Network Intrusion Detection - PowerPoint PPT Presentation

1 / 26

About This Presentation

Title:

Network Intrusion Detection

Description:

The art and science of sensing when a system or network is being used ... Var RULE_PATH ./rules. Configure preprocessors. Portscan Detection. IP defragmentation ... – PowerPoint PPT presentation

Number of Views:29

Avg rating:3.0/5.0

Slides: 27

Provided by: Dep53

Category:

more less

Transcript and Presenter's Notes

Title: Network Intrusion Detection

1
Network Intrusion Detection

Bill Eaheart
Network Security Coordinator
DePaul University

2
What is Intrusion Detection?

The art and science of sensing when a system or
network is being used inappropriately or without
authorization. An intrusion-detection system
(IDS) monitors system and network resources and
activities and, using information gathered from
these sources, notifies the authorities when it
identifies a possible intrusion.

3
Why use Intrusion Detection?

Provides an extra layer of protection
Defense in Depth
Protect Data and Networks
Ensure system integrity
New vulnerabilities and exploits are found
regularly

4
What types of Intrusion Detection?

Host-Based Detection
Installed on a single Host
Checks for modified files
Log scanners
Swatch
Log Surfer
Log Sentry
Integrity Checkers
Tripwire
AIDE (Advanced Intrusion Detection Environment)
Fcheck
Network-Based Detection
Collect and analyze all traffic on a network
Rule Based analysis
Flags suspicious traffic

5
Advantages and Disadvantages

Yeah!
Relatively easy to deploy
statistics on probes and attacks
detection and watching capability for low to
moderately skilled intruders
Works out-of-the-box for well know
vulnerabilities
Snort has over 1900 signatures
Boo!
New vulnerabilities cannot be detected
False positives / negatives
Maintenance / Monitoring
Can be bypassed

6
How are intrusions detected?

Signature-based detection
Activity matches a predefined string
Effective against known attacks
Must be updated constantly
Anomaly-based detection
Identifies unusual traffic behavior (anomalies)
Some signature-based IDSes include limited
instances of anomaly detection, but few rely
solely on this technology.

7
What about Network Intrusion Prevention?

Inspect traffic directly
Detects, intercept and stop attacks before they
occur
Danger! Will Robinson Danger!
Could stop legitimate traffic
False Positives can cause headaches
Network latency
Single point of failure

8
Where do I put IDS systems on my network?

Network hosts
Network perimeter
Production Environments
LAN subnets

9
IDS Not the only part

First step system security
Policies and standards
Offers another layers of protection
Will not substitute for other elements of an
information security plan

10
QUIZ TIME

In computer security, this describes a
non-technical kind of intrusion that relies
heavily on human interaction. It often involves
tricking people into breaking their own security
procedures.
a. cyberterrorismb. debuggingc. hijackingd.
nonrepudiatione. social engineering
A properly configured firewall will provide
complete information security from external
attacks?
True or False?

11
Introduction to Snort

www.snort.org

12
What is Snort?

Network Intrusion Detection System
Developed by Marin Roesch in 1998
Current version snort 1.9.0

13
Why use it?

ITS FREE!!
GPL/Open Source Software
Other products avaialbe -
Dragon

14
What does it run on?

Linux
BSDs
Solaris
Win98/XP/NT/2000

15
How does it work?

Configuration File - /etc/snort.conf
Here you tell it which networks to protect.
What servers to ignore traffic from
What options you want loaded
Rules
How to log the alerts

16
/etc/snort.conf Setup

Set the network variables for your network
var HOME_NET 192.168.0.0/16
var EXTERNAL_NET !192.168.0.0/16
var DNS_SERVERS HOME_NET
Var RULE_PATH ./rules
Configure preprocessors
Portscan Detection
IP defragmentation
TCP stream assembly
Configure output plugins
Alert_syslog
Database
Customize your rule set
local.rules

17
Understanding Snort Rules

Simple Format
Each Rule has two parts
Rule Header
Rule options
Rule Header is required but rule options are not

18
Snort Rules cont.

Rule Header
Defines who is involved
Action alert, log, pass
Protocol tcp, udp, icmp, ip
Source and Destination IP addresses
Source and Destination IP ports
Direction of traffic
Alert tcp !10.1.1.0/24 any -gt 10.1.1.0/24
!21

19
Snort Rules cont.

Rule Options
Define what is involved
What packet attributes should be inspected
Syntax
(flagsSF msg SYN-FIN scan)
Options (not a complete list)
TCP flags IP TOS IP TTL
IP ID IP Protocol IP Options
ICMP Type Payload content

20
Examples of Rules

FTP rule
alert tcp EXTERNAL_NET any -gt HOME_NET 21
(msg"FTP EXPLOIT STAT dos attempt"
flowto_server,established content"STAT "
nocase content"" referencebugtraq,4482
classtypeattempted-dos sid1777 rev1)
DNS rule
alert udp EXTERNAL_NET 53 -gt HOME_NET any
(msg"DNS SPOOF query response PTR with TTL\ 1
min. and no authority" content"8580000100010000
0000" content"c00c000c00010000003c000f"
classtypebad-unknown sid253 rev2)

21
What do the logs look like?