Intrusion Detection and Intrusion Prevention. Ed Sale VP of Security Pivot Group, LLC

Transcription

1 Intrusion Detection and Intrusion Prevention Ed Sale VP of Security Pivot Group, LLC

2 Presentation Goals Describe IDS and IPS Why They Are Important Deployment and Use Major Players

3 The IT Security Camera Intrusion Detection Two types: Network (NIDS) and Host (HIDS) Looks at network traffic and host logs for signs of intrusion Alerts bring potential intrusions to the attention of administrators Data is useful in forensic investigations Issues include false positives and negatives, large amounts of data, requires full-time monitoring, signature updates, encrypted traffic

4 Passive Monitoring Not Inline IDS Deployment Network Tap Network Tap Proxy Server Mail Server DMZ WAN Router Network Tap DMZ IDS Sensor Inside IDS Sensor IDS Console Outside IDS Sensor Intranet

5 Types of Detection Rule-Based Detection Signatures produced for known attacks Traffic scanned for matches to signatures Anomaly Detection Baseline of normal traffic produced Deviations from baseline flagged as intrusions HIDS Detection Types Executable file checksums System call monitoring Log file monitoring

6 Types of Detection (cont d) Target-based Alerting (new) Combines knowledge of system vulnerabilities with type of incoming attack to reduce # of alerts Only alerts when attack has chance of success

7 IDS Management Reactive Response to Attack Centralized Monitoring and Management Critical for multi-sensor environments Tuning Required Constant Monitoring Large Data Store Backups Frequent Signature Updates (if rule-based) Software Upgrades

8 Intrusion Prevention The IT Security Guard Two types: Network (NIPS) and Host (HIPS) Looks at network traffic and host logs for signs of intrusion Automatically takes action to protect networks and systems from attack Helps reduce patch update urgency Issues include false positives and negatives, inline operation can create bottlenecks or single point of failure, signature updates, encrypted traffic

9 Inline Network Device(s) IPS Deployment Proxy Server Mail Server WAN Router Outside IPS DMZ IPS DMZ Inside IPS IPS Console Intranet

10 IPS Management Proactive Response to Attack Centralized Monitoring and Management Critical for multi-sensor environments Tuning Required Redundancy / Fail-open Required Constant Monitoring not Necessary Frequent Signature Updates (if rule-based) Software Upgrades

11 Common NIDS Pitfalls Deployed where it does not have access to all network traffic Output and/or alerts are ignored Inadequate incident response planning Administrators become overwhelmed by an un-tuned system Limitations of IDS/IPS are not well understood (updates, zero-day attacks, IDS blinding and evasion techniques)

12 Network Resets Types of Protection Passive monitors may not get connections reset before damage is done Not all attacks are connection based IP Address Blocking Passive monitors may not get address blocked before damage is done Address spoofing may cause DoS of legitimate user Packet Drop Decision has to be made real-time (0.5 usec for 1 GB link)

13 Product Selection What types of protection do I need? Zero-day attacks Network Segments to Monitor Bandwidth Tuning Flexibility How do I want to manage it? Few False Positives and False Negatives Constant Monitoring Reporting Capabilities Pivot Group Recommends Evaluation

14 IDS/IPS Solutions Host IDS/IPS: Cisco (Okena), Sana Security, Network Associates (Enterasys) Network IDS: Snort, Cisco, ISS, SecureWorks, Symantec, Lancope, Tenable, NetScreen, Computer Associates, NFR Security, McAfee, Sourcefire, Lucid Technologies Network IPS: Tipping Point, Captus, TopLayer, DeepNines, EcoNet.com, Lucid, StillSecure, Vsecure Technologies

15 IDS is evolving, not dead Final Words IDS/IPS required in some industries Network IDS data has forensic and other uses Correlation, Analysis, Alerting, Reporting IDS and IPS adds to defense in depth

16 More Information For additional references on IDS/IPS, see: