Intrusion Detection Prepared by: Mohammed Hussein Supervised by: Dr. Lo’ai Tawalbeh NYIT- winter 2007.

WHAT IS SECURITY ISO defines five security services ISO defines five security services –Confidentiality (secrecy) –Authentication (identify verification) –Integrity –Access control Users also would likely include Users also would likely include –Preventing spam –Preventing denial of service –Privacy –…

Security Terminology Vulnerabilities Vulnerabilities –security flaws in systems Attacks Attacks –means of exploiting vulnerabilities Countermeasures Countermeasures –technical or procedural means of addressing vulnerabilities or thwarting specific attacks Threats Threats –motivated adversaries capable of mounting attacks which exploit vulnerabilities

Types of violation Attack Attack –Attempts to exploit a vulnerability –Ex: denial of service, privilege escalation Intrusion Intrusion –Masquerading as another legitimate user Misuse Misuse –User abuses privileges –Often called the “insider threat”

Intrusion “Any intentional event where an intruder gains access that compromises the confidentiality, integrity, or availability of computers, networks, or the data residing on them.” Credit: CERT-CC Security Improvement Module 8: Responding to Intrusions

Why Systems Are Vulnerable Contemporary Security Challenges and Vulnerabilities

Use of fixed Internet addresses through use of cable modems or DSL Lack of encryption with most Voice over IP (VoIP) Widespread use of and instant messaging (IM) Internet Vulnerabilities: Why Systems Are Vulnerable (Continued)

Intrusion Detection and Computer Security Computer security goals: Computer security goals: –Confidentiality, integrity, and availability Intrusion is a set of actions aimed to compromise these security goals Intrusion is a set of actions aimed to compromise these security goals Intrusion prevention (authentication, encryption, etc.) alone is not sufficient Intrusion prevention (authentication, encryption, etc.) alone is not sufficient Intrusion detection is needed Intrusion detection is needed

Intrusion Examples Intrusions : Any set of actions that threaten the integrity, availability, or confidentiality of a network resource Intrusions : Any set of actions that threaten the integrity, availability, or confidentiality of a network resource Examples Examples –Denial of service (DoS): attempts to starve a host of resources needed to function correctly –Worms and viruses: replicating on other hosts

Intrusion Detection Intrusion detection: The process of monitoring and analyzing the events occurring in a computer and/or network system in order to detect signs of security problems Intrusion detection: The process of monitoring and analyzing the events occurring in a computer and/or network system in order to detect signs of security problems Primary assumption: User and program activities can be monitored and modeled Primary assumption: User and program activities can be monitored and modeled Steps Steps –Monitoring and analyzing traffic –Identifying abnormal activities –Assessing severity and raising alarm

IDS Architecture Sensors (agent) Sensors (agent) –to collect data and forward info to the analyzer  network packets  log files  system call traces Analyzers (detector) Analyzers (detector) –To receive input from one or more sensors or from other analyzers –To determine if an intrusion has occurred User interface User interface –To enable a user to view output from the system or control the behavior of the system

Intrusion Detection Model Credit: IETF: Intrusion Detection Message Exchange Requirements (Internet Draft) Data Source Sensor Administrator Manager Operator Analyser Sensor Security Policy Response Activity Event Alert Notification

Intrusion Detection Systems Detect intrusive behaviour in an automated fashion Detect intrusive behaviour in an automated fashion Monitor activity both across networks (NIDS) and within hosts (HIDS) Monitor activity both across networks (NIDS) and within hosts (HIDS) Analyse activity for signs of intrusion Analyse activity for signs of intrusion –Signature based –Anomaly based Respond to predetermined triggers by: Respond to predetermined triggers by: –Blocking specific actions

Common Defense Strategies Firewalls Firewalls Intrusion Detection Systems Intrusion Detection Systems Anti-virus technology (in hosts and in mail gateways) Anti-virus technology (in hosts and in mail gateways) Anti-spam technology (in hosts and in mail gateways) Anti-spam technology (in hosts and in mail gateways) Periodic penetration testing (enterprise nets) Periodic penetration testing (enterprise nets) Centralized patch management (enterprise nets) Centralized patch management (enterprise nets) Anti-DOS mechanisms (ISPs) Anti-DOS mechanisms (ISPs)

Defining Policy Consider this example Consider this example –A hospital deploys a database system for patient records. The system consists of a centralized DB server accessed by client systems in the hospital. Clients access the information through a network of connected PCs and via wireless PDAs What sorts of policy statements can we make about the hardware? Software? Users? What sorts of policy statements can we make about the hardware? Software? Users?

Defining Policy Possible statements Possible statements –The DB server software will be kept up to date –Unused network services (ports) on the DB server will be disabled –Wireless access will employ strong cryptographic protocols –Users are prohibited from examining records of patients not in their care Machine readable policy is very hard problem Machine readable policy is very hard problem –Particularly for misfeasance (i.e. insiders)

Info Case studyCourse :Intrusion detection and hacker exploits Case studyCourse :Intrusion detection and hacker exploits Presented to: Dr. Lo’ai Tawalbeh Presented to: Dr. Lo’ai Tawalbeh Homepage: ople/aclark/questnet2003-ac-ids.ppt Homepage: ople/aclark/questnet2003-ac-ids.ppt

Presented to: Dr. lo’ai tawalbeh Presented to: Dr. lo’ai tawalbeh Course :Intrusion detection and hacker Course :Intrusion detection and hacker exploits exploits