Jason Ewing

What is an Intrusion Why Detecting Signs of Intrusion is Important? Types of Intrusion Detection Systems (IDS) Approaches for Detection Anomaly Detection Signature Recognition Protocol Analysis Policy and Procedures Questions Introduction

“Normal activities that leave signs of intrusion include but are not limited to attempts to gain unauthorized access to a system or its data, unauthorized exposure of information, disruption or denial of service, unauthorized data processing, unauthorized downloading, and changes to system hardware, firmware, or software without network administrators knowledge or consent (Kochmar et al 6)”. What is an Intrusion?

Without detection and damage assessment time to recover from attacks can increase along with damage Legal Repercussions, Attackers could utilize system to launch other attacks Loss of Business Damaged Reputation Why It’s Important?

Network Intrusion Detection Systems (NIDS) Packet Monitoring system Will Capture Packets Evaluate Both Incoming and Outgoing traffic System Integrity Verifiers (SIV) Monitors System Files Windows Registry Critical Components No Real Time Alert Types of Intrusion Detection Systems (IDS)

Log File Monitors (LFM) Monitors Generated Log Files Identify Well-Known Patterns of attackers Decoy Systems Trap Attackers Rely on Deception Honeypots Fake Accounts Without Privileges Types of Intrusion Detection Systems (IDS)

General Framework for Detection Look for Suspicious Activity Investigate any problems or strange behavior If something is unexplainable assume there’s an intrusion Anomaly Detection Signature Recognition Protocol Analysis Approaches for Detection

Most Common Method Detects Statistical Anomalies Baseline of Network Activity CPU Use Disk Activity User Activity File Activity Alarm will activate when an anomaly occurs Anomaly Detection

Similar to virus scanning Examines Network Traffic Looks for Well Known Patterns of Attackers Must be compared to a signature file Not very effective due to Many different variations of attacks Signatures created after an network or honeypot is attacked Signature Recognition

Decodes Application-Layer Network Traffic Each protocol is decoded and analyzed Searches for suspicious behavior Unusual Packet Characteristics Unusual Packet Source & Destination Example: Malicious Code in a Header Field sent to a Web server Protocol Analysis

It’s very important to document types of threats and possible intrusions Attempted attacks Port scanning Unauthorized access of information Changes to the system – Hardware, Software, etc. Great documentation allows for great intrusion response and prevention Maintain all documentation Policy and Procedures

Questions

Allen, Julia H. The CERT Guide to System and Network Security Practices. Boston: Addison-Wesley, Print. Berge, Matthew. "Intrusion Detection FAQ: What Is Intrusion Detection?" Intrusion Detection. SANS. Web. 9 Apr Ciampa, Mark D. Security+ Guide to Network Security Fundamentals. 3rd ed. Boston, MA: Thomson/Course Technology, Print. Graham, Robert. " Network Intrusion Detection Systems." Network Security Articles for Windows Server 2003, 2008 & Vista. Windows Security, 16 Oct Web. 09 Apr Kochmar, John, Julia Allen, Christopher Alberts, Cory Cohen, Gary Ford, Barbara Fraser, Suresh Konda, Peter Kossakowski, and Derek Simmel. "Preparing to Detect Signs of Intrusion." (2001): Carnegie Mellon Software Engineering Institute, Web. 09 Apr Sources