Computer Security and Intrusion Detection(IDS/IPS)

IDS/IPS
Computer Security and Intrusion Detection
• Communication
•Any communication requires 4 entities
•Source
•Destination
•Medium
•Protocol – Rule

IDS/IPS
• Communication – Flow of Information

IDS/IPS
• Various types of attacks
•Interruption
•Interception
•Modification
•Fabrication

IDS/IPS
• Interruption - state where the asset of a system gets
destroyed or becomes un-available
• targets the source or the communication channel
• prevents the information from reaching the destination

IDS/IPS
• Interruption - Examples
• Cutting the physical cable medium
• Overload the carrying medium
• Types of Denial of Service (DoS) Attacks

IDS/IPS
• Interception – un-authorized party gets illegal access to
the information traversing through the communication
channel.
• Examples
•Wiretapping

IDS/IPS
• Modification – information is intercepted and modified .
• Examples
•MITM Attacks

IDS/IPS
• Fabrication – attacker inserts forged objects into the
system without the senders knowledge and involvement .

IDS/IPS
• Fabrication – 2 types
• Replaying
• previously intercepted entity is inserted
• Example – Replaying an authentication message.
• Masquerading
• attacker pretends to be the legitimate source
• inserts his / her desired information
• Example – Adding new records to a file or database

IDS/IPS
• Security Property
•Desired feature of a system with regard to certain
type of attacks.
•The four attacks discussed in the previous section
violates the various security properties of an
information system
•Core qualities of any information system

IDS/IPS
• Security Property
•Confidentiality
•Integrity
•Availability
•Authentication
•Non Repudiation

IDS/IPS
• Traffic Analysis - Process of intercepting and
examining messages in order to deduce information
from patterns in communication. Information collected
include:
•Source
•Destination
•Timing of the data
•Frequency of a particular message
•Type of data / communication

IDS/IPS
• Non-repudiation
Concept of ensuring that a contract cannot later be
denied by one of the parties involved.
• Describes the mechanism that prevents either sender
or receiver from denying a transmitted message.
•Non-repudiation of origin – proves data has been sent
•Non-repudiation of delivery – proves data has been
received

IDS/IPS
•Security Mechanisms
The various actions and countermeasures
employed to safeguard the security properties of an
information system.
•Security Mechanisms – 3 Types
•Attack Prevention
•Attack Avoidance
•Attack Detection

IDS/IPS
• Attack Prevention
Series of security mechanisms implemented to
prevent or defend against various kinds of attacks
before they can actually reach and affect the target
system.
•Examples
•Access Control
•Firewall

IDS/IPS
• Attack Avoidance
Techniques in which the information is modified in a
way that makes it unusable for the attacker.
•Assumption – Attacker may / has access to the
subject information.
•Examples
• Cryptography

IDS/IPS
• Attack Detection
Process / Technique of reporting that something is
able to bypass the security measures (if available),
and identifying the type of attack.
• Counter measures are initiated to recover from the
impact of the attack.
•Examples
• IDS / IPS

IDS/IPS
• Intrusion Detection System
Intrusion detection encompasses a range of
security techniques designed to detect (and report
on) malicious system and network activity or to
record evidence of intrusion.

IDS/IPS
Attack Framework
• Types of Events – 2
• Attributable
Event can be traced to an authenticated user
•Non-attributable
Event cannot be traced to an authenticated user.
Ex: Any event that occur before authentication in
the login process – bad password attempts.

IDS/IPS
Attack Framework
Vulnerability
•Existence of a weakness, design, or implementation
error that can lead to an unexpected, undesirable
event compromising the security of the system,
network, application, or protocol involved
•Pen Testers Point of View - From a penetration
tester’s point of view, vulnerability is defined as a
security weakness in a Target of Evaluation.

IDS/IPS
Attack Framework
Threat
• Any possible event, action, process or phenomenon
that can potentially inflict damage on system resources

IDS/IPS
Attack Framework
Relation between Vulnerability and Threat

IDS/IPS
Attack Framework
Real Life Case Study – European Space Agency
•Ariane 5 Rocket – 10 years and $ 7 million
•Capable of placing a pair of three-ton satellites into
the orbit.
•Launched on 04 Jun 1996

IDS/IPS
Attack Framework
Immediately after launch, Ariane 5
exploded
Case of the explosion
a very small computer program
trying to stuff a 64-bit number into a
16-bit space
See it:
http://s.freissinet.free.fr/videos/aria
ne5.wmv

IDS/IPS
Attack Framework
Vulnerability Classification
Vulnerabilities can be classified as follows:
• Design Vulnerabilities
• Implementation Vulnerabilities
• Configuration or Operational Vulnerabilities

IDS/IPS
Attack Framework
Design Vulnerability
• When the vulnerability is said to be inherent to the
project or design
• Very difficult to detect and eliminate as it is
inherent to the project
• Proper implementation of the product will not get
rid of the flaw
• Example - TCP/IP protocol stack vulnerability

IDS/IPS
Attack Framework
Implementation Vulnerability
• When an error is introduced into the components
of a system, during the implementation stage of a
project or algorithm, they are termed as
Implementation Vulnerabilities.
• Error could be hardware based or software based.
• Example – Buffer Overflows

IDS/IPS
Attack Framework
Configuration Vulnerability
• Also known as Operational Vulnerability.
• Introduced into the system when the administrator
responsible does not perform the proper
configuration or sometimes leaving the default
configuration on.
•Example - Not disabling unwanted services,
allowing weak passwords

IDS/IPS
Attack Framework
Attacks
• an assault on system security that derives from an
intelligent threat.
• an intelligent act that is a deliberate attempt to
evade security services and violate the security
policy of a system
•Example - denial of service attacks, penetration
and sabotage

IDS/IPS
Attack Framework
Difference between Attack and Security Event
• Attack - the intruder aims at achieving a particular
result which could be against the implied security
policy
• Event – No rules are violated or broken

IDS/IPS
Attack Framework
Attack Components
• Attack realization tool – Example - Port
Scanner
• Vulnerability – Exploit a known vulnerability
• Security Event – actions on target system
• Result of the Attack - When an attacker is
able to exploit vulnerability and has generated a
security event
The results of an attack may vary depending upon
the security event and vulnerability chosen.

IDS/IPS
Attack Framework
ATTACKER
TARGET
PERFORMS ATTACK
General Attack Model

IDS/IPS
Attack Framework
The attacker and target represent the same entity
ATTACKER AND TARGET
ARE ON THE SAME
ENTITY

IDS/IPS
Attack Framework
Attack Model Categories
• Traditional Attack Model
• One-to-one Attack Model
• One-to-many Attack Model
• Distribution Attack Model
• Many-to-one Attack Model
• Many-to-many Attack Model

IDS/IPS
Attack Framework
Traditional Attack Model
• Attack always originate from a single point.
• Single – tier architecture
• There is only a single layer between the attacker
and the target.

IDS/IPS
Attack Framework
One-to-one (traditional attack model)
• The attacker and target is having a one-to-one
relationship.
•Attack originates from a single machine.

IDS/IPS
Attack Framework
One-to-many (traditional attack model)
• The attacker and target is having a one-to-many
relationship.
•Attack originates from a single machine, but more
than one target is there

IDS/IPS
Attack Framework
One-to-many (traditional attack model)

IDS/IPS
Attack Framework
Distributed Attack Model
• Based on many-to-one and many-to-many
relationship.
• Source of the attack is more than one entity.
• The attack packets originate from intermediate
systems compromised by the attacker.

IDS/IPS
Attack Framework
Many-to-one (Distributed attack model)
• The attacker and target is having a Many-to-one
relationship.
•Attack originates from more than one machine.
•There is only one target

IDS/IPS
Attack Framework
Many-to-one (Distributed attack model)

IDS/IPS
Attack Framework
Many-to-many (Distributed attack model)
• The attacker and target is having a Many-to-many
relationship.
•Attack originates from more than one machine.
•There are more than one target

IDS/IPS
Attack Framework
Many-to-many (Distributed attack model)

IDS/IPS
Attack Framework
Distributed attack
• Reconnaissance – searching for suitable host.
• Compromise the system – installing backdoors
• Attack Initiation – start the attack using the
compromised system.

IDS/IPS
Attack Framework
Distributed attack - Agents
• Two types of special agents
•Masters / Servers
•Daemons / Clients
•Zombie – compromised systems where agents are
installed.
•Distributed attacks implement a three tier
architecture

IDS/IPS
Attack Framework
Distributed attack - Advantages
• Attack Effect – devastating effect as attack
originates from multiple locations.
• Anonymity – provides high level of anonymity to
the attacker.
• Hard-to-stop attacks – Very difficult to stop the
attack without bringing down or disconnecting the
target system

IDS/IPS
Attack Framework
Intruder
• Also known as attacker – first element in the
attack model.
•person who attempts to gain unauthorized access
to a system, to damage that system, or to disturb
data on that system
•attempts to violate Security by interfering with
system Availability, data Integrity or data
Confidentialit

IDS/IPS
Attack Framework
Intruder Types
•Black Hat Hacker
•Hacker spies support by Govt
•Cyber Terrorist
•Corporate Spies
•Professional Criminals
•Vandals

IDS/IPS
Attack Framework
Incidents
•violation or imminent threat of violation that
could or results in
•a loss of data confidentiality,
•disruption of data or system integrity, or
disruption or denial of availability
•An incident must clearly be a breach of network
security.

IDS/IPS
Attack Framework
Examples of Incidents
• DoS
• Malicious Code
• Unauthorized Access
• Inappropriate Usage

IDS/IPS
Introduction to IDS and IPS
Intrusion - any unauthorized system or network
activity on one (or more of) computer(s) or
network(s)
Intrusion detection systems (IDSs) are software
or/and hardware based systems that detect
intrusions to your network / host based on a number
of telltale signs.

IDS/IPS
Two types of IDS:
•Active IDS –
•attempt to block attacks
•respond with countermeasures
•alert administrators
•Passive IDS –
•merely log the intrusion
•create audit trails

IDS/IPS
IDS can provide the following information on
attempted or actual security events
•Data destruction
•Denial-of-service
•Hostile Code
•Network or system eavesdropping
•System or network mapping and intrusion
•Unauthorized access

IDS/IPS
Types of IDS
•Host - based Intrusion detection system (HIDS)
•Network-based intrusion detection system
(NIDS)
•Hybrid Intrusion Detection Systems

IDS/IPS
HIDS
•Resides on the host
•They scan log files – OS log files, application
log files etc
•If the log files are corrupt, HIDS is not effective.
•The scan output is logged into secure database
and compared to detect any intrusion.

IDS/IPS
Types of HIDS
• Operating System Level – Works on OS log
files.
•Application Level – Works on application level
log files.
• Network Level – works on packets addressed
to or sent from a host.

IDS/IPS
Advantages of HIDS
• Cost Effective
• Additional Layer of Protection.
• Direct control over system entities – works on
packets addressed to or sent from a host.

IDS/IPS
NIDS
• IDS responsible for detecting in-appropriate,
anomalous, or any other kind of data which may
be considered unauthorized or inappropriate for
a subject network
• Pattern based
HIDS – Combination of HIDS and NIDS

IDS/IPS
IPS
• Sophisticated class of network security
implementation that not only has the ability to detect
the presence of intruders and their actions, but also
to prevent them from successfully launching any
attack.
• Incorporate the security features of firewall
technology and that of intrusion detection systems

IDS/IPS
IPS Categories
• Host IPS (HIPS)
•Loaded on each PC and server
• Network IPS (NIPS)
•Component that effectively integrates into your
overall network security framework.

IDS/IPS
Benefits of HIPS
• Attack Prevention
• Patch Relief
• Internal Attack propagation prevention
• Policy enforcement
• Regulatory requirements

IDS/IPS
NIPS - Places sensors as L2 forwarding devices.

IDS/IPS
Main difference between IDS and IPS – packet
dropping.
Dropping of packets – Categories
•Dropping a single packet
•Dropping all packets for a connection
•Dropping all traffic from a source IP.

IDS/IPS

IDS/IPS
Defense in Depth.
• Also known as Elastic defense.
• Military strategy that seeks to delay rather than
prevent the advance of an attacker.
• Represents the use of multiple computer security
techniques to help mitigate the risk of one
component of the defense being compromised or
circumvented.

IDS/IPS
Defense in Depth
•Attacker has to penetrate a series of layered
defenses
• Each layer is equipped with the suitable defense
• The delay provides the security staff with the time
to respond to the attack.

IDS/IPS
Defense in Depth

IDS/IPS
IDS & IPS Analysis Scheme
•A baseline is first set.
•Baseline - known value or quantity with which an
unknown is compared when measured or assessed
•A group of network activities / characteristics are
categorized as baseline for an IDS system
•Anything outside baseline - malicious

IDS/IPS
Network Activity Baseline
Variance from
the Baseline
activities

IDS/IPS
IDS Analysis
• Process of organizing the various elements of
data related to IDS and their inter-relationships to
identify any irregular activity of interest.

IDS/IPS
IDS Analysis
Divided into 4 phases:
• Preprocessing
• Analysis
• Response
• Refinement

IDS/IPS
Detection Methodologies
• Rule based Detection
• Also known as Misuse Detection or Signature
detection or pattern matching.
• First scheme used in earlier IDS
• process of attempting to identify instances of
network attacks by comparing current activity
against the expected actions of an intruder

IDS/IPS
• Anomaly Detection
• Also known as profile-based detection
•A profile is created for each user group on the
system.
•The profile created is then used as a baseline
to define user activity.
•If network activity deviates from baseline, alarm
is generated.

IDS/IPS
• Behavior Anomaly Detection
• Looks for anomalies in user behavior.
• Characteristics dependent rather than
statistical.

IDS/IPS
• Network Behavior Anomaly Detection (NMAD)
• Also known as traffic anomaly systems
• Process of continuously monitoring a
proprietary network for unusual events or trends
• Basically statistical rather than characteristics.

IDS/IPS
• Protocol Anomaly Systems
• Look for deviations from the set protocol
standards.
• Primarily characteristics based.
• Not very reliable and generates false positives.

IDS/IPS
• Target Monitoring Systems
• Look for modification of specified files or
objects.
• More of a corrective control.
•Creates crypto checksum for each file.
•This checksum is compared at regular intervals
to detect any changes.

IDS/IPS
Heuristics
• Still in its initial stages
• Refers to the use of AI in detecting Intrusions.
• AI scripting language is used to apply the
analysis to the incoming data.

IDS/IPS
Hybrid Approach
• Any system that uses a combination of the
above mentioned analysis

IDS/IPS
Some Myths
•IDS and IPS are two separate solutions
•IDSs and IPSs will catch or stop all network
intrusions
•IDS give too many false positives
•IDS will eventually replace firewalls.
•Few Security Admins are required if you deploy
an IDS

Computer Security and Intrusion Detection(IDS/IPS)

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Destaque

Destaque (20)

Semelhante a Computer Security and Intrusion Detection(IDS/IPS)

Semelhante a Computer Security and Intrusion Detection(IDS/IPS) (20)

Mais de LJ PROJECTS

Mais de LJ PROJECTS (11)

Último

Último (20)

Computer Security and Intrusion Detection(IDS/IPS)