Monitoring Systems Richard Newman

Security in Depth Layered Security – Physical access control – Identification and Authentication – know who is using system Individual authentication – for audit Detect patterns of behavior – Logical Access Control Programs, files, resources, etc. Check – use issues – Real-time monitoring IDS – Off-line monitoring Audit Forensic uses Chain of control

Computer System Monitoring - Detection – May be done at any level – Pattern matching – Statistical anomaly – Self/Non-self - Classification – Severity level – Special considerations - Response – Event logging – alert to user/admin Per event Digest – RT call/page/IM – System reconfiguration

Event Logging - System log – Start-up, shut-down of system, major processes – Opening/closing of important files, major resources - Security log – Major access control requests, logins – Access control failures - Application logs – Application specific events

Log Entry Append-only file – Prevent log entry modification or loss Log entry fields – Time and date of event – Event source (process/component) – User identity – Event type – Event details – depend on event type

Event Logging Mechanisms Process detects an event – configured to log – Creates log entry – Puts entry in buffer – Alerts logging process Logging process retrieves event from buffer – Classifies as worthy of collection or not Logging process writes events to audit log – Log selection – May fire other responses also Sysadmins review audit log – Data mining – Direct study Archiving – Signature, compression

Access Control Strategies - Islands – Isolation and mediation – Untrusted process given “sandbox” - Vaults – Access to wider (more dangerous) resources requested individually with system mediation on a case-by-case basis – Required for access to shared resources - Puzzles – Process uses secret or hidden information to access desired resources – must be impractical to find it or to guess – Cryptography, steganography, security through obscurity - Patterns – Access patterns compared with known bad patterns, blocked or audited if match (virus signatures) – Normal access patterns noted and deviations detected (anomalies)

External Requirements & Policy Treat external reqts as separate input to policy – Allows compliance tracking Treat possible legal or contractual problems as risks – Acknowledges non-compliance as risk Treat certifications as assets – More than marketing