DOCSLIB.ORG

Guide to Intrusion Detection and Prevention Systems (IDPS)

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Guide to Intrusion Detection and Prevention Systems (IDPS) Special Publication 800-94 Guide to Intrusion Detection and Prevention Systems (IDPS) Recommendations of the National Institute of Standards and Technology Karen Scarfone Peter Mell NIST Special Publication 800-94 Guide to Intrusion Detection and Prevention Systems (IDPS) Recommendations of the National Institute of Standards and Technology Karen Scarfone Peter Mell C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 February 2007 U.S. Department of Commerce Carlos M. Gutierrez, Secretary Technology Administration Robert C. Cresanti, Under Secretary of Commerce for Technology National Institute of Standards and Technology William Jeffrey, Director GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS) Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-94 Natl. Inst. Stand. Technol. Spec. Publ. 800-94, 127 pages (February 2007) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessa rily the best available for the purpose. iii GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS) Acknowledgements The authors, Karen Scarfone and Peter Mell of the National Institute of Standards and Technology (NIST), wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. The authors would like to acknowledge John Connor, Tim Grance, Anoop Singhal, and Murugiah Souppaya of NIST; Michael Gerdes, Ralph Martins, Angela Orebaugh, and Mike Zeberlein of Booz Allen Hamilton; and Steve Sharma of Project Performance Corporation for their keen and insightful assistance throughout the development of the document. The authors particularly want to thank Rebecca Bace of KSR for her careful review of the publication and for her work on the predecessor publication, NIST Special Publication 800-31, Intrusion Detection Systems. The authors would also like to express their thanks to security experts Andrew Balinsky (Cisco Systems), Anton Chuvakin (LogLogic), Jay Ennis (Network Chemistry), John Jerrim (Lancope), and Kerry Long (Center for Intrusion Monitoring and Protection, Army Research Laboratory), as well as representatives from the Department of State and Gartner, for their particularly valuable comments and suggestions. Additional acknowledgements will be added to the final version of the publication. Trademarks All product names are registered trademarks or trademarks of their respective companies. iv GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS) Table of Contents Executive Summary..............................................................................................................ES-1 1. Introduction ......................................................................................................................1-1 1.1 Authority...................................................................................................................1-1 1.2 Purpose and Scope .................................................................................................1-1 1.3 Audience ..................................................................................................................1-1 1.4 Document Structure .................................................................................................1-1 2. Intrusion Detection and Prevention Principles .............................................................2-1 2.1 Uses of IDPS Technologies .....................................................................................2-1 2.2 Key Functions of IDPS Technologies ......................................................................2-2 2.3 Common Detection Methodologies..........................................................................2-3 2.3.1 Signature-Based Detection...........................................................................2-4 2.3.2 Anomaly-Based Detection ............................................................................2-4 2.3.3 Stateful Protocol Analysis.............................................................................2-5 2.4 Types of IDPS Technologies ...................................................................................2-6 2.5 Summary..................................................................................................................2-7 3. IDPS Technologies...........................................................................................................3-1 3.1 Components and Architecture .................................................................................3-1 3.1.1 Typical Components.....................................................................................3-1 3.1.2 Network Architectures ..................................................................................3-1 3.2 Security Capabilities ................................................................................................3-2 3.2.1 Information Gathering Capabilities ...............................................................3-2 3.2.2 Logging Capabilities .....................................................................................3-2 3.2.3 Detection Capabilities...................................................................................3-3 3.2.4 Prevention Capabilities.................................................................................3-4 3.3 Management ............................................................................................................3-4 3.3.1 Implementation .............................................................................................3-4 3.3.2 Operation and Maintenance .........................................................................3-6 3.3.3 Building and Maintaining Skills .....................................................................3-9 3.4 Summary................................................................................................................3-10 4. Network-Based IDPS........................................................................................................4-1 4.1 Networking Overview ...............................................................................................4-1 4.1.1 Application Layer ..........................................................................................4-1 4.1.2 Transport Layer ............................................................................................4-2 4.1.3 Network Layer ..............................................................................................4-2 4.1.4 Hardware Layer ............................................................................................4-3 4.2 Components and Architecture .................................................................................4-3 4.2.1 Typical Components.....................................................................................4-3 4.2.2 Network Architectures and Sensor Locations...............................................4-4 4.3 Security Capabilities ................................................................................................4-7 4.3.1 Information Gathering Capabilities ...............................................................4-7 4.3.2 Logging Capabilities .....................................................................................4-8 4.3.3 Detection Capabilities...................................................................................4-9 4.3.4 Prevention Capabilities...............................................................................4-12 4.4 Management ..........................................................................................................4-13 v GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS) 4.4.1 Implementation ...........................................................................................4-14 4.4.2 Operation and Maintenance .......................................................................4-14 4.5 Summary................................................................................................................4-14 5. Wireless IDPS...................................................................................................................5-1 5.1 Wireless Networking Overview
Load more

Recommended publications
  • The 5 Things You Need to Do to Protect Yourself from Ransomware
    THE 5 THINGS YOU NEED TO DO TO PROTECT YOURSELF FROM RANSOMWARE ARE YOU RANSOMWARE-AWARE? In our recent survey* of more than RANSOMWARE is malware sent The 5 things you need to do to protect 3,000 people in the U.S. and Canada by criminals that encrypts your we learned that many are unaware of files and threatens to delete yourself from ransomware ransomware or how to defend against it. them if you don’t pay a ransom. By Stephen Cobb, ESET Senior Security Researcher ...said85% they would not pay the ransom fee and just risk losing their files, and Family photos and videos. Tax returns and other financial records. Business 15% said they would pay and take the chance that they may not even get documents. Think about everything that you keep on your computer. What their files back. would happen if it all was stolen from you? ...of42% people did not know if the internet That’s what a ransomware attack does. Criminals use this nasty breed security/antivirus they were using helped protect them from ransomware. of software to reach out over your internet connection and kidnap the contents of your computer, literally holding them for ransom. Ransomware silently encrypts all of your personal files, making them unreadable, and then demands that you send money to the criminal in order to restore them. ...of31% respondents NEVER backup their files. Those in the youngest age bracket (18-24) were the most likely age group to never back up files (35%). We surveyed over 3,000 people across the U.S.
    [Show full text]
  • Ransomware Facts and Tips
    RANSOMWARE FACTS & TIPS As technology evolves, the prevalence of ransomware attacks is growing among businesses and consumers alike. It’s important for digital citizens to be vigilant about basic digital hygiene in an increasingly connected world. WHAT IS RANSOMWARE? Ransomware is a type of malware that accesses a victim’s files, locks and encrypts them and then demands the victim to pay a ransom to get them back. Cybercriminals use these attacks to try to get users to click on attachments or links that appear legitimate but actually contain malicious code. Ransomware is like the “digital kidnapping” of valuable data – from personal photos and memories to client information, financial records and intellectual property. Any individual or organization could be a potential ransomware target. WHAT CAN YOU DO? We can all help protect ourselves – and our organizations – against ransomware and other malicious attacks by following these STOP. THINK. CONNECT. tips: • Keep all machines clean: Keep the software on all Internet-connected devices up to date. All critical software, including computer and mobile operating systems, security software and other frequently used programs and apps, should be running the most current versions. • Get two steps ahead: Turn on two-step authentication – also known as two-step verification or multi-factor authentication – on accounts where available. Two-factor authentication can use anything from a text message to your phone to a token to a biometric like your fingerprint to provide enhanced account security. • Back it up: Protect your valuable work, music, photos and other digital information by regularly making an electronic copy and storing it safely.
    [Show full text]
  • Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model
    S S symmetry Article Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model William Steingartner 1,* , Darko Galinec 2 and Andrija Kozina 3 1 Faculty of Electrical Engineering and Informatics, Technical University of Košice, Letná 9, 042 00 Košice, Slovakia 2 Department of Informatics and Computing, Zagreb University of Applied Sciences, Vrbik 8, 10000 Zagreb, Croatia; [email protected] 3 Dr. Franjo Tudman¯ Croatian Defence Academy, 256b Ilica Street, 10000 Zagreb, Croatia; [email protected] * Correspondence: [email protected] Abstract: This paper aims to explore the cyber-deception-based approach and to design a novel conceptual model of hybrid threats that includes deception methods. Security programs primarily focus on prevention-based strategies aimed at stopping attackers from getting into the network. These programs attempt to use hardened perimeters and endpoint defenses by recognizing and blocking malicious activities to detect and stop attackers before they can get in. Most organizations implement such a strategy by fortifying their networks with defense-in-depth through layered prevention controls. Detection controls are usually placed to augment prevention at the perimeter, and not as consistently deployed for in-network threat detection. This architecture leaves detection gaps that are difficult to fill with existing security controls not specifically designed for that role. Rather than using prevention alone, a strategy that attackers have consistently succeeded against, defenders Citation: Steingartner, W.; are adopting a more balanced strategy that includes detection and response. Most organizations Galinec, D.; Kozina, A. Threat Defense: Cyber Deception Approach deploy an intrusion detection system (IDS) or next-generation firewall that picks up known attacks and Education for Resilience in or attempts to pattern match for identification.
    [Show full text]
  • Internet Security
    Internet Security Thompson Davis & Co. (TD & Co.) is committed to protecting the security and confidentiality of customer information. We use a combination of state-of-the-art technology and methods to help to protect the security of your online information. • Internet Communication Security Measures - Any sensitive personal information that you send through TD & Co. is held in a secured environment, protected by tools such as firewalls and/or database field encryption. Please do not send any sensitive or personal information over email. TD & Co. will not electronically send any personal financial information to you unless you request us to do so. • Protect Yourself from Fraudulent Web Sites - Personal information shared over the Internet can be used to commit fraud. One common method is for thieves to create a web site using a name that is similar to that of a reputable business, for instance by using a common misspelling of the company's name. The intent is to lure you into clicking onto the copycat web site and giving your personal information, including your account number and password. We caution you to make sure of whom you are dealing with over the Internet and to understand what will be done with your information. Always check that you have typed the correct web site address before entering personal information onto a site. • Personal Computer Security – Regardless of the security measures TD & Co. takes to protect your online financial information, if the computer or network you are using to access this data is not secure, you run the risk of your financial information being compromised.
    [Show full text]
  • A Honeypot for Arbitrary Malware on USB Storage Devices
    A Honeypot for Arbitrary Malware on USB Storage Devices Sebastian Poeplau Jan Gassen University of Bonn Elmar Gerhards-Padilla Institute of Computer Science 4 Fraunhofer FKIE Friedrich-Ebert-Allee 144 Cyber Defense research group 53113 Bonn Friedrich-Ebert-Allee 144 53113 Bonn Abstract—Malware is a serious threat for modern information be infected usually by pretending to be vulnerable computers technology. It is therefore vital to be able to detect and analyze or services. Most commonly, honeypots are run on dedicated such malicious software in order to develop contermeasures. systems, i. e. machines that are maintained exclusively for the Honeypots are a tool supporting that task—they collect malware samples for analysis. Unfortunately, existing honeypots concen- purpose of capturing malware. Honeypots enable researchers trate on malware that spreads over networks, thus missing any and anti-virus companies to analyze new types of malware and malware that does not use a network for propagation. to develop countermeasures, and they are vital in generating A popular network-independent technique for malware to signatures of previously unknown malware. Even though there spread is copying itself to USB flash drives. In this article we are various different honeypot concepts, they all face one basic present Ghost, a new kind of honeypot for such USB malware. problem: How to trick malware into infecting a honeypot It detects malware by simulating a removable device in software, thereby tricking malware into copying itself to the virtual device. machine? We explain the concept in detail and evaluate it using samples Many of the employed concepts make use of the fact that of wide-spread malware.
    [Show full text]
  • Internet Security Threat Report Volume 24 | February 2019
    ISTRInternet Security Threat Report Volume 24 | February 2019 THE DOCUMENT IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENT. THE INFORMATION CONTAINED IN THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT NOTICE. INFORMATION OBTAINED FROM THIRD PARTY SOURCES IS BELIEVED TO BE RELIABLE, BUT IS IN NO WAY GUARANTEED. SECURITY PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT (“CONTROLLED ITEMS”) ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER FOR YOU TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT SUCH CONTROLLED ITEMS. TABLE OF CONTENTS 1 2 3 BIG NUMBERS YEAR-IN-REVIEW FACTS AND FIGURES METHODOLOGY Formjacking Messaging Cryptojacking Malware Ransomware Mobile Living off the land Web attacks and supply chain attacks Targeted attacks Targeted attacks IoT Cloud Underground economy IoT Election interference MALICIOUS
    [Show full text]
  • The Order of Encryption and Authentication for Protecting Communications (Or: How Secure Is SSL?)?
    The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)? Hugo Krawczyk?? Abstract. We study the question of how to generically compose sym- metric encryption and authentication when building \secure channels" for the protection of communications over insecure networks. We show that any secure channels protocol designed to work with any combina- tion of secure encryption (against chosen plaintext attacks) and secure MAC must use the encrypt-then-authenticate method. We demonstrate this by showing that the other common methods of composing encryp- tion and authentication, including the authenticate-then-encrypt method used in SSL, are not generically secure. We show an example of an en- cryption function that provides (Shannon's) perfect secrecy but when combined with any MAC function under the authenticate-then-encrypt method yields a totally insecure protocol (for example, ¯nding passwords or credit card numbers transmitted under the protection of such protocol becomes an easy task for an active attacker). The same applies to the encrypt-and-authenticate method used in SSH. On the positive side we show that the authenticate-then-encrypt method is secure if the encryption method in use is either CBC mode (with an underlying secure block cipher) or a stream cipher (that xor the data with a random or pseudorandom pad). Thus, while we show the generic security of SSL to be broken, the current practical implementations of the protocol that use the above modes of encryption are safe. 1 Introduction The most widespread application of cryptography in the Internet these days is for implementing a secure channel between two end points and then exchanging information over that channel.
    [Show full text]
  • Trend Micro Incorporated Research Paper 2012
    Trend Micro Incorporated Research Paper 2012 Detecting APT Activity with Network Traffic Analysis Nart Villeneuve and James Bennett Contents About This Paper .................................................................................................................................. 1 Introduction ........................................................................................................................................... 1 Detecting Remote Access Trojans ................................................................................................... 3 GhostNet......................................................................................................................................... 3 Nitro and RSA Breach .................................................................................................................4 Detecting Ongoing Campaigns .........................................................................................................5 Taidoor ............................................................................................................................................5 IXESHE ............................................................................................................................................5 Enfal aka Lurid ..............................................................................................................................6 Sykipot ...........................................................................................................................................
    [Show full text]
  • An API Honeypot for Ddos and XSS Analysis
    An API Honeypot for DDoS and XSS Analysis G Leaden, Marcus Zimmermann, Casimer DeCusatis, Fellow, IEEE, and Alan G. Labouseur Marist College School of Computer Science and Mathematics Poughkeepsie, NY 12601 fG.Leaden1, Marcus.Zimmermann1, Casimer.DeCusatis, [email protected] Abstract—Honeypots are servers or systems built to mimic II. BACKGROUND critical parts of a network, distracting attackers while logging their information to develop attack profiles. This paper discusses Not long after making G-Star Studio available online, we the design and implementation of a honeypot disguised as a REp- observed a number of unauthorized connection attempts to resentational State Transfer (REST) Application Programming its Application Programming Interface (API). These attacks Interface (API). We discuss the motivation for this work, design specifically targeted G-star Studio’s REpresentational State features of the honeypot, and experimental performance results Transfer (REST) API. under various traffic conditions. We also present analyses of both a distributed denial of service (DDoS) attack and a cross-site A REST API is among the most commonly used API scripting (XSS) malware insertion attempt against this honeypot. architectures today [6]. There are many examples of recent attacks against REST APIs, including well-publicized attacks on the Nissan Leaf smart car [7] and the U.S. Internal Revenue Service database. Existing APIs do not always follow security I. INTRODUCTION best practices, and developers might be lulled into a false sense of security by believing that their API will not be an attack The number and severity of cyber attacks has grown signif- target. In an effort to improve the security of our SecureCloud icantly in recent years [1], [2].
    [Show full text]
  • Security, Encryption, and Certificates FAQ
    Security, Encryption, and Certificates FAQ Overview In Security Center 5.4, several new capabilities will be added that further strengthen the security of the platform itself, as well as the privacy of data. The aim is to prevent unauthorized access to stored and transmitted messages and data, as well as prevent attacks through the use of stronger encryption and authentication mechanisms. With growing demand for privacy, new capabilities in Security Center 5.4 will strengthen Genetec’s position and overall value proposition. This FAQ addresses some of the most common questions in relation to the new capabilities of Security Center: Encryption, Authentication, and Digital Certificates. These concepts are first described in generic terms; the FAQ then outlines how these new measures are used within Security Center 5.4. Encryption vs. Authentication vs. Authorization What is the difference between encryption, authentication, and authorization? Encryption is used to encrypt data so that only authorized users can see it. Authentication determines whether an entity is who they claim to be, eg. in the case of an individual, it is usually based on a username/password combination. Authentication does not actually say anything about what someone is authorized to do or has the right to do. o Client-side authentication uses username/password combinations, tokens (dual authentication), and other techniques. o Server-side authentication uses certificates to identify trusted third parties. Authorization is the function of specifying the rights, eg. defining the access rights someone has over a set of recourses such as a private data, computing resources, or an application. When users log into a Security Center system, what they are allowed or authorized to do depends on the set of privileges assigned to them by administrators.
    [Show full text]
  • Introducing Traffic Analysis
    Introducing Traffic Analysis George Danezis and Richard Clayton January 26, 2007 1 Introduction In the Second World War, traffic analysis was used by the British at Bletchley Park to assess the size of Germany's air-force, and Japanese traffic analysis countermeasures contributed to the surprise of their 1941 attack on Pearl Harbour. Nowadays, Google uses the incidence of links to assess the relative importance of web pages, credit card companies examine transactions to spot fraudulent patterns of spending, and amateur plane-spotters revealed the CIA's `extraordinary rendition' programme. Diffie and Landau, in their book on wiretapping, went so far as to say that “traffic analysis, not cryptanalysis, is the backbone of communications intelligence" [1]. However, until recently the topic has been neglected by Computer Science academics. A rich literature discusses how to secure the confidentiality, integrity and availability of communication content, but very little work has considered the information leaked from communications ‘traffic data' and how these compromises might be minimised. Traffic data records the time and duration of a communication, and traffic analysis examines this data to determine the detailed shape of the communication streams, the identities of the parties communicating, and what can be established about their locations. The data may even be sketchy or incomplete { simply knowing what `typical' communication patterns look like can be used to infer information about a particular observed communication. Civilian infrastructures, on which state and economic actors are increasingly reliant, are ever more vulnerable to traffic analysis: wireless and GSM telephony are replacing traditional systems, routing is transparent and protocols are overlaid over others { giving plenty of opportunity to observe, and take advantage of the traffic data.
    [Show full text]
  • Biometrics Authentication Technique for Intrusion Detection Systems Using Fingerprint Recognition
    International Journal of Computer Science, Engineering and Information Technology (IJCSEIT), Vol.2, No.1, February 2012 BIOMETRICS AUTHENTICATION TECHNIQUE FOR INTRUSION DETECTION SYSTEMS USING FINGERPRINT RECOGNITION 1 2 3 Smita S. Mudholkar , Pradnya M. Shende , Milind V. Sarode 1, 2& 3 Department of Computer Science & Engineering, Amravati University, India [email protected], [email protected], [email protected] ABSTRACT Identifying attackers is a major apprehension to both organizations and governments. Recently, the most used applications for prevention or detection of attacks are intrusion detection systems. Biometrics technology is simply the measurement and use of the unique characteristics of living humans to distinguish them from one another and it is more useful as compare to passwords and tokens as they can be lost or stolen so we have choose the technique biometric authentication. The biometric authentication provides the ability to require more instances of authentication in such a quick and easy manner that users are not bothered by the additional requirements. In this paper, we have given a brief introduction about biometrics. Then we have given the information regarding the intrusion detection system and finally we have proposed a method which is based on fingerprint recognition which would allow us to detect more efficiently any abuse of the computer system that is running. KEYWORDS Intrusion detection, keystroke, Biometrics, Mouse dynamics, Authentication 1. INTRODUCTION Biometric recognition forms a strong bond between a person and his identity as biometric traits cannot be easily shared, lost, or duplicated. Hence, biometric recognition is fundamentally superior and more resistant to social engineering attacks than the two conservative methods of recognition, namely, passwords and tokens.
    [Show full text]