Security+ Topic - IDS

The Intrusion Detection Systems available for network administrators today are some amazing pieces of equipment able to detect everything from a single pin-pointed attack to a well masked distributed attack on your network. These vital parts of your network provide the administrator with immediate notification of issues or potential threats and if integrated with an Intrusion Prevention System are able to repel attacks. The first part of the process is making a positive identification of a potential threat. Historically this is done based off of signature files similar to traditional virus scanners. As of this writing they are able to analyze traffic patters, sources of data, combined logs from outside nodes, and other resources to detect threats. In general, they are trying to check for any compromise of confidentiality, integrity, or availability of resources.


There are a lot of different alerts that could act as triggers for the Intrusion Detection System such as an excess of ping or traffic patterns that are extremely abnormal. There is also the data source of the requests to take into consideration. An easily detectable source would be from a single node while a distributed attack may take the intrusion detection system longer to detect.


How can you use an Intrusion Detection System in your network?


It all boils down to available resources and money. Seriously, money. Who has the money to put down on something that is just going to sit there? Well now you do. Now is the time to let your boss know the threats that are out there and business impact of those threats. Ask someone in finance if they are able to give you a ballpark figure of how much money would be lost if the company was unable to perform their work for one hour. If you work for a medium to large size business then the number they give you may surprise you. Historically companies have been down for many hours at a time waiting for an attacker to finish getting their kicks or for anti-virus companies to update definitions to get rid of a botnet. To me, the few thousand dollars for an Intrusion Detection System is cheap insurance for keeping the company running.


Up until now I have not been specific on a network intrusion detection system or a host intrusion detection system. Well, that is because what I talked about was kind of generic. To close out here I would like to bring up the network side of things. Granted there is a lot of encrypted traffic on the network, they are still able to analyze traffic patterns that may be problematic for your network. There is a huge amount of data that needs to be processed on a network and so the system requirements for such a device cannot be something like an old school 486. Don't know what that is? Ok, not even a Pentium (ya the original) would work out for you unless you had very little traffic to check. An interesting part about the network detection is that it doesn't have to be in line with any of your network and so an attacker would have no clue that it even exists. It can be on a mirrored port of your switch.

-- Joe McShinsky

Anonymous

I don't understand the hacker group anonymous. They take down websites to make a statement (usually big ones). If the really wanted to affect the organization they would understand that most large organizations usually run servers on a different network than employees. Thus if you figure out the employee network and attack it you reduce the productivity and give the organization a much larger headache due to employees sitting idle. A organization is going to be much more upset with paying idle employees than having a few hours of downtime. Now I also understand that the website may take orders etc and even a half hour can result in lots of money lost. My point is about anonymous though. It seems they only want to be in the news for taking down a website (which is trivial and extremely common). Wouldn't it be much more effective to attack the bottom line?

Security+ Topic - Firewalls

Lets talk firewalls. It used to be that if you had a firewall then you were basically protected against a lot of the threats that are in the world today. While yes it is true that having a firewall in place will help mitigate a lot of threats it is still not the only thing you need on your network or servers. Ok, now that the disclaimer is out of the way, lets move onto the firewall subject at hand. From a security standpoint they can help by letting you (the good guy) see different things on your network while keeping others (possibly bad people) from fingerprinting your network. Even with a wealth of types of firewalls including packet filtering, proxy firewall, and stateful inspection firewalls I would like to cover the approach of utilizing a firewall to hide behind.


Why would you want to hide? Or what do I gain from being invisible?


Think about it for a second from the mind of a malicious person. Actually, lets take the standpoint of an inside threat. As a disgruntled employee you are wanting to take down something on the network on your last day of work. You just don't give a crap anymore and you wont see any of these people after you leave your little present anyway. You, as a network administrator had previously decided to try and mitigate some risk by setting up some firewalls. Each department is blocked from other departments and each department only has access to the areas of the network that they need access to.


Sounds simple enough right? Wrong.


I have seen quite a few networks where the network administrator will simply setup the network to allow everyone access to each part of the network as it makes their job easier. Having firewalls in place throughout your INTERNAL network is just as important as having firewalls block threats from outside your network. The biggest thing that keeps people from doing this is cost. As a disclaimer, I am a big Cisco guy and so my networks are usually segregated by Cisco routers. In any vendor network there will almost always be some sort of method to control traffic. Your setup could be a router on a stick or a 50+ internal router setup but it all boils down to the firewall rules that you put into place.


I will cover a couple brief methods of firewalls so I don't leave you hanging in the wind. The previously mentioned one was with Cisco gear. ACL's can work wonders. These little things on gear you already have can be your first line of defense for keeping people in Customer Support from getting to the Accounting computers. Another option is the use of transparent Linux firewall/proxy. It acts just like a switch on your network passing data like normal but inspects the packets to make sure they are allowed to be there. Again on the Cisco side but more expensive is your (older) PIX and (new) ASA firewalls. If you have the money for an ASA, go for it!


What it boils down it is protection. Firewalls are there as a layer of security and that is what you are looking for. Layers. In a drive-by scan you want to be hidden so they don't dig deeper. In a targeted internal or external attack you want to provide as many road-blocks as possible.

-- Joe McShinsky