Transcript ch07 - kuroski.net

Guide to Network Defense and
Countermeasures
Second Edition
Chapter 7
Intrusion Detection System Concepts
Objectives
• Identify the components of an intrusion detection
system
• Explain the steps of intrusion detection
• Describe options for implementing intrusion detection
systems
• Evaluate different types of IDS products
Guide to Network Defense and Countermeasures, Second Edition
2
Examining Intrusion Detection System
Components
• Network intrusion
– Attempt to gain unauthorized access to network
resources
• Intrusion Detection System (IDS)
– Consists of more than one application or hardware
device
– Incorporates more than just detection
• Intrusion Detection
– Involves prevention, detection, and response
Guide to Network Defense and Countermeasures, Second Edition
3
Guide to Network Defense and Countermeasures, Second Edition
4
Examining Intrusion Detection System
Components (continued)
• Components
–
–
–
–
–
Network sensors
Alert systems
Command console
Response system
Database of attack signatures or behaviors
Guide to Network Defense and Countermeasures, Second Edition
5
Network Sensors
• Sensor
– Electronic “eyes” of an IDS
– Hardware or software that monitors traffic in your
network and triggers alarms
– Attacks detected by an IDS sensor
• Single-session attacks
• Multiple-session attacks
• IDS types
– Host-based IDS
– Network-based IDS
Guide to Network Defense and Countermeasures, Second Edition
6
Network Sensors (continued)
• Sensors should be placed at common-entry points
– Internet gateways
– Connections between one LAN and another
– Remote access server that receives dial-up
connections from remote users
– Virtual private network (VPN) devices
• Management program controls sensors
• Sensors could be positioned at either side of the
firewall
– Behind the firewall is a more secure location
Guide to Network Defense and Countermeasures, Second Edition
7
Guide to Network Defense and Countermeasures, Second Edition
8
Guide to Network Defense and Countermeasures, Second Edition
9
Alert Systems
• Trigger
– Circumstances that cause an alert message to be
sent
• Types of triggers
– Detection of an anomaly
– Detection of misuse
Guide to Network Defense and Countermeasures, Second Edition
10
Alert Systems (continued)
• Anomaly detection
– Requires you to make use of profiles
• For each authorized user or group of users
• Describe services and resources normally accessed by
users
– Some IDSs can create user profiles
• During “training period”
– Accuracy problems
• False negatives
• False positives
Guide to Network Defense and Countermeasures, Second Edition
11
Alert Systems (continued)
• Misuse detection
– Triggers alarms based on characteristic signatures of
known attacks
– IDS comes equipped with a set of signatures
• Can start protecting the network immediately
– Need to maintain state information
• Other detection mechanisms
– Traffic rate monitoring
– Protocol state tracking
– IP packet reassembly
Guide to Network Defense and Countermeasures, Second Edition
12
Guide to Network Defense and Countermeasures, Second Edition
13
Command Console
• Provides a graphical front-end interface to an IDS
– Enables administrators to receive and analyze alert
messages and manage log files
• IDS can collect information from security devices
throughout a network
• Command console should run on a computer
dedicated solely to the IDS
– To maximize the speed of response
Guide to Network Defense and Countermeasures, Second Edition
14
Response System
• IDS can be setup to take some countermeasures
• Response systems do not substitute network
administrators
– Administrators can use their judgment to distinguish a
false positive
– Administrators can determine whether a response
should be escalated
• Increased to a higher level
Guide to Network Defense and Countermeasures, Second Edition
15
Database of Attack Signatures or
Behaviors
• IDSs don’t have the capability to use judgment
– Can make use of a source of information for
comparing the traffic they monitor
• Misuse detection
–
–
–
–
References a database of known attack signatures
If traffic matches a signature, it sends an alert
Keep database updated
Passive detection mode
• Anomaly-based IDS
– Store information about users in a database
Guide to Network Defense and Countermeasures, Second Edition
16
Guide to Network Defense and Countermeasures, Second Edition
17
Examining Intrusion Detection Step by
Step
• Steps
–
–
–
–
–
–
–
Installing the IDS database
Gathering data
Sending alert messages
The IDS responds
The administrator assesses damage
Following escalation procedures
Logging and reviewing the event
Guide to Network Defense and Countermeasures, Second Edition
18
Guide to Network Defense and Countermeasures, Second Edition
19
Step 1: Installing the IDS Database
• IDS uses the database to compare traffic detected
by sensors
• Anomaly-based systems
– Require a training period (over a week)
– IDS observes traffic and compile a network baseline
• Misuse-based IDS
– Can use database immediately
– You can provide it with your own database
Guide to Network Defense and Countermeasures, Second Edition
20
Step 2: Gathering Data
• Network sensors gather data by reading packets
• Sensors need to be positioned where they can
capture all packets
– Sensors on individual hosts capture information that
enters and leaves the host
– Sensors on network segments read packets as they
pass throughout the segment
• Sensors on network segments cannot capture all
packets
– If traffic levels become too heavy
Guide to Network Defense and Countermeasures, Second Edition
21
Step 3: Sending Alert Messages
• Sensors capture packets
• IDS software compares captured packets with
information in its database
• IDS sends alert messages
– If captured packets match an attack signature or
– Deviates from normal network behavior
Guide to Network Defense and Countermeasures, Second Edition
22
Step 4: The IDS Responds
• Command console receives alert messages
– Notifies the administrator
• IDS can be configured to take actions when a
suspicious packet is received
– Send an alarm message
– Drop the packet
– Stop and restart network traffic
Guide to Network Defense and Countermeasures, Second Edition
23
Step 5: The Administrator Assesses
Damage
• Administrator monitors alerts
– And determines whether countermeasures are
needed
• Administrator need to fine-tune the database
– The goal is avoiding false negatives
• Line between acceptable and unacceptable network
use is not always clear
Guide to Network Defense and Countermeasures, Second Edition
24
Guide to Network Defense and Countermeasures, Second Edition
25
Step 6: Following Escalation
Procedures
• Escalation procedures
– Set of actions to be followed if the IDS detects a true
positive
• Should be spelled out in company’s security policy
• Incident levels
– Level One
• Might be managed quickly
– Level Two
• Represents a more serious threat
– Level Three
• Represents the highest degree of threat
Guide to Network Defense and Countermeasures, Second Edition
26
Step 7: Logging and Reviewing the
Event
• IDS events are stored in log files
– Or databases
• Administrator should review logs
– To determine patterns of misuse
– Administrator can spot a gradual attack
• IDS should also provide accountability
– Capability to track an attempted attack or intrusion
back to the responsible party
– Some systems have built-in tracing features
Guide to Network Defense and Countermeasures, Second Edition
27
Guide to Network Defense and Countermeasures, Second Edition
28
Guide to Network Defense and Countermeasures, Second Edition
29
Options for Implementing Intrusion
Detection Systems
• Network-based IDS
• Host-base IDS
• Hybrid implementations
Guide to Network Defense and Countermeasures, Second Edition
30
Network-Based Intrusion Detection
Systems
• Locating an NIDS on the Network
– Network-based IDS (NIDS)
• Monitors network traffic
– Common locations for NIDS sensors
• Behind the firewall and before the LAN
• Between the firewall and the DMZ
• Any network segment
– Management and analysis software must be installed
on a dedicate computer
– Positioning sensors at network perimeter
• Enables IDS to sniff traffic
Guide to Network Defense and Countermeasures, Second Edition
31
Guide to Network Defense and Countermeasures, Second Edition
32
Network-Based Intrusion Detection
Systems (continued)
• Advantages and disadvantages of NIDS
– NIDS handles a high volume of traffic
– Requires dedicated hardware appliance
Guide to Network Defense and Countermeasures, Second Edition
33
Host-Based Intrusion Detection
Systems
• Host-based IDS (HIDS)
– Deployed on a host in the LAN
• Protected by the firewall
– Evaluates traffic generated by the host
– Gathers system variables such as
• System processes
• CPU use
• File accesses
– Does not sniff packets as they enter the LAN
Guide to Network Defense and Countermeasures, Second Edition
34
Host-Based Intrusion Detection
Systems (continued)
• Configuring an HIDS
– Centralized configuration
• HIDS sends all data to a central location
• Host’s level of performance is unaffected by the IDS
• Alert messages that are generated do not occur in real
time
– Distributed configuration
• Processing of events is distributed between host and
console
• Host generates and analyzes it in real time
• Performance reduction in host
Guide to Network Defense and Countermeasures, Second Edition
35
Guide to Network Defense and Countermeasures, Second Edition
36
Guide to Network Defense and Countermeasures, Second Edition
37
Host-Based Intrusion Detection
Systems (continued)
• Choosing the host computer
– Centralized configuration
• RAM, hard disk memory, and processor speed
requirements are minimal
– Distributed configuration
• Host should be equipped with maximum memory and
processor speed
Guide to Network Defense and Countermeasures, Second Edition
38
Host-Based Intrusion Detection
Systems (continued)
• Advantages and disadvantages of HIDSs
– Advantages
•
•
•
•
Detect events on host systems
Can process encrypted traffic
Not affected by use of switched network protocols
Can compare records stored in audit logs
Guide to Network Defense and Countermeasures, Second Edition
39
Host-Based Intrusion Detection
Systems (continued)
– Disadvantages
•
•
•
•
•
More management issues
Vulnerable to direct attacks and attacks against host
Susceptible to some denial-of-service attacks
Can use large amounts of disk space
Could cause increased performance overhead on host
Guide to Network Defense and Countermeasures, Second Edition
40
Hybrid IDS Implementations
• Hybrid IDS
– Combines the features of HIDSs and NIDSs
• Gains flexibility and increases security
• Combining IDS sensor locations
– Put sensors on network segments and network
hosts
– Can report attacks aimed at particular segments or
the entire network
Guide to Network Defense and Countermeasures, Second Edition
41
Hybrid IDS Implementations
(continued)
• Combining IDS detection methods
– IDS combines anomaly and misuse detection
– Database enables IDS to run immediately
– Anomaly-based systems keep the alert system
flexible
– Can respond to the latest, previously unreported
attacks
• Both external and internal attacks
– Administrators have more configuration and
coordination work to do
Guide to Network Defense and Countermeasures, Second Edition
42
Hybrid IDS Implementations
(continued)
• Shim IDS
– Acts like a type of NIDS
– Involves sensors being distributed around a network
• Data collected by sensors is sent to a central location
– Sensors are installed in selected hosts and network
segments
• Those that require special protection
Guide to Network Defense and Countermeasures, Second Edition
43
Hybrid IDS Implementations
(continued)
• Distributed IDS
– Multiple IDS devices are deployed on a network
– Reduces response time
– Two popular DIDSs
• myNetWatchman
• DShield
Guide to Network Defense and Countermeasures, Second Edition
44
Guide to Network Defense and Countermeasures, Second Edition
45
Hybrid IDS Implementations
(continued)
• Advantages
– Combine aspects of NIDS and HIDS configurations
– Can monitor network as a whole
– Can monitor attacks that reach individual hosts
• Disadvantages
– Need to get disparate systems to work in coordinate
fashion
– Data gathered by multiple systems can be difficult to
absorb and analyze
Guide to Network Defense and Countermeasures, Second Edition
46
Evaluating Intrusion Detection
Systems
• Survey various options and match them to your
needs
• Review topology of your network identifying
– Number of entry points
– Use of firewalls
– Number of network segments
• Evaluating IDSs can be time consuming
Guide to Network Defense and Countermeasures, Second Edition
47
Freeware NIDS: Snort
• Ideal for monitoring traffic on a small network or
individual host
– Does not consume extensive system resources
• Intended for installation on a computer at network
perimeter
• Comes with a collection of rule files
• Separate rules exist for
– Port scans
– Back door attacks
– Web attacks
Guide to Network Defense and Countermeasures, Second Edition
48
Guide to Network Defense and Countermeasures, Second Edition
49
Commercial HIDS: Norton Internet
Security
• Firewall designed to protect a home-based
standalone computer
– Or a computer on a small network
• Contains a limited number of intrusion detection
features
– Block port scans
– Block attack attempts on ports used by known Trojan
programs
• Can be trained to identify normal network use
• Alert messages appear as pop-up windows
Guide to Network Defense and Countermeasures, Second Edition
50
Guide to Network Defense and Countermeasures, Second Edition
51
IDS Hardware Appliances
• Can handle more network traffic
– Have better scalability than software IDSs
• Plug-and-play capabilities
– One of its major advantages
– Do not need to be configured to work with a
particular OS
• Examples
– iForce
– Intrusion SecureNet
– StealthWatch G1
Guide to Network Defense and Countermeasures, Second Edition
52
IDS Hardware Appliances (continued)
• You should create a custom configuration
– To reduce the number of false positives and false
negatives
• Upgrade appliances periodically
– Can be complicated and expensive
Guide to Network Defense and Countermeasures, Second Edition
53
Summary
• Intrusion Detection System (IDS)
– Supplementary line of defense behind firewalls and
antivirus software
• IDS components
–
–
–
–
–
Network sensors
Alert messages
Command console
Response system
Database of signatures
Guide to Network Defense and Countermeasures, Second Edition
54
Summary (continued)
• IDS steps
– Install set of attack signatures
– Sensors monitor packets
– IDS responds
• False positives are highly likely
– Require administrators to fine-tune the system
– If attack is legitimate, escalation procedures should be
followed
• IDS logs alarmed events
– They can be reviewed later
Guide to Network Defense and Countermeasures, Second Edition
55
Summary (continued)
• IDS implementation
–
–
–
–
–
Network-based IDS (NIDS)
Host-based IDS (HIDS)
Hybrid IDS
Shim IDS
Distributed IDS (DIDS)
• Types of IDS products
– Open-source IDSs such as Snort
– Commercial firewalls such as Norton Internet Security
– IDS hardware appliances
Guide to Network Defense and Countermeasures, Second Edition
56