Engaging the Adversary as a Viable Response to Network Intrusion Sylvain P. Leblanc & G. Scott Knight Royal Military College of Canada PST 05 Workshop October 12, 2005

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 2 In a nutshell … We're going to hold onto him by the nose, and we're going to kick him in the ass. General George S. Patton England, May We must remain in contact with those who threaten our cyber infrastructure if we hope to successfully defend it.

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 3 Outline 1.Introduction 2.Information Operations 3.IO Counter-measures Tools Honeypots 4.Conclusion

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight Introduction The defence paradigm has been to Protect, Detect and React Protect Detect React It is important to gain information about those who threaten the infrastructure. It is not sufficient to React by cutting off access.

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight Information Operations (IO) Manoeuvre FirepowerCommandProtection Sustainment Information Operations Information Operations are a key combat function. IO are defined as actions taken in support of political and military objectives which influence decision makers by affecting others’ information while exploiting, or fully utilizing, one’s own information.

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 6 Defensive IO 1.Protection – 2.Defensive Counter-Information Operations (IO Counter- measures) - 3.Offensive Counter-Information Operations – Jamming the Radar Radar Absorbent Paint Chaff

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 7 Computer Network Operations (CNO) CNO represent all aspects of computer related operations, but they have three specific components –Defence (CND) –Attack (CNA) –Exploitation (CNE)

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 8 Operational Objectives 1.Holding Contact with the Adversary 2.Understanding the Adversary a)Who is attacking? b)What are they capable of? c)What are their current mission and objectives? d)What is the context of the current attack. 3.Preparing the Adversary

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 9 Network-based IO counter- measures Principles of Operations 1.Operational Objectives for Active Response 2.Combined Operations 3.Repeatable Operations a)Standing procedures b)Dedicated resources c)Computer Network Operations Order-of-Battle 4.Risk Management

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 10 Risk Management Access risks –Damage or alter information –Exfiltrate more sensitive information than expected –Push attack to other systems –Mount IO counter- counter-measure Denial implications –Inability to identify –Loss of knowledge on techniques and motivations –Loss of ability to influence –Encourage adversary to seek other ingress points

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight IO Counter-measures Tools Operational use with very high interaction The attacker must feel that he is in a real production environment –High fidelity environment –New tools Provide legitimate operational activity Capture attacker’s activity

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 12 Characteristics of IO Counter- measures Tools Components and mechanisms undetectable from user with root privileges. Behaviours and communication patterns appear legitimate from vantage point of other host on the network. Able to simulate normal human user at the interface level. Provide means of observing and collecting attacker activity Make de-conflicting attack traffic straightforward.

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 13 Honeypots Stem from the difficulty in discriminating attacker activity A honeypot’s value lies in being probed, attacked and compromised. Honeypots have no production value, making discrimination of attacker activity trivial. Credited with many successes.

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 14 Honeypot Classifications Spitzner suggests two main purposes –Production honeypots: Support operations by helping secure the environment. –Research honeypots: Gain information on attacker’s tools and techniques

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 15 Honeypot Levels of Interaction Level of Interaction Work to Install and Configure Work to Deploy and Maintain Information Gathering Potential Level of Risk LowEasy LimitedLow MediumInvolved VariableMedium HighDifficult ExtensiveHigh Spitzner’s proposes a taxonomy is based on the level of interaction afforded to the attacker.

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 16 IO Counter-measure example IO Counter-measures tool installed as part of baseline

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 17 IO Counter-measure example Intrusion Detected.

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 18 IO Counter-measures example Machine is physically isolated IO Counter-measures tool is activated Attacker is monitored and prepared

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight Conclusion Reactive-oriented defence policy is insufficient. Defence must include an understanding of the adversary. –First response should not always be to break contact –IO Counter-measures to gain information Principles of Operations for Network-based IO counter-measures –Operational Objectives Key Research Areas include tools –Obfuscate attacker behaviour observation –Simulate normal human user behaviour

October 12, 2005PST 05 - St-Andrew's NB, Leblanc & Knight 20 ??? Questions ???