RAR Enterprises, Inc.

The layered approach can best be compared as an analogy of weathering out a winter storm. Many people know the feeling of being stuck at home during a winter blizzard. The things one does in a winter storm are to heat some soup, turn up the furnace, snuggle up under the blankets, and start a fire in the fireplace. All of these things lead to a warm and secure feeling while waiting for the storm to pass. It's this utilization of separate things in the household that results in an overall approach that gives us that warm and fuzzy feeling in a winter storm. Thus, computer security is the most effective when multiple layers of security are used within an organization.

The most common misconception is that a firewall will secure your computer facilities and additional steps don't need to be taken. A firewall is just one component of an effective security model. Additional components or layers should be added to provide an effective security model within your organization. The security model that will protect your organization should be built upon the following layers:

1. Security policy of your organization
2. Host system security
3. Auditing
4. Router security
5. Firewalls
6. Intrusion detection systems
7. Incident response plan

Using multiple layers in a security model is the most effective method of deterring unauthorized use of computer systems and network services. Every layer provides some protection from intrusion, and the defeat of one layer may not lead to the compromise your whole organization. Each layer has some inter-dependence on other layers. For example, the intrusion detection systems and the incident response plan have some interdependencies. Although they can be implemented independently, it's best when they're implemented together. Having an intrusion detection system that can alert you to unauthorized attempts on your system has little value unless an incident response plan is in place to deal with problems. The most important part of overall security organization is the security policy. You must know what you need to protect and to what degree. All other layers of the security model follow logically after the implementation of the organization security policy.

In summary, an intrusion detection system is just one component of an effective security model for an organization. The overall security integrity of your organization is dependent upon the implementation of all layers of the security model. The implementation of the layered approach to security should be undertaken in a logical and methodical manner for best results and to ensure the overall sanity of the security personnel.

Peter Watson
Senior Security Architect
Purolator Courier Corp.

When we talk about Intrusion Detection Systems (IDS), management automatically assumed it is THE solution to all network, organization and social problems. Most people deal with this technology like it is a monolithic solution. This is not a good way to consider any security technology, it does not work like that. The majority fails to recognize that IDS' initial design and function is to protect the organization's vital information from an outsider.

However, this is now slowly changing, as more organizations want to monitor their "networks" because studies shows the majority of all losses in the commercial sector involve insiders. They now want to use the IDS in any of the following combinations: To track down insiders, catch them in the act, get the evidence needed for prosecution, fire them or take them to court for indictment.

New attack techniques are coming out each month and the IDS technology must adapt to these rapid changes. The list of all known attacks constantly changes rendering codifying the statistical "signature" of a new attack a daunting task for R&D labs.

Current Network Intrusion Detection System (NIDS) products (first generation) use a predominantly passive approach to collect data via protocol analysis by watching traffic on the network. Most IDS have been built on signature-base and anomaly detection, providing the capability to look for set "patterns" in packets, but they can also be tuned to look for things you should never see. The addition of specific string search signature (i.e. look for confidential), logging and TCP reset features has greatly enhance the IDS capability as a detection and protection tool.

Due to the inability of NIDS to see all the traffic on switched Ethernet, many companies are now turning to Host-based IDS (second generation). These products can use far more efficient intrusion detection techniques such as heuristic rules and analysis. Depending on the sophistication of the sensor, it may also learn and establish user profiles as part of its behavioral database. Charting what is normal behavior on the network would be accomplished over a period of time.

As part of the Total Defense Strategy of an organization, they offer additional protection and deterrence against:

• Script kiddies
• Hackers
• Would-be hackers
• Crackers
• Industrial espionage
• Elite Blackhat

The power of IDS is that it demonstrates a positive degree of readiness, which may be critical for long term success. If your business depends on networking, IDS is good business and well worth the return.

Guy Bruneau
DND CIRT

Last updated 4/8/2000

There are no fully mature open standards for ID at present. However, we are getting close.

The Internet Engineering Task Force (IETF) is the body which develops new Internet standards. They have a working group to develop a common format for IDS alerts. The group has worked through the requirements phase, and the design is substantially fleshed out, though details continue to change. Preliminary implementation work is probably possible, though implementations would have to change as the standard is finalized. The design involves sending XML based alerts over an HTTP like communications format. A lot of attention has been paid to the needs of IDS analysis, and to making the protocol work through firewalls in a straightforward way.

More contributors are always welcome. IETF working groups are open to any technically competent individual who wishes to contribute. Individuals represent their own views on the best way to solve the problem, rather than the agenda of their employer.

There is also an effort by the ISO's T4 committee to develop an Intrusion Detection Framework. The status of that effort is presently unknown, and attempts by the FAQ item author to reach prominent figures in that effort were unsuccessful.

A "honeypot" is a tool that can help protect for network from unauthorized access. The honeypot contains no data or applications critical to the company but has enough interesting data to lure a hacker. A honeypot is a computer on your network the sole purpose is to look and act like a legitimate computer but actually is configured to interact with potential hackers in such a way as to capture details of their attacks. Honeypots are known also as a sacrificial lamb, decoy, or booby trap. The more realistic the interaction, the longer the attacker will stay occupied on honeypot systems and away from your production systems. The longer the hacker stays using the honeypot, the more will be disclosed about their techniques. This information can be used to identify what they are after, what is their skill level, and what tools do they use. All this information is then used to better prepare your network and host defenses.

The honeypot can be used to augment the deployment of an IDR system. Some of the problems with commercial IDR include inability for detection of low level attacks, techniques or tools that are new or not previously known, or use of techniques that may appear as legitimate user activity. To a certain extent, the honeypot is also subject to missing new attacks. However, the honeypot is uniquely capable of letting you know that some hacker is in your network doing things they have no business doing. The honeypot may spot them because as far as other security measures (including IDR) are concerned they are legitimate users.

Phil Bandy, Michael Money & Karen Worstell
SRI Consulting

The best place to start really depends upon the organization and the necessity for keeping its information secure. One good starting place is to look at the impact of past intrusions. If the company has been subject to recent intrusions and hacking activity, they will be cognizant of the risks out of necessity. Studying past intrusions and the company’s response will be helpful in framing the business case for intrusion detection products. For example, intrusion detection products would have caught the intrusion sooner saving $X.XX and the embarrassment of the intrusion in the press.

The cost of prior intrusions will be beneficial in the preparation of a preliminary cost benefit analysis. The cost of an intrusion may include production downtime, negative public relations that may affect a company’s stock price, sabotage of critical information leading to bad decisions, or unauthorized access or theft of confidential information leading to the loss of a competitive advantage. The cost also includes the expenses associated with investigation, legal, forensic and management reporting.

The understanding of the benefits of intrusion detection has to be developed with a general familiarity with the intrusion detection products currently in the market. The goals and objectives of the intrusion detection products need to be understood. Understanding the relation between the business case objectives and those of specific products helps articulate what is possible to achieve and will also pave the way for selecting products that meet company IDS needs. Unfortunately, there are not many textual reference books available on intrusion detection. Web sites, white papers, product brochures and intrusion detection conferences will provide a good starting point for assembling this information. Discussing intrusion detection with other organizations that have implemented intrusion detection may prove to be very helpful.

The next step is to translate this material for management. White papers and presentations are good mechanisms to increase management’s awareness and understanding of intrusion detection. The objective is to establish a good business case for using intrusion detection. The costs of recent break-ins by intrusions into the company will help support the business case even if only at the anecdotal level. Certainly, recent related cases from the media would help reinforce the need for intrusion detection. Management will be more likely to take action when the business case is strongly articulated and clearly related to the benefits of intrusion detection products.

Phil Bandy, Michael Money & Karen Worstell

SRI Consulting

Intrusion detection is needed in today’s computing environment because it is impossible to keep pace with the current and potential threats and vulnerabilities in our computing systems. The environment is constantly evolving and changing fueled by new technology and the Internet. To make matters worse, threats and vulnerabilities in this environment are also constantly evolving. Intrusion detection products are tools to assist in managing threats and vulnerabilities in this changing environment.

Threats are people or groups who have the potential to compromise your computer system. These may be a curious teenager, a disgruntled employee, or espionage from a rival company or a foreign government. The hacker has become a nemesis to many companies.

Vulnerabilities are weaknesses in the systems. Vulnerabilities can be exploited and used to compromise your system. New vulnerabilities are discovered all of the time. Every new technology, product, or system brings with it a new generation of bugs and unintended conflicts or flaws. Also the possible impacts from exploiting these vulnerabilities is constantly evolving. In a worst-case scenario, an intrusion may cause production downtime, sabotage of critical information, theft of confidential information, cash, or other assets, or even negative public relations that may affect a company’s stock price.

Intrusion detection products are tools that can assist in protecting a company from intrusion by expanding the options available to manage the risk from threats and vulnerabilities. Intrusion detection capabilities can help a company secure its information. The tool could be used to detect an intruder, identify and stop the intruder, support investigations to find out how the intruder got in, and stop the exploit from use by future intruders. The correction should be applied across the enterprise to all similar platforms. Intrusion detection products can become a very powerful tool in the information security practitioner’s tool kit.

Phil Bandy, Michael Money & Karen Worstell
SRI Consulting

Many corporate networks and corporate security policies rely heavily on intrusion detection to alert administrators of intrusion. With all of the features of modern intrusion detection systems there are some tragic flaws inherent in their design. These weaknesses apply to Snort and all other signature based intrusion detection engines. Snort is singled out in this paper because of its popularity and its familiarity amongst the SANS community.

Snort is an intrusion detection system written by Martin Roesch. Snort is was written as an open source project and is available for free under the GNU public license. The software is based upon a signature comparison engine optimized for speed. Snort offers many features that make it an ideal choice in the battle against Internet intruders. Here is a description of Snort from the Snort website:

Snort was written to take advantage of a highly modularized design. The application can take advantage of several different pre-processors to normalize, filter, and categorize data. Snort also has very powerful post-processors, or output plug-ins, that can be used to log the data generated by Snort in several different ways. Because Snort is an open source project and that it has many users its signature database is updated often and are simple to update.

Understanding how signatures work is essential to understanding how to defeat them. When Snort is given an incoming packet from the packet capture driver it compares that packet to its database of known signatures. The signature has some key aspect of the packet that it is compared against to look for a match. If a match occurs than Snort sends the output to a standard output mechanism or to one of the configured post-processor output plug-ins. For example if Snort received the following packet then it would compare it against its database:

and match it to rule:

This event would trigger an alert message. Most signatures do not just look for what port a packet is to or from, but it also examines part of the payload. As new security holes and exploits are found new signatures are written to counteract the danger.

What Snort and other signature based intrusion detection systems count on is that malicious traffic will have unique patterns to it that can be matched against rules in the database. For example Snort uses the following rule to look for the SubSeven Trojan:

The important part of this rule to note is that Snort is looking for the hex signature "0d 0a 5b 52 50 4c 5d 30 30 32 0d 0a" that is located anywhere in the payload of the packet.

It then seems obvious that there are many ways of circumventing this signature. The first thing that we could do is vary the destination port. This is usually undesirable though since the infected machine is probably using the default port for SubSeven to make it easier to scan for. If the attacker knows what port SubSeven should be running on then they could quickly and easily scan large blocks of addresses for machines listening on that port. The next evasion technique that an attacker could use would be change or scramble the content that the sensor is looking for. This could be accomplished by using some very simple form of encryption. Here is how a simple packet encryption might work:

1^st byte of the packet payload is the value to be added to every subsequent byte. If we use 3 then our payload of "0d 0a 5b 52 50 4c 5d 30 30 32 0d 0a" becomes "31 3d 8e 85 83 7f 81 63 63 65 31 3e" which does not mach any of the known signatures. The attacker has now evaded our intrusion detection system. Another twist of this technique could incorporate public key/ private key encryption. The private key for the server and the public key for the client could be sent or bundled with the original install. This would render all communication between the 2 hosts unintelligible and undetectable by intrusion detection systems.

New techniques are also being developed to change how the executable code that runs Trojans and other applications looks. As reported in a recent ZDNET article:

Snort and other intrusion detection systems do excel in detecting attacks on services that require an exploit that cannot be encrypted. Attacks like this would include buffer overflows, directory traversal, and scanning attempts. These types of attacks rely on existing flaws within the victim machine. These flaws can typically only be exploited using a certain attack mechanism that will have a certain signature. In these cases signature based intrusion detection does very well at detecting these patterns and alerting or stopping them.

The problem with intrusion detection as it relates to attacks on services is that it may take some time for a new exploit to become known. After the exploit is known then a new signature can be written for it and distributed. This leaves many systems vulnerable to unknowing attack for a certain period of time. It is possible that a well-executed attack will leave no trace of intrusion thereby rendering all of the effort placed into intrusion detection wasted. IDS are also hurt by a lack of supporting data for attacks that were not immediately recognized. The author of Stick, Cortez Giovanni says:

Although denial of service attacks are typically associated with individual machines or networks, it is also possible to apply denial of service techniques against signature based intrusion detection systems. Jerry Marsh states one such possible technique in an article he wrote:

This is just one method of implementing a denial of service attack against an intrusion detection system.

Another possible method of implementing a denial of service against an IDS would be to exhaust the resources of that IDS. This denial of service would flood the IDS with traffic that will generate alerts until the IDS runs out of resources. This would cause the IDS to have an incomplete log of the events that took place. Here is the post of an author who claims to have written a tool to automatically overwhelm IDS systems.

Although signature based IDS do provide a useful service to let an administrator know that he/she has been or is being attacked they should not be relied upon. It is far too easy to fool or shut down an IDS machine for them to be utilized as the primary line of defense against intruders. Some recommendations that have been given by Lawrence R. Halme and R. Kenneth Bauer in their article "AINT Misbehaving: A Taxonomy of Anti-Intrusion Techniques" are to use the following practices in conjunction with intrusion detection:

• Prevention
• Preemption
• Deterrence
• Deflection
• Countermeasures

Intrusion detection should be part of a defense in depth strategy and no single tool or technology should be relied upon exclusively.

[7] Posting on Snort users mailing list by Cortez Giovanni.