Intrusion Detection, Internet Law Enforcement and Insurance Coverage to Accelerate the Proliferation of Internet Business

Transcription

1 Intrusion Detection, Internet Lw Enforcement nd Insurnce Coverge to Accelerte the Prolifertion of Internet Business Abstrct Christopher Ting, Ong Ting Hwee, Tn Yong Ti & Ng Pek Yong DSO Ntionl Lbortories 20 Science Prk Drive Singpore In this rticle, we propose frmework to ccelerte the ubiquitous cpitliztion of Internet s vehicle to merchndise goods nd services. The motivtion for proposing this frmework derives from the fct tht mny consumers nd smll-to-medium-sized compnies re still hesitnt to use Internet to shop, trde nd disclose sensitive informtion such s credit crd numbers. While IT security technologies nd products re widely vilble, there re still gps tht hve to be filled in before Internet becomes truly vible nd profitble chnnel to do business. The business model tht we propose is nchored upon the trilogy of three elements, which re interwoven nd indispensble. We believe tht to do business over the cyberspce, IT security technologies need to be complemented by finncil nd lw enforcement instruments. We propose nd present the cse tht Intrusion Detection, Internet Lw Enforcement nd Insurnce Coverge (I3) cn fill the gps, both from the technicl s well s non-technicl stndpoints. Just like Commnd, Control nd Communictions (C3) re indispensble in ny militry opertions, I3 re criticl to creting trusted environment for Internet Business. The highlight of the I3 frmework is n Agent-bsed Monitoring, Intrusion Detection And Response (AMIDAR) system. AMIDAR is proposed to enble the lw enforcement gency to police the cyberspce effectively, so tht both the virtul shop owners nd the consumers feel secure to buy nd sell on the Internet. For the insurnce underwriters, AMIDAR forms the bsis to gin insights into the residul risk, nd to drw up relistic insurnce policies tht sell well. We lso point out tht risk ssessment, utomted systems configurtion checking s well s computer forensics re the ssocited technologies to help mke the I3 business model fesible. Another novelty is the shopping protocol. It is designed to rise the level of ssurnce to the proposed I3 frmework ginst frud. We hope tht the I3 frmework with the ssocited shopping protocol cn turn the Internet into mrket plce. 1. Introduction Evolving from working prototype in the reserch lbs nd cdemi, Internet hs gined its sttute in reching out to the mss in the erly 90 s. Although electronic trnsctions re not new nd they hve existed even before the rrivl of Internet nd web, only big corportions nd government bodies cn fford the resources to stremline their finncil, tendering nd other trnsctions with externl business prtners. Internet bnking, Internet commerce, Internet retiling nd so on re still t the rudimentry stge, t lest in the context of Singpore. Set in the Asin bckdrop, Singporen consumers re reluctnt to disclose their credit crd informtion over the insecure Internet. The entrepreneurs nd retilers, especilly those not in the IT-relted businesses re lso hesitnt to exercise the option of using 1

2 Internet s vehicle to lunch strtegic dimension to their trditionl business prctices. Prt of the reson stnds from the fct tht there is no security ssurnce; the libilities re lso mbiguous. Despite the vilbility of IT infrstructure, IT security products nd consulting services, there is prevlent sense of mystique nd insecurity s fr s Internet business is concerned. In this pper, we propose triprtite frmework to ddress the issues of lck of ssurnce nd confidence. It is hoped tht the I3 frmework of Intrusion Detection, Internet Lw Enforcement nd Insurnce Coverge will ctlyze the process of turning Internet into vibrnt mrket plce. 2. Problem Formultion & Principl Considertions If smll-sized business tke florist shop for instnce were to put up web server to dvertise the rnge of goods nd the order informtion, would the shop owner end up loosing money? On more positive note, wht is the profit mrgin tht he cn expect from the sles tht re ttributed to the orders coming through the Internet? On the other hnd, from the consumer s point of view, is there mechnism to ssure tht his credit crd informtion is well protected? There re probbly more issues tht need to be considered, such s non-repudition, clims of goods not received physiclly nd not in good conditions nd so on. However, these issues re common to ordering piece of pizz over the telephone, or wtch by mil. As they re not specific to Internet business, we shll not discuss them in this pper. Agin, much s people still prefer reding hrd-copied documents thn their electronic versions, chnging the hbit of choosing merchndised objects with physicl touch is not over-night. Hving sid tht, it is up to the imgintion of every money-mking merchnt to think of innovtive nd clever wys to llow the Internet shoppers to exmine goods, sy durins, through the web. Hence, we will not ddress the problem of hbits here. Suppose, buy-nd-sell (be it flower, durin or stock option) vi the Internet is ccompnied by finncil commitment in the form of credit or other types of electronic rrngement, wht re the instruments needed to give confidence to both the suppliers nd consumers? This is the problem tht this pper is ddressing. From the consumer s point of view, he is worried tht C1 He loses his credit crd informtion nd other personl informtion C2 It seems tht Singporens re not the exception. The British poll shows tht 69% of the British compnies re hesitnt to do business over the Internet [1]. In this pper, the I3 frmework is restricted to the locl context of Singpore. Although it is interesting, more meningful nd useful to conceive frmework tht pplies cross ntionl borders, the legl spects re likely to become overwhelmingly complex nd controversil to ddress in this conference dequtely. 2

3 He is trnscting with spoofed web site From the supplier s point of view, he is worried tht S1 He is lible to py for the customer s clim tht its web site is responsible for disclosing the personl informtion. S2 His web server is broken into by hckers, who my lter the content of the web pges. S3 His web server is crshed by denil-of-service ttcks, nd during the downtime, his business my potentilly lose out to his competitors. 3. Intrusion Monitoring, Detection nd Response Before discussing the proposed I3 frmework, description of n Agent-bsed Monitoring, Intrusion Detection And Response (AMIDAR) system is in order. While there re mny technicl spects of AMIDAR, we hve selected to describe those tht re relevnt to this pper. In our technologicl development project, we hve rpid-prototyped n AMIDAR tht provides the following security services: Monitor the IP pckets trvelling in the network to detect nd respond to network-bsed ttcks Monitor the log generted by the firewll to look for suspicious ctivities in the network Monitor the servers log entries online to detect nd respond to host-bsed ttcks Monitor the behviour of the router to detect nd respond to ttcks trgeted t it While there re mny intrusion detection products in the mrket, s well s mny dvnced prototypes in the reserch lbs ll over the world, the AMIDAR is the first in being n integrted suite of intrusion detection nd response cpbility. In ddition, AMIDAR is contemporry in the sense tht it dopts the technology of softwre gents in building the prototype. From our experience, we find tht the benefits tht we hve obtined in dopting the gent-bsed pproch re s follows. Ese of instlltion nd deployment Ese of dministrtion Relibility nd robustness in the communictions of intrusion detection informtion to the dministrtor or the custodin of the informtion systems. 3

4 Sclbility Re-configurbility Ese of softwre development becuse of high re-usbility nd modulrity Ese of updte for detection nd response ginst new cyberspce exploits 4. Some Technicl Aspects of AMIDAR The system rchitecture of AMIDAR prototype [2] is depicted in Figure 1. From the user s point of view, it is very importnt to see to it tht the IT security product does not introduce noticeble performnce hit on the computer systems nd networks tht it is protecting. Therefore, when designing AMIDAR, we hve dopted the strtegy: pssive sniffing to monitor the networks nd systems. distributed computing to rrive t the decisions of hving detected intrusion ttempts. In other words, the ides re to imge or mirror IP dt from the networks nd systems, s well s to process IP dt on different mchines. Now, given the sme price, the performnce of PC is doubled every yer; it is costeffective to run monitoring progrm (cyberspce sensor or imger) on the PC. Wht bout the brin of AMIDAR, which is to process the IP nd rrive t some conclusions? It too, is being run in the sme PC tht runs the monitoring progrm. The brin is distributed becuse for every monitor (sensor), there is clss of gents ssocited to it to detect cyberspce intrusion ttempts. Essentilly, AMIDAR hs the following modules: Network-bsed Intrusion Detection Module Network Monitor. Building upon tcpdump, this is n in-house developed network sniffer. It runs on PC. It is high- performnce in the sense tht it cn sniff pckets from the network without missing ny (on 10 Mbit/sec trffic flow). Being pssive listener of the network trffic, the network monitor does not ffect the network performnce. They re most effective when deployed t strtegic loctions. Network Intrusion Detection Agents. By processing the IP pckets provided by the network monitor, this clss of gents scns nd monitors the network to check for bnorml nd mlicious network pckets. It lso hs the functionlity to record importnt network sessions. The gents run in the sme PC tht hosts the network monitor. Firewll-bsed Intrusion Detection Module Firewll Monitor. Anlogous to the network monitor, this is n in-house developed progrm tht sniffs the log generted by the firewll softwre. It lso runs on PC, which is connected directly to the computer tht runs the firewll. 4

5 Firewll Intrusion Detection Agents. This clss of gents prses the log dt nd look for events tht re indictive of network-bsed ttcks. Dropped pckets, unusul network ccess trces re the things the gents look for. The gents run in the sme PC tht runs the firewll monitor. Host-bsed Intrusion Detection Module Host Monitor. Host refers to informtion system servers such s emil server, web server, dtbse server, ppliction server nd so on. Anlogous to the network monitor, this is n in-house developed progrm tht sniffs the log generted by the server to be monitored. Host monitor runs on PC, which is directly connected to the host. Host Intrusion Detection Agents.This clss of gents prse the log dt nd look for events tht re indictive of ttempted brek-in vi for exmple buffer overflow. It lso keeps trck of filed login events. The gents run in the sme PC tht runs the host monitor. Intrusion Detection Module for Router Router Monitor. Connected directly to the router, router monitor is PCclss mchine tht pulls event dt from the router. Router Intrusion Detection Agents. This clss of gents prses the event dt nd looks for tell-tle signs of ttcks trgeted t the router itself. The gents run on the router monitor mchine. Centrl Controller The centrl controller is the nerve centre of the intrusion detection gents. It controls, distributes nd dministers ll the four clsses of gents. It runs two bckground processes: the hertbet listener nd the lert listener. These two processes form the core to mintin uthenticted communictions with the gents distributed to the network monitors, firewll monitors, host monitors nd router monitors. Whenever the detection gents hve detected intrusions, they will report to the centrl controller for it to respond by, for exmple, pging the system dministrtors. 5. Re-engineering AMIDAR for Internet Lw Enforcement In erlier sections, we hve seen tht AMIDAR is network of distributed cyberspce sensors nd detectors. The deployment of AMIDAR is bout superimposing it on existing networks nd computer systems to be protected. In the context of Internet business, the lw enforcement gency hs definitive role to ply to police the cyberspce. The objective is to provide sense of security for Internet users to set up virtul shops nd counters, nd for consumers to purchse goods nd services. For lw enforcement gency to police the cyberspce effectively, tools re needed. Quite nlogous to the concept of neighbourhood police post, the vrious detection modules Other types of responses re conceivble nd implemented, but they will not be discussed here to keep the pper concise. 5

6 cn be deployed t virtul shops on the Internet. The centrl controllers, or hierrchy of them cn be deployed t the hedqurters. Unlike physicl spce, cyberspce respects no ntionl boundries. It is hopeless to stop nd prosecute overses hckers to come in nd crete senstionl story lines on locl mss medi. Given this relity, which is not likely to improve for the next 5 yers, the Internet business we hve in mind is restricted to the locl scene. In ny cse, multi-ntionl nd big compnies hve lredy strted using the Internet to do their business, nd they cn fford to engge consultnts, buy security products to protect themselves, nd mnge the risk. But wht bout locl smll- nd medium-sized compnies? Wht bout locl consumers who wnt to shop nd buy goods nd services vilble on the locl mrket? We know tht every country is ssigned rnge of well-defined IP ddresses. Techniclly, router cn be configured to filter IP pckets bsed on IP ddresses. Therefore, it is possible to restrict Internet business to the locl mrket until n interntionl frmework for lw enforcement is put in plce. We believe tht true indictor of success of Internet business in Singpore is the emergence of locl compnies to provide wide rnge of goods nd services to the locl consumers vi Internet. To crete locl virtul mrket plce, vibrnt with billions of buy-nd-sell trnsctions everydy, frmework nd tool such s AMIDAR re indispensble to provide confidence nd sense of security to the locl popultion. With AMIDAR deployed, the intrusion detection modules will estblish n uthenticted chnnel to communicte with the centrl controllers. Whenever intrusion ttempts re detected, the centrl controllers will be lerted. Depending on the types of intrusions, centrl controllers t the physicl neighbourhood police posts nd HQ s of the lw enforcement gency cn respond ccordingly. 6. Frmework of I3 The underlying principle behind I3 is risk reduction, risk elimintion, risk shring nd online frud prevention, detection nd response. As in ny trde, there will be government registrr to grnt license for setting up virtul shop on the locl Internet. Under the license, the virtul shop owner hs to set up the following bsic pckges: Web server tht provides merchndised informtion to the requests originted from the locl IP ddresses Security services to provide end-to-end secure session to trnsmit credit crd nd other personl informtion # Of course, locl supplier cn still estblish its own logiclly different connectivity to the overses business prtners, distributors, resellers nd customers. Only port 80 is open. # Mny web servers nd browsers hve this security feture. To mke it more secure, we will discuss simple mechnism (Internet Shopping Protocol) in Section 8. 6

7 Router tht filters IP pckets to llow only locl IP ddresses Intrusion monitor nd detection gents tht mke police report t regulr intervl to the centrl controllers (housed in the physicl confines of the lw enforcement gency) in rel-time. We hve discussed the link between intrusion detection nd Internet lw enforcement. Wht bout the role of insurnce coverge in this frmework? As credit crd informtion, personl nd finncil informtion of the consumers will reside in the computers of the Internet merchnts, the risk of losing the informtion to hckers hs to be ddressed. If cyberspce incident hs hppened, the Internet merchnt my be sued nd lible to py for the dmges climed by the customers. Therefore, it is wise nd in fct dvntgeous from the business viewpoint to tke up suitble insurnce policy. The objective is to shre nd mnge the risk with the insurnce compnies. In this proposed frmework, our opinion is tht insurnce coverge should be instituted, just like every irliner must insure itself ginst ir crshes. Although it increses the business cost somewht, there re cler dvntges to dopt this pproch. In Singpore, consumers will feel more confident to shop on the Internet when they know tht the virtul shops re officilly registered monitored by the uthorities in rel time responsible to py them for their losses (vi the insurnce mechnisms) should cyberspce incidents occurred. In essence, ll these mesure re imed t creting confidence in the consumers, nd thereby incresing the consumer bse. From the viewpoint of insurnce compny, it is foolhrdy to underwrite n insurnce policy without bsis to estimte the risk involved. It is lso possible tht the virtul shop is delibertely set on fire by the owner itself, so s to clim the insurnce money frudulently. To ddress the first problem, the insurnce compny cn buy consulting services from competent security firms to conduct computer nd network risk ssessment if the insurnce sum is lrge. If the mount is smll, softwre tool to check for systems configurtions my be sufficient to do the job. Whtever the cse, both risk ssessment nd utomted systems configurtion checking re mture technologies in the computer security ren. In the I3 frmework, the risk ssessment cn tke into considertion the types of intrusions tht AMIDAR cn detect nd hndle. So it is possible to estimte the risk involved. The insurnce premium, terms nd conditions cn then be determined ccordingly. For the second problem where n unscrupulous virtul shop owner is exploiting the insurnce policy, computer forensics is indispensble here. Agin, the Internet lw enforcement gency hs role to ply in this respect. In the proposed I3 frmework, it is possible to bse the evidence on the regulr police reports sent by the Intrusion monitor nd detection gents. In ddition, the legl frmework cn be set up such tht the insured sum is pid nd distributed to the customers rther thn to the virtul shop owners. This is becuse the consumers hve lost their crd numbers nd personl 7

8 informtion, nd therefore they re the ones tht ought to be compensted. With this proviso, it becomes much hrder for the unscrupulous virtul shop owners to succeed in the frud without collborting with the customers. 7. Firness in Addressing the Concerns In ny business ventures, the return of investment should be proportionl to the business risk. Since the consumers re pying money, the Internet business model should mke it risk-free for them. On the other hnd, since the suppliers re mking money by getting their return from investing in the virtul shops, they hve to be prepred to tke the risk. Among other things, the suppliers re exposed to the risk of hckers ttcking their virtul shops, nd lible to py the consumers for losing their credit crd nd personl informtion when brek-in occurs. In the previous sections, we hve ddressed these concerns with the loclized I3 model. To mke it ttrctive for the smll- nd medium-sized compnies to set up virtul shops, insurnce policies nd lw enforcement with AMIDAR s described before re necessry. With these three components, the risk is shred nd distributed to the insurnce compnies. Not only tht, they cn provide dded ssurnce nd confidence to the consumers who re buying from them. Therefore, suppliers concerns (S1 to S3) hve been ddressed. 8. Shopping Protocol in I3 To ddress the concern C1 nd concern C2 of the consumers further, we proposed shopping protocol under the I3 frmework. In this protocol, credit crd service providers hve role to ply s well. The credit crd service provider genertes tokens rndomly nd prcel out the tokens to their clients rndomly. The credit crd service provider sets up number of secure servers on the Internet to provide the checking nd verifiction services. Through the monthly sttement of ccount received by hrdcopy mil, the shopper obtins the tokens (sy one hundred tokens per month). Ech time when consumer pys n item with his credit crd, he sends one hlf of the token to the virtul shop (with his credit crd number) nd the other hlf to the credit crd service provider. The virtul shop sends tht hlf of the token he hs received from the consumer to the credit crd service provider. The credit crd service provider checks if the combined tokens it hs received is mong one in the prcel of the consumer. The credit crd service provider notifies both the supplier nd the consumer of the verifiction results. Ech token is vlid for one purchse only. To do nother purchse, the consumer hs to use different token in his prcel. 8

9 This is preliminry nd simplest version of the shopping protocol nd there re mny wys to improve it. The ide is to render it impossible for hckers who hve mnged to obtin the credit crd informtion to derive ny benefits. With this shopping protocol, on top of the credit crd informtion, the hckers hve to stel the tokens from the consumer s well. Even if the consumer is tricked into trnscting with spoofed virtul shop, the hcker hs to somehow intercept the other hlf of the token tht is sent to the credit crd service provider. This is by no mens esy over the Internet. In the cse of purchse tht involves delivery of goods, it is even impossible for the hcker to gin nything out of it, becuse by defult, the goods will be delivered to the residentil or office ddress of the consumer. If the consumer wishes to mke purchse nd hve the goods delivered not to him but to his loved ones s gifts, he cn register their ddresses with the credit crd service provider. So in ddition to checking the tokens, the credit crd service provider cn lso check the delivery ddress. If the ddress for the goods to be delivered to is not one of the registered, the credit crd service provider cn quickly deduce tht there is frud or nomly nd should contct the consumer immeditely for clrifiction. 9. Remrks The upshot of I3 frmework is tht it genertes two supporting industries: insurnce underwriting for Internet business, risk ssessment nd systems security evlution nd certifiction. For the I3 frmework to work, the relevnt government bodies, the lw enforcement gency, the IT security professionls nd vendors, the insurnce compnies s well s the credit crd service providers hve to tke prt nd ply their respective roles. We emphsize tht IT security technologies re vilble tody nd they cn only do tht much; the business, legl nd socil spects re more importnt nd complex. 10. Summry E-commerce nd more generlly Internet business hve yet to permete into the society. Consumers sty t the sideline, feeling insecure to send credit crd nd other personl informtion cross the Internet. Smll- nd medium-sized compnies lso find it not esy nd risky to open virtul shops nd counters. Given this stte of the ffirs, we propose I3 frmework nd its ssocited shopping protocol in the locl context of Singpore. The I3 refers to Intrusion Detection, Internet Lw Enforcement nd Insurnce Coverge. It encompsses technicl, legl nd finncil dimensions. We hve discussed Agent-bsed Monitoring, Intrusion Detection And Response (AMIDAR), which is useful for Internet lw enforcement nd insurnce underwriting. To provide consumers with n even higher level of ssurnce, the shopping protocol within the I3 frmework ws lso proposed. Of course, there is remote chnce tht the hcker is so lucky to guess the token right for the first time. But the odds cn be mde s smll s possible in designing the tokens. Filed ttempts to guess the token will be detected esily. 9

10 11. Acknowledgement We wish to cknowledge the support of the Directorte of Reserch nd Development, s well s the useful discussions with the collegues of Computer Systems Lb. 12. Bibliogrphy [1] Bill Hncock, Security Views, Computers & Security Vol. 17 (1998) [2] Next-genertion Intrusion Detection nd Response, DSO Technicl Report 10