DOCSLIB.ORG

Webové Rozhraní IDS Systému Snort Snort IDS Web Interface

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Webové Rozhraní IDS Systému Snort Snort IDS Web Interface VŠB – Technická univerzita Ostrava Fakulta elektrotechniky a informatiky Katedra informatiky Webové rozhraní IDS systému Snort Snort IDS Web Interface 2019 Dominik Raška Na tomto místˇebych rád podˇekoval hlavnˇeMgr. Ing. Michalu Krumniklovi, Ph.D. za jeho rady a pˇri- pomínky, které mi pomohly pˇritéto práci, a ještˇepom˚užou pˇripracích budoucích. Abstrakt Úˇcelem této práce je vytvoˇritnástavbu aplikace Snort umožˇnující pˇrehlednouanalýzu log˚uprostˇred- nictvím webového rozhraní, které bude schopné provozu i na routerech s relativnˇemalým výkonem. V úvodu práce je ˇctenáˇrseznámen s nejznámˇejšími systémy pro odhalení pr˚uniku, jejich funkcemi a konfigurací. Následuje porovnání již existujících rozhraní pro systém Snort a návrh vlastní imple- mentace webové rozhraní. Vlastní implementace je potom ˇrádnˇezdokumentovaná a otestovaná na více zaˇrízeních. Klíˇcová slova: IDS, Snort rozhraní, webové rozhraní, sít’ové zabezpeˇcení Abstract This thesis objective was to implement a Snort extension allowing for convenient analysis of Snort alerts through a web interface. At first, reader is being presented with the theory of intrusion detec- tion systems, how they work and what are some commonly used alternatives. After that, the existing Snort interfaces are being compared while proposing the vision for my own implementation. My application is then thorougly documented and deployed in a couple of testing enviroments. Key Words: IDS, Snort interface, web interface, network security Obsah Seznam použitých zkratek a symbol˚u 9 Seznam obrázk˚u 10 Seznam tabulek 11 Seznam výpis˚uzdrojového kódu 12 1 Úvod 13 2 Co je to intrusion detection system? 14 2.1 NIDS ................................................. 14 2.2 HIDS ................................................. 14 2.3 Intrusion prevention system . 15 2.4 IDS Snort . 15 2.5 IDS Suricata . 21 2.6 Zeek.................................................. 22 3 Rešerše webových a grafických rozhraní pro IDS Snort 23 3.1 SnortAlog............................................... 23 3.2 BASE ................................................. 23 3.3 Snorby ................................................ 24 3.4 Sguil.................................................. 25 3.5 Shrnutí ................................................ 27 4 Vlastní implementace webového rozhraní - Snort.NET 30 4.1 Návrh................................................. 30 4.2 Datová vrstva . 31 4.3 Aplikaˇcní vrstva . 32 4.4 Architektura systému . 33 4.5 Testování a hardwarové požadavky . 35 4.6 Instalace . 35 5 Srovnání 38 5.1 Úvodní stránka . 38 5.2 Detail útoku . 39 5.3 Graf rozdˇelení použitých protokol˚u . 39 5.4 Mapa distribuce p˚uvodu útok˚u. 40 6 Závˇer 42 7 Literatura 43 Pˇrílohy 44 A Návod k instalaci Snort.NET pro Debian 9.8 45 A.1 Instalace Snortu ze zdroje . 45 A.2 Instalace programu Barnyard2 a MySQL . 46 A.3 Instalace webového rozhraní Snort.NET . 48 B Úvodní stránka Snort.NET 49 8 Seznam použitých zkratek a symbol˚u AJAX – Asynchronous JavaScript and XML API – Application Programming Interface ARP – Address Resolution Protocol ASCII – American Standard Code For Information Interchange BSD – Berkeley Software Distribution CPU – Central Processing Unit CSV – Comma Separated Values CUDA – Compute Unified Device Architectur DDoS – Distributed Denial Of Service DNS – Domain Name System GUI – Graphical User Interface HTML – Hypertext Markup Language HTTP – HyperText Transfer Protocol ICMP – Internet Control Message Protocol IDS – Intrusion Detection System IP – Internet Protocol IPS – Intrusion Prevention System JIT – Just In Time JSON – JavaScript Object Notation MD5 – Message-Digest Algorithm 5 OS – Operating System PDF – Portable Document Format PHP – Hypertext Preprocessor RAM – Random Access Memory SANCP – Security Analyst Network Connection Profiler SCD – Self-contained Deployment SMTP – Simple Mail Transfer Protocol SQL – Structured Query Language SSH – Secure Shell SVG – Scalable Vector Graphics TCL – Tool Command Language TCP – Transmission Control Protocol UDP – User Datagram Protocol VM – Virtual Machine XML – Extensible Markup Language 9 Seznam obrázk˚u 1 Postup zpracování dat Snortem v režimu NIDS . 17 2 BASE interface . 24 3 Snorby interface . 25 4 Sguil: 3-vrstvá architektura . 26 5 Entitnˇevztahový model datové domény . 32 6 Sekvenˇcní diagram požadavku na stránku zobrazující geografická data . 34 7 Diagram nasazení a vztah˚ujednotlivých komponent systému . 34 8 Graf rozdˇelení použitých protokol˚u . 40 9 Mapa distribuce p˚uvodu útok˚u. 41 10 Snímek úvodní stránky Snort.NET – 1. ˇcást . 49 11 Snímek úvodní stránky Snort.NET – 2. ˇcást . 50 10 Seznam tabulek 1 Pˇrehledrozhraní pro IDS Snort a jejich funkcí . 29 2 Doba zpracování dotazu v závislosti na systému a poˇctu databázových záznam˚u . 36 3 Doporuˇcené systémové požadavky . 36 11 Seznam výpis˚uzdrojového kódu 1 Pˇríkazy ke spuštˇení Snortu . 17 2 Pˇríklad pravidla pro IDS Snort . 21 3 Pˇríklad pravidla pro IDS Suricata . 22 4 Pˇríklad pravidla pro IDS Suricata demonstrující detekci protokol˚uaplikaˇcní vrstvy . 22 5 Pˇríklad pravidla pro IDS Suricata demonstrující využití buffer˚uaplikaˇcní vrstvy . 22 12 1 Úvod Obor poˇcítaˇcové bezpeˇcnosti pˇrišel paralelnˇese vznikem informaˇcních technologií. Základní model informaˇcní bezpeˇcnosti zmiˇnuje tˇri funkce k zajištˇeníochrany informací – d˚uvˇeryhodnost, integrita a dostupnost. Po dlouhou dobu byla tato bezpeˇcnost ˇcasto pˇrehlížena, rizika byla nízká a v tom smyslu bylo uˇcinˇeno mnoho bezpeˇcnostních kompromis˚u. S nástupem internetu na pˇrelomu tisíciletí se ale radikálnˇezmˇenila situace. Náš svˇetje dnes propojen jako nikdy dˇríve. Máme instantní pˇrístupk informacím a poˇcetuživatel˚ua chytrých za- ˇrízení, které komunikují prostˇrednictvím poˇcítaˇcových sítí, se stále zvyšuje [1]. Stejnˇetak se ale zvy- šují finanˇcní škody zp˚usobené r˚uznými sít’ovými útoky, které poškozují pilíˇre informaˇcní bezpeˇcnosti (DDoS, phishing, malware atd.). Poˇcítaˇcová bezpeˇcnost a speciálnˇeoblast sít’ového zabezpeˇceníse tak stává velkou výzvou moderní doby. Jak prohlásil odborník na poˇcítaˇcovou bezpeˇcnost Bruce Schneier: „You can’t defend. You can’t prevent. The only thing you can do is detect and respond.“ Velké ˇcásti slabin v systému zneužitelných k útoku, jinak ˇreˇceno zranitelností, se nedá úplnˇepˇred- cházet. Castoˇ m˚uže dojít k pochybení uživatele vlivem sociálního inženýrství, špatné konfiguraci soft- waru apod. Nˇekterétypy útok˚uzase vyžadují jejich detekci v reálném ˇcase a rychlou reakci, aby nedo- šlo k narušení systému (útoky typu DDoS, útoky hrubou silou). Složitost v této oblasti a neustálý vývoj nových technologií sebou pˇrináší také nové zranitelnosti, které se dají jen tˇežko pˇredpovídat pˇredem. Efektivním zp˚usobem,jak bojovat s podobnými útoky je použitím systém˚upro odhalení pr˚uniku, zkrácenˇeIDS (Intrusion detection system). Pˇrestože takový program má své nástroje k odhalování hrozeb, vyžaduje také pr˚ubˇežné intervence ze strany administrátora. V tempu, v jakém se objevují nové útoky, vzniká potˇrebaje postupnˇepˇridávat do zvoleného IDS. Zároveˇnne každá hrozba, kterou IDS identifikuje, je nutnˇehrozbou. Proto je dobré systém vyladit a podle svých potˇrebminimalizovat poˇcet falešnˇepozitivních útok˚ua nastavit akci proti skuteˇcným útok˚um.Takový proces ˇcasto vyža- duje hloubkovou analýzu vzniklého incidentu. Mým úkolem je implementovat webové rozhraní jako nástavbu IDS Snort, která bude sloužit k této analýze potenciálních útok˚uadministrátorem. V následující kapitole rozeberu obecné funkce a ˇcásti IDS. Rozdˇelím je podle oblasti, kterou moni- torují a podle zp˚usobu jakým detekují útoky. V druhé ˇcásti kapitoly se budu vˇenovat konkrétním im- plementacím IDS, zejména potom IDS Snort, který je stˇežejní pro tuto práci. Dále, v kapitole 3 popíšu významné volnˇedostupné rozhraní pro IDS Snort, pˇredstavím jejich architekturu a specifické vlast- nosti. Aplikace mezi sebou porovnám, identifikuji nˇekteré jejich nedostatky a pˇredstavím vizi vlastní implementace webového rozhraní. Kapitola 4 dokumentuje vlastní implementaci rozhraní Snort.NET od jejího návrhu až po testování. Nakonec provedu srovnání funkˇcních požadavk˚usvé implementace s ostatními na jejich pˇríkladném praktickém využití sít’ovým analytikem. 13 2 Co je to intrusion detection system? Jako IDS m˚užeme oznaˇcitzaˇrízení nebo software, který má za úkol odhalit sít’ové ˇci systémové akti- vity, které pˇredstavují možné napadení hostitelské sítˇeˇci systému, nebo akce, které takovému napa- dení pˇredcházejí. Hlavním prvkem softwarových ˇrešení,které lze oznaˇcitjako IDS, je senzor. Jde o pasivní souˇcást obsahující mechanismy pro detekci podezˇrelých aktivit na základˇedat poskytnutých hostitelským systémem. V závislosti na topologii sítˇese urˇcuje umístˇení pˇrípadnˇepoˇcetpotˇrebných senzor˚una ochranu sítˇeproti externím, v nˇekterých pˇrípadech i interním hrozbám. Typickým ˇrešenímje umístit senzory za každý router, který je na rozhraní chránˇenésítˇes ned˚uvˇeryhodnou externí sítí [2]. IDS systémy lze dále rozdˇelit podle metody detekce událostí narušující bezpeˇcnost na dva hlavní typy: 1. Podle signatury – Souˇcástí systému je množina pravidel, jenž pˇredstavuje vzory známých útok˚u. Pozorovaná data jsou porovnávána s tˇemitovzory. Takovým zp˚usobem lze dobˇreurˇcit,o jaký typ útok˚use jedná. Efektivita odhalení útok˚uspoˇcívá ve spektru použitých pravidel a jejich aktuálnosti. Riziko pˇredstavují tzv. zero-day exploity (bezpeˇcností hrozby, které zatím nejsou obecnˇeznámé).
Load more

Recommended publications
  • Implementing Cisco Cyber Security Operations
    2019 CLUS Implementing Cisco Cyber Security Operations Paul Ostrowski / Patrick Lao / James Risler Cisco Security Content Development Engineers LTRCRT-2222 2019 CLUS Cisco Webex Teams Questions? Use Cisco Webex Teams to chat with the speaker after the session How 1 Find this session in the Cisco Live Mobile App 2 Click “Join the Discussion” 3 Install Webex Teams or go directly to the team space 4 Enter messages/questions in the team space Webex Teams will be moderated cs.co/ciscolivebot#LTRCRT-2222 by the speaker until June 16, 2019. 2019 CLUS © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 3 Agenda • Goals and Objectives • Prerequisite Knowledge & Skills (PKS) • Introduction to Security Onion • SECOPS Labs and Topologies • Access SECFND / SECOPS eLearning Lab Training Environment • Lab Evaluation • Cisco Cybersecurity Certification and Education Offerings 2019 CLUS LTRCRT-2222 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 4 Goals and Objectives: • Today's organizations are challenged with rapidly detecting cybersecurity breaches in order to effectively respond to security incidents. Cybersecurity provides the critical foundation organizations require to protect themselves, enable trust, move faster, add greater value and grow. • Teams of cybersecurity analysts within Security Operations Centers (SOC) keep a vigilant eye on network security monitoring systems designed to protect their organizations by detecting and responding to cybersecurity threats. • The goal of Cisco’s CCNA Cyber OPS (SECFND / SECOPS) courses is to teach the fundamental skills required to begin a career working as an associate/entry-level cybersecurity analyst within a threat centric security operations center. • This session will provide the student with an understanding of Security Onion as an open source network security monitoring tool (NSM).
    [Show full text]
  • Securing Infrastructure-As-A-Service Public Clouds Using Security Onion
    Securing Infrastructure-as-a-Service Public Clouds Using Security Onion MIKAIL, Abdullahi and PRANGGONO, Bernardi <http://orcid.org/0000-0002- 2992-697X> Available from Sheffield Hallam University Research Archive (SHURA) at: http://shura.shu.ac.uk/23927/ This document is the author deposited version. You are advised to consult the publisher's version if you wish to cite from it. Published version MIKAIL, Abdullahi and PRANGGONO, Bernardi (2019). Securing Infrastructure-as-a- Service Public Clouds Using Security Onion. Applied System Innovation, 2 (1). Copyright and re-use policy See http://shura.shu.ac.uk/information.html Sheffield Hallam University Research Archive http://shura.shu.ac.uk Article Securing Infrastructure-as-a-Service Public Clouds Using Security Onion Abdullahi Mikail and Bernardi Pranggono * Department of Engineering and Mathematics, Sheffield Hallam University, Howard Street, Sheffield S1 1WB, UK; [email protected] * Correspondence: [email protected] Received: 17 December 2018; Accepted: 23 January 2019; Published: 30 January 2019 Abstract: The shift to Cloud computing has brought with it its specific security challenges concerning the loss of control, trust and multi-tenancy especially in Infrastructure-as-a-Service (IaaS) Cloud model. This article focuses on the design and development of an intrusion detection system (IDS) that can handle security challenges in IaaS Cloud model using an open source IDS. We have implemented a proof-of-concept prototype on the most deployed hypervisor—VMware ESXi—and performed various real-world cyber-attacks, such as port scanning and denial of service (DoS) attacks to validate the practicality and effectiveness of our proposed IDS architecture.
    [Show full text]
  • Evaluating the Availability of Forensic Evidence from Three Idss: Tool Ability
    Evaluating the Availability of Forensic Evidence from Three IDSs: Tool Ability EMAD ABDULLAH ALSAIARI A thesis submitted to the Faculty of Design and Creative Technologies Auckland University of Technology in partial fulfilment of the requirements for the degree of Masters of Forensic Information Technology School of Engineering, Computer and Mathematical Sciences Auckland, New Zealand 2016 i Declaration I hereby declare that this submission is my own work and that, to the best of my knowledge and belief, it contains no material previously published or written by another person nor material which to a substantial extent has been accepted for the qualification of any other degree or diploma of a University or other institution of higher learning, except where due acknowledgement is made in the acknowledgements. Emad Abdullah Alsaiari ii Acknowledgement At the beginning and foremost, the researcher would like to thank almighty Allah. Additionally, I would like to thank everyone who helped me to conduct this thesis starting from my family, supervisor, all relatives and friends. I would also like to express my thorough appreciation to all the members of Saudi Culture Mission for facilitating the process of studying in a foreign country. I would also like to express my thorough appreciation to all the staff of Saudi Culture Mission for facilitating the process of studying in Auckland University of Technology. Especially, the pervious head principal of the Saudi Culture Mission Dr. Satam Al- Otaibi for all his motivation, advice and support to students from Saudi in New Zealand as well as Saudi Arabia Cultural Attaché Dr. Saud Theyab the head principal of the Saudi Culture Mission.
    [Show full text]
  • Part Iii Network Security Monitoring Processes
    Bejtlich_book.fm Page 345 Thursday, June 17, 2004 8:40 AM PART III NETWORK SECURITY MONITORING PROCESSES 345 Bejtlich_book.fm Page 346 Thursday, June 17, 2004 8:40 AM Bejtlich_book.fm Page 347 Thursday, June 17, 2004 8:40 AM Best11 Practices In Parts I and II we explored NSM theory and some tools for conducting NSM. Part III is intended for people who manage NSM operations. It presents best practices for assess- ment, protection, detection, and response, as far as NSM is concerned. While elements of NSM best practices appear throughout the book, this chapter focuses exclusively on the mind-set needed to conduct NSM operations. Chapter 12 brings these principles to life in several case studies. Chapter 1 introduced the security process in general. In this chapter, I explain the NSM-specific aspects of each security process step (see Figure 11.1). First, I describe the benefits of developing a well-defined security policy during assessment. Then I explain protection with respect to access control, traffic scrubbing, and proxies. Next, detection is expanded to include collection, identification, validation, and escalation of suspicious events. I elaborate on response within the context of short-term incident containment and emergency NSM. Finally, I conclude by returning to the assessment phase by high- lighting analyst feedback as a component of planning for the next cycle. ASSESSMENT Assessment involves taking steps to ensure the probability of successfully defending an enterprise. Within the NSM model, assessment means implementing products, people, and processes most conducive to accurately identifying and mitigating intrusions. Part II illustrated NSM tools, and Part IV will offer suggestions for training people.
    [Show full text]
  • Intrusion Detection System and Intrusion Prevention System with Snort Provided by Security Onion
    Bezborodov Sergey Intrusion Detection System and Intrusion Prevention System with Snort provided by Security Onion. Bachelor’s Thesis Information Technology May 2016 DESCRIPTION Date of the bachelor's thesis 06.05.2016 Author(s) Degree programme and option Bezborodov Sergey Information Technology Name of the bachelor's thesis Intrusion Detection Systems and Intrusion Prevention System with Snort provided by Security Onion. Abstract In this thesis I wanted to get familiar with Snort IDS/IPS. I used the Security Onion distribution with a lot of security tools, but I concentrated on Snort. Also I needed to evaluate Security Onion environment and check what features it provides for processing with Snort. During the work I needed to figure out the pros and cons of using Security Onion with Snort as a security system for network. I compared it with alternatives and briefly describe it. As result I installed Security Onion, work with the environment, configured different features, created and modified rules and so on. I think this thesis will be helpful for people who want to use IDS/IPS for their network, it should help them to choose IDS/IPS vendor, make Security Onion and Snort installation, make comparison with another one and just get familiar with the network security tools. Also, this thesis can be a part of big research of network security tools, because now is impossible to find such detailed guides and literatures about any IDS/IPS tools. It is a good idea to combine many researches about it and make a good library. This thesis can be used for further development of Snort and Security Onion as it only on the development phase now, it will provide base for new researching with new versions.
    [Show full text]
  • Analyzing Offensive and Defensive Networking Tools in a Laboratory Environment
    NIKO HEIKURA ANALYZING OFFENSIVE AND DEFENSIVE NETWORKING TOOLS IN A LABORATORY ENVIRONMENT Master of Science thesis Examiners: prof. Jarmo Harju and M.Sc. Markku Vajaranta Examiners and topic approved by the Faculty Council of the Faculty of Computing and Electrical Engineer- ing on 8th October 2014 i ABSTRACT NIKO HEIKURA : Analyzing Offensive and Defensive Networking Tools in a La- boratory Environment Tampere University of Technology Master of Science Thesis, 93 pages March 2015 Master’s Degree Programme in Signal Processing and Communications Engi- neering Major: Communications Networks and Protocols Examiners: Professor Jarmo Harju and M.Sc. Markku Vajaranta Keywords: denial of service, network security, network security monitoring, ex- ploits, vulnerabilities The safest way of conducting network security testing is to do it in a closed laboratory environment that is isolated from the production network, and whose network configu- ration can be easily modified according to needs. Such an environment was built to the Department of Pervasive Computing in the fall of 2014 as part of TUTCyberLabs. In addition to the networking hardware, computers and servers, two purchases were made: Ruge, a traffic generator, and Clarified Analyzer, a network security monitor. Open source alternatives were researched for comparison and the chosen tools were Ostinato and Security Onion respectively. A hacking lab exercise was created for Computer Network and Security course employing various tools found in Kali Linux that was in- stalled on the computers. Different attack scenarios were designed for the traffic genera- tors and Kali Linux, and they were then monitored on the network security monitors. Finally a comparison was made between the monitoring applications.
    [Show full text]
  • Logging and Monitoring at Home Who Am I
    Defending the Homeland Logging and Monitoring at home Who am I @nullthreat Offensive Red Team for a major company I break stuff Started security @ CNDSP ADT for networks @ DOD Designed and Deployed NSM on DOD net Talking Points Perimeter Firewall Central Logging Host IDS Network IDS Basic Honeypots Deployment Strategies Disclaimer: The ideas and solutions presented are my opinion, feel free to disagree. OS'es I use all Linux and Macs at home I will not be talking about Windows at all, deal with it Won't matter once we are talking NIDS Firewalls on the Cheap As I see it there is only one good solution in this space PFSense http://www.pfsense.org ● Fork of MonoWall ● Robust Firewall based on PF(FreeBSD) ● Multiple VPN Support built-in ○ OpenVPN, IPSec, L2TP, PPTP ● Package based add-ons ○ pfBlocker(block netblocks), Snort, Squid ● Runs on almost anything, Full PC or Embedded Embedded Solutions ALIX 2D3/2D13 ~ 200$ @ store.netgate.com PFsense on Alix Setup Pauldotcom.com tech segement from episode 220 Google "alix pfsense pauldotcom" and you'll find the show notes Spark notes: Download IMG, Write to CF Card, Boot, Use Serial Terminal to do initial setup PFSense on Alix Setup Pro Tip: Don't put the box together until you flash the OS onto the card, You have to take the entire box apart to get the CF Card in and out. PFSense Demo Other Options Surplus Cisco/Juniper/Checkpoint Hardware Consumer Firewall Solutions http://en.wikipedia. org/wiki/List_of_router_or_firewall_distributions Firewalls Questions? Central Logging I do this on my servers and VPSs Could do on clients but....meh Usually the same box that hosts my NIDS stuff Lots of options syslogd Ol' reliable Been around since the dawn of freaking time originally part of sendmail circa 1980s UDP Only(in most cases) Easy-ish to configure but hard to really dial in syslogd Server: set -r flag in /etc/sysconfig/syslog ex.
    [Show full text]
  • Open Source Network Security Monitoring with Sguil
    Open Source Network Security Monitoring With Sguil David J. Bianco Cybersecurity Analyst Jeferson Lab [email protected] Thomas Jefferson National Accelerator Facility Cyber Security Review, April 23-24, 2002, Operated by Jefferson Science Associates, LLC. for the U.S. Depart. Of Energy 1 Table of Contents • Intro to Network Security Monitoring (NSM) • NSM with Sguil • Sguil architecture • Working with Sguil • Sguil in action • Try it yourself! • Summary • More Information • Questions Thomas Jefferson National Accelerator Facility Cyber Security Review, April 23-24, 2002, Operated by Jefferson Science Associates, LLC. for the U.S. Depart. Of Energy 2 Network Monitoring • Most mid/large-sized organizations perform network monitoring • Intrusion Detection Systems (IDS) • Syslogs/Event Logs • NetFlow/SFlow • Other sources(?) • Lots of information but no coherence • Hard to correlate into usable intelligence • Difficult to reassemble the puzzle • Research & analysis takes lots of analyst time Thomas Jefferson National Accelerator Facility Cyber Security Review, April 23-24, 2002, Operated by Jefferson Science Associates, LLC. for the U.S. Depart. Of Energy 3 Network Security Monitoring The collection, analysis and escalation of indications and warnings to detect and respond to intrusions. Thomas Jefferson National Accelerator Facility Cyber Security Review, April 23-24, 2002, Operated by Jefferson Science Associates, LLC. for the U.S. Depart. Of Energy 4 NSM in a Nutshell • NSM is a methodology, not a product • An extension/evolution of traditional network monitoring • Integrates different sources into a single view • Easier to understand • Speeds the research process Thomas Jefferson National Accelerator Facility Cyber Security Review, April 23-24, 2002, Operated by Jefferson Science Associates, LLC.
    [Show full text]
  • Logging and Monitoring to Detect Network Intrusions and Compliance Violations in the Environment
    Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Logging and Monitoring to Detect Network Intrusions and Compliance Violations in the Environment Log Management and Intrusion Detection solutions have been evolving for years. Yet, it remains a challenge for organizations of all sizes to meet the operational, audit and security needs using these solutions. This paper presents a solution to bridge logging, log based intrusion detection and network based intrusion detection using well known free open source tools available on the Security Onion Linux Distribution. It walks through the logging, monitoring and alerting approach necessary for security, compliance and q... Copyright SANS Institute Author Retains Full Rights AD Logging and Monitoring to Detect Network Intrusions and Compliance Violations in the Environment . ts h g ri GIAC (GCIA) Gold Certification ll u f Author: Sunil Gupta, [email protected] s Advisor: Dr. Kees Leune in ta re r Accepted: July 4, 2012o th u , A te tu ti Abstract s n Log Management and Intrusion I Detection solutions have been evolving for years. Yet, it remains a challenge for organizationsS of all sizes to meet the operational, audit and security needs using these solutions. ThisN paper presents a solution to bridge logging, log based intrusion detection A and network Sbased intrusion detection using well known free open source tools available on the Security Onion Linux Distribution. It walks through the logging, monitoring and alerting 12 approach0 necessary for security, compliance and quality of service.
    [Show full text]
  • Shadow Sensor Configuration Policy
    Guy Bruneau – [email protected] Build Securely Suricata with Sguil Sensor Step-by-Step Powered by Slackware 64-Bit Linux By Guy Bruneau, GSE (GSEC, GCIA, GCIH, GCUX, GCFA, GPEN) Version 8.0 – 17 June 2015 INTRODUCTION .........................................................................................................................................3 DETAILED INSTALLATION, CONFIGURATION AND PARTITIONING THE DRIVE ................4 DATABASE AND SENSOR ..............................................................................................................................4 Note on MySQL Drive size estimate: .......................................................................................................5 INSTALL THE SOFTWARE ..............................................................................................................................5 SGUIL CLIENT CONFIGURATION ...................................................................................................................6 Sguil sguil.conf update ............................................................................................................................7 CLIENT ACCESS TO DATABASE ....................................................................................................................8 TCP WRAPPER - SSH ...................................................................................................................................8 IPTABLES FIREWALL ....................................................................................................................................8
    [Show full text]
  • Testing the Security Onion Kayla Jansen [email protected]
    St. Cloud State University theRepository at St. Cloud State Culminating Projects in Information Assurance Department of Information Systems 12-2018 Testing the Security Onion Kayla Jansen [email protected] Follow this and additional works at: https://repository.stcloudstate.edu/msia_etds Recommended Citation Jansen, Kayla, "Testing the Security Onion" (2018). Culminating Projects in Information Assurance. 70. https://repository.stcloudstate.edu/msia_etds/70 This Thesis is brought to you for free and open access by the Department of Information Systems at theRepository at St. Cloud State. It has been accepted for inclusion in Culminating Projects in Information Assurance by an authorized administrator of theRepository at St. Cloud State. For more information, please contact [email protected]. Testing the Security Onion by Kayla Jansen A Thesis Submitted to the Graduate Faculty of St. Cloud State University In Partial Fulfillment of the Requirements for the Degree of Master of Science in Information Assurance December, 2018 Committee Members: Dennis Guster, Chairperson Susantha Herath Erich Rice 2 Abstract Security professionals utilize different types of systems, tools, and software in an attempt to secure an organization from external threats. There are many challenges that professionals face, when attempting to choose and execute a system into their framework. Because of these challenges, professionals may decide to go with a free open source system, such as the Security Onion. However, there is little information or results that show the effectiveness of the system. Several articles indicate ways of configuring the system or examining certain components within it. This project aims to examine the effectiveness of the Security Onion through a controlled test.
    [Show full text]
  • 20C403C Packet Analysis for Network Security
    Packet Analysis for Network Security 1 Agenda • Why Network Security? • Attack Frameworks • Detection analysis techniques • List of Free Open Source Software (F.O.S.S) • Overview of Security Onion • Demo Time 2 Amount of attacks – SSH attack • APNIC 46 Network security workshop, deployed 7 honeypots to a cloud service • 21,077 attacks in 24 hours • Top 5 sensors – training06 (8,431 attacks) – training01 (5,268 attacks) – training04 (2,208 attacks) – training07 (2,025 attacks) – training03 (1,850 attacks) 3 Time of attack – RDP attack The 10 RDP honeypots logged a combined 4,298,513 failed login attempts over a 30-day period https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophos-rdp-exposed-the-threats-thats-already-at-your-door- wp.pdf last accessed 24/07/2019 4 Legislative requirements • Government intervention and regulation – Europe, GDPR (General Data Protection Regulation) – Australia, Notifiable Data Breaches (NDB) scheme – United States, various State data breach notification Statutes – India, Personal Data Protection Bill (Early 2020) – China, Cybersecurity Law & draft Data Security Administrative Measures • Data protection laws of the world – https://www.dlapiperdataprotection.com 5 Attack Life Cycle http://www.iacpcybercenter.org/resource-center/what-is-cyber-crime/cyber-attack-lifecycle/ 6 Mitigate Cyber Security incidents Relative Mitigation strategy Potential Upfront cost Ongoing security user (staff, maintenance effectiveness resistance equipment, cost (mainly rating technical staff) complexity) Mitigation strategies to detect cyber security incidents and respond Excellent Continuous incident detection and response with Low Very high Very high automated immediate analysis of centralised time- synchronised logs of permitted and denied: computer events, authentication, file access and network activity.
    [Show full text]