Security fundamentals Topic 13 Detecting and responding to incidents

Agenda Detecting intrusions Responding to incidents

Intrusion detection Minimise the negative impact of security incidents Protect evidence for prosecution Intrusion detection – Monitor and evaluate computer events and network traffic for signs of intrusions – Use a computer or software that can detect unauthorised activity on your network, log this activity, and alert you Network-based IDS (NIDS) – A NIDS monitors network traffic and traffic patterns to discover attempted denial of service (DoS) attacks, port scans or attempts to guess the password to a secured resource Host-based IDS (HIDS) – A HIDS monitors a single system’s file structure to determine when an attacker modifies, deletes or changes a system file Log file monitor – A log file monitor processes system log entries from one or more computers to identify possible system attacks or compromises – Log file monitors often analyse databases to which log file entries have been copied and correlate multiple events to detect patterns

Network-based IDS Use sensors at various points on a network which monitor and analyse network traffic at their locations and report potential attacks to a central management console Commonly bastion hosts limited to running only the IDS sensor software Stealth mode – sensors do not send any data on the network segment they monitor Low impact on network traffic because they don’t act as gateways

Network-based IDS Features: – Protect multiple systems – Monitor traffic inside your firewall – Alert you to firewall failures – Detect slow attacks (such as scans over time) – Delayed analysis for honeypots – Take corrective action by changing configuration to stop attack – Increase overall security: one layer of a defence-in-depth Limitations: – Processing speed for processing and collection – Segmentation: use a switch span port – Encryption: most NIDS can’t decrypt – Attack success: report only that an attack was initiated – Missed detections: up to date attack signatures – False positives: alerts that indicate an intrusion, even though no actual attempt has occurred – NIDS attacks: tools like Stick, Fragroute, Tribe Flood Network Internet Information Systems: RealSecure®, Snort®

Host-based IDS Features: – Installed on servers and other critical computers to protect the systems – More reliable than NIDSs in detecting attacks on individual systems – Typically use operating system audit trails and system logs – Also monitor changes to system files – Must carefully configure an HIDS to not create false positives Benefits: – HIDSs are better at monitoring and keeping track of local system events – HIDSs typically cannot be bypassed by encrypted attacks – HIDSs can help you detect attack software that has been installed on a computer, such as trojan horse software. – Because HIDSs protect only a single computer – switches, virtual private networks (VPNs) and routers do not affect their functionality

Host-based IDS limitations Limitations: – HIDSs are more difficult to manage as they are on individual systems – HIDSs are susceptible to DoS attacks – HIDSs require resources from the protected host: Extra hard disk space to store logs and tracking information Processor time and memory to analyse packets, user-issued commands, audit trails, and system logs to protect the client

Application-based IDS Integrating IDS functions into vendor applications Analyse the events occurring within a specific software application by using the application’s transaction log files Analyse interactions between the user, the data and the application

Detection methods Misuse detection: Requires the IDS to identify a predefined attack pattern Identifying an attack signature Analyse system activity, looking for events that match a predefined pattern of attack Benefits: – They can quickly identify defined attacks – They help you track attacks – Don’t generate many false alarms Limitations: – Require updated attack signature files because they can detect only predefined attacks that are based on those signatures – They can be attacked by sending data that matches the attack signatures

Detection methods Anomaly detection: – Recognising something suspicious or atypical – Identify unusual activities or situations, called anomalies – Must gather information about the systems and networks on which it operates, can then identify abnormalities based on historical data Benefits: – Don’t need to rely on predefined attack signature files to identify attacks – Can help identify attack patterns that can later be converted into attack signatures for misuse detectors Limitations: – Require more experienced security administrators to determine the attacks – The detector can only point out abnormalities, which might or might not be attacks – More likely to produce false alarms because not all irregularities are actual attacks – They require more administrative involvement than misuse detectors

Response types Active response: An automatic action that a system takes when it recognises an attack Increase logging activities or the number of packets captured for analysis Reconfiguring the network such as reconfigure firewall filters, isolate a host on a particular VLAN or reroute network packets Passive response: Simply alerts a system or security administrator about an event Might be a log entry or it might involve immediate notification by or pager

IDS deployment Stage 1: Deploy a limited NIDS – Install management console, deploy the console before you begin adding sensors – Start to customise NIDS Stage 2: Deploy NIDS sensors – Incrementally deploy sensors throughout your network – Understand the differences in traffic, reporting, logging and alerts that you receive from that sensor Stage 3: Deploy a limited HIDS – Deploy HIDS only on critical hosts or servers at first – Too many alerts to analyse if done on a large scale initially Stage 4: Fully deploy an HIDS – Roll out the HIDS to all client systems Where to place sensors How critical the resources are that you must secure and where you expect attacks to occur

Honeypots and honeynets Traps that are set up to catch hackers or to study their behaviour Appears to be a normal computer system and looks like an attractive target for an attack Honeypots are more likely to give you valuable information about an attack as attackers, not legitimate users, use them Honeypots are designed to track access, so they are not likely to run out of system resources when under attack Learn about how hackers operate by investigating the exact actions that they use to attack a honeypot Honeypots can occupy hackers so they don’t attack other computers

Incident response basics An incident is an actual, attempted or suspected breach of computer security An incident response policy exists so that all users know who to contact if they think an incident is occurring Contains specific steps that everyone involved should take when an incident occurs including priority list. For example: 1.Protect people’s lives and safety 2.Protect classified and sensitive data first 3.Protect other data 4.Protect hardware and software 5.Minimise disruption of business services and operations Computer security incident response team (CSIRT), computer emergency response team (CERT) or security officer usually takes the lead in receiving, reviewing, and responding to incident reports and activity

Computer forensics The investigation and analysis of computer security incidents with the interests of gathering and preserving potential legal evidence Collecting evidence – Designate a Point of Contact for maintaining contact with law enforcement and other CSIRTs and disseminating information – Also is responsible for coordinating the collection of evidence to ensure that it is done in accordance with all laws and legal regulations Working carefully – Consider what your actions might mean to the present state of the system – Concentrate on not altering anything and meticulously document all of your actions for later reference – Analyse a replica of the system instead of the original, make an exact bit-level copy of the disk Using forensic tools, EnCase® Audit trail – To establish, examine and preserve an audit trail. An audit trail is a record of the users who accessed a computer and what operations they performed

Collecting information Obtain and protect the latest partial and full system backups Take pictures or screen shots of all evidence Obtain and protect any security videos, audios or reports from periods of time surrounding and including the incident Recover as many deleted, encrypted or damaged files related to the intrusion as possible You should also create and maintain a written log for all incident response activity Examples of what you should document include the following: – The name of the system or systems compromised – The time, date and location of each activity – The specific actions that were taken – The identities of the people performing each action – Who was notified and what information was disseminated – What actions that were taken by each notified person, group or organization – Who had access to the system, physical location and evidence – What data was collected and who analysed it

Collecting evidence Maintaining a chain of custody: A documented chain of custody shows who collected and had access to each piece of evidence Failure to maintain this chain of custody might make your evidence inadmissible in court – Including dates, times, locations and the verified identities of every person who handled evidence – Includes any time evidence is accessed or moved while in storage – Anyone accessing stored evidence should provide a legitimate, verifiable, and documented purpose for doing so

Preserving evidence Work carefully and change as little as possible Try to conduct your investigation on a separate system that is a restored backup or imaged version of the compromised system Everything you do must be thoroughly documented – Archive and retain all information concerning an intrusion until the investigation and any legal proceedings are complete – Preserve all critical information on and offsite: Make copies of all logs, system hard disks, policies, procedures, system and network configurations, photographs, cryptographic checksums, databases and system backups. Offsite storage preserves evidence in the event of a natural disaster or subsequent intrusion – Define, document and follow a strict procedure for securing and accessing evidence both onsite and offsite

Lesson summary How to go about detecting intrusions with IDS How to go about responding to incidents and collecting information