IT Security Doug Brown Jeff Bollinger

What is security? P.H.P. People Have Problems Security is the mitigation and remediation of human error in information technology

Mistakes Computers don’t make mistakes; people do. People write programs. Each program that you run introduces another set of mistakes that the bad guys can use against you.

From the network Programs open ports Attackers probe these ports (Layer 4 - transport) to determine which programs are running, what version they are, and what they can attack

Firewalls (Layer 4 – Transport) What they do:

Why not stop there? A Firewall on your network is not a panacea You will probably have to allow some access to your network through the firewall If someone uses this access to hack a box on your network, then the firewall becomes inconsequential Firewalls are troublesome in some environments – like UNC

Break-ins Things the bad guys take advantage of Bad or weak passwords Poorly written programs Buffer Overflows Execution of code Detection of break-ins System logs IDS and/or Firewall logs Abnormal system behavior Complaint from another user

Intrusion Detection Normally a passive security tool Monitors network traffic in search of attacks Signature based Traffic pattern based Monitoring the IDS logs provide Evidence with which to respond to attacks Warnings to allow the stopping of attacks in progress Post-mortem information after attacks UNC is currently using Snort

An example from Snort Signature # Alerts# Sources # Destinations Detail link ida ISAPI Overflow Summary CUSTOM Port TCP traffic Summary WEB-MISC Invalid URL Summary WEB-MISC 403 Forbidden Summary SMTP relaying denied Summary CUSTOM IRC file-sharing Summary FTP EXPLOIT wu-ftpd overflow Summary WEB-MISC Attempt to execute cmd Summary INFO Possible IRC Access Summary Incomplete Packet Fragments Summary WEB-MISC http directory traversal Summary

Intrusion Detection The downside of Intrusion Detection? False Positives!

Enter Intrusion Prevention Sits In-line and automatically drops bad traffic Layer 7 – Application Inspection With the right brand - No False Positives Security Zones (Attack Domains) contain infections

An example from Tipping Point Hit CountFilter 8988MS-RPC: DCOM 396Shell Command Exec 334IE CHM File Proc 202Code Red II Worm 83Nimda Attack

IE CHM File Processing This filter detects an attempt to exploit a vulnerability in Internet Explorer, specifically in IE's processing of compiled help (".chm") files. The flaw can be exploited by a malicious website to execute arbitrary code on a client system. Note that the vulnerability is being exploited in the wild to install malicious code named "Ibiza" on compromised systems.

Key Points People are behind the technology Security combats human error Goal of security is to ensure: Confidentiality - Integrity - Availability (of the data and systems)

Wireless Demo Wireless Implementations = Human Error