Intrusion Detection Presentation : 3 OF n by Manish Mehta 02/21/03

What will we discuss? Host-Based Detection Host-based Architecture -Centralized -Distributed real-time Operational Concepts for host-based detection Policy Management(next time) Benefits of Host-based ID Challenges for Host-based Technologies

Introduction Why do you call it ‘Host-based’? - used to analyze data originating on host. - Application - Syslog - RDBMS - Web Server -OS event logs - kernel - Basic Security Module

Why do you need it? Despite of popularity of network-based ID, host-based monitoring is becoming more important because of insider threat.

Host-based Detection Not all threats can be detected using Network-based ID. There are three main categories of the threats we deal with Host-based ID -Abuse of Privilege -Critical Data Access and Modification -Change in Security Configuration

Abuse of Privilege When a user has root, admin, or some other privilege and uses it in an unauthorized manner. Examples: Contractors with elevated Privileges Ex-employee with old account Admin creates Back-door account Inadvertent Privileges Granted.

Critical Data Access and Modification Mission-critical data = “Company Jewels” Any release/modification of this data carries a significant liability.

Examples Student Changes Grade Employee Modifies performance Evaluation. Falsification of Results Unauthorized Disclosure Theft of Personnel/Medical Reports. Web-site data is modified (Graffiti) Anonymous users browsing Critical Files.

Changes in Security Configuration Generally Security Configurations are one- time and static operations. Done when machine is built or deployed. Changes are necessary only when policy changes. By monitoring Security Configuration, unauthorized modifications may be caught early.

Examples User disabling locking Screen Savers Legal Notice Missing Guest Account Enabled. Open Registry Nomadic users with Compromised Systems.

Host-based ID Architecture Usually “agent-based” Two types of Host-based ID -Centralized - Raw data is forwarded to a central location before it is analyzed. -Distributed (real-time) - The raw data is analyzed in real-time on the target first and only alerts are forwarded.

Centralized host-based Architecture

Distributed real-time Architecture

Advantages of Centralized Architecture No performance degradation on the target Statistical behavioral information Multi-host signature Raw data archive for prosecution support

Disadvantages of Centralized Architecture No real-time detection. No real-time response. Some network Traffic.

Misconception  (revisited) Real-Time ID “I need Intrusion Detection” “Are you interested in network-based or host based?” “Oh, I need real-time Intrusion Detection” “Great, on the host or the network” “What???”

Advantages of Distributed real-time Architecture Real-time alerting Real-time response

Disadvantages of Distributed real-time Architecture Performance degradation on the target. No statistical behavioral information. No multi-host signatures. No raw data archive for prosecution support Reduced data forensics capabilities. Gaps in data analysis when system offline.

Target Agents Small executables that run with privilege on target systems. Factors to be considered –Performance –Management implications

Tasks of Target Agent Read audit data in real-time. Detect misuse and forward alerts. Centralize raw event logs. Set audit policy. Execute responses locally on the target. Verify file integrity. Perform Compliance checks.

Autonomous Agents They have mind of their own. They can move from system to system on their own. Advantage: Criminal will never know on which system they are currently. Disadvantage: Neither will you !

Operational Modes Operational mode describes the manner in which you will operate your HIDS and partially describe the end goals of monitoring. Four primary operational modes: -Tip-Off -Surveillance -Damage Assessment -Compliance

Tip-Off and Surveillance The defining characteristic for tip-off The system is detecting something previously unsuspected. (in/out-of band) Unlike tip-off, surveillance takes place when misuse is already indicated or suspected. It usually follows a tip-off from either an IDS or an out-of-band indicator.

Damage Assessment Used after an incident. Determining extent of Compromise. -actions leading to compromise -areas of compromise -Collateral damage -Residue effects (time-bomb) Data forensics

Compliance Confirming that users are complying with policies. -Proper use of application/process -Logging in/out at night.

Questions ?

Until then..