnerabilities are fixed Safe systems given full access -Internet access is maximized

Lawrence Berkeley National Laboratory 24 Future Integration With Bro NETS uses Bro information to prioritize vulnerabilities based a on threat BroNETS Extra attention given to vulnerabilities with a high risk of attack Extra attention to attacks against known weaknesses Bro uses NETS information to prioritize threats based on vulnerabilities

Lawrence Berkeley National Laboratory 25 Views of Protection “Threat” Based Protection “Vulnerability” Based Protection

Lawrence Berkeley National Laboratory 26 NETS and Bro Integration Network protection adapts based on both threats and vulnerabilities “Threat” and “Vulnerability” Based Protection