_____________________________________________________________Chapter-5___________

Chapter-5 System Security

Intruders
No matter how much secure a system is made, there would be attackers, who would constantly try to find their way called intruders, because they try to intrude into the privacy of a network. Intruders are said to be of three type Masquerade: A user who does not have the authority to use a computer, but penetrates into a system to access a legitimate users account is called as a masquerade. It is generally an external user. Misfeasor: There are two possible cases for an internal user to be called misfeasor o A legitimate user, who accesses data, some applications or resources for whom these access is not authorized. o A legitimate user, who has access to some applications, data or resource and misuses his privileges. Clandestine user: An internal or external user who tries to work using the privileges of a supervisor user to avoid auditing information being captured and recorded is called as a clandestine user.

Intrusion Detection Systems Intrusion Detection Systems (IDS) have been marketed as the ultimate and final answer to network security. An IDS is software that runs on either individual workstations or on network devices to monitor and track network activity. Using an IDS, a network administrator can configure the system to respond just like a burglar alarm in your building. IDS systems can be configured to evaluate systems logs, look at suspicious network activity, and disconnect sessions that appear to violate security settings. Intrusion Detection Systems (IDS) are becoming integral parts of network monitoring. Intrusion Detection (ID) is the process of monitoring events in a system or network to determine if an intrusion is occurring. An intrusion is defined as any activity or action that attempts to undermine or compromise the confidentiality, integrity, or availability of resources. Firewalls, as you may recall, were designed to prevent access to resources by an attacker. Intrusion Detection Systems report and monitor these activities. The Intrusion Detection System has many different components and processes that work together to provide a real-time picture of your network traffic.

_________________________________________________________________________

_____________________________________________________________Chapter-5___________

Activity An activity is an element of a data source that is of interest to the operator. This could include a specific occurrence of a type of activity that is suspicious. An example of this might be a TCP connection request that occurs repeatedly from the same IP address. Administrator The administrator is the person responsible for setting the security policy for an organization. He is responsible for making decisions about the deployment and configuration of the IDS. The administrator should make decisions regarding alarm levels, historical logging, and session monitoring capabilities. He is also responsible for determining the appropriate responses to attacks and ensuring that those responses are carried out. Alert An alert is a message from the analyzer indicating that an event of interest has occurred. This alert would contain information about the activity, as well as specifics of the occurrence. An alert may be generated when an excessive amount of ICMP traffic is occurring or when repeated logon attempts are failing. A certain level of traffic is normal for a network. Alerts occur when activities of a certain type exceed a preset threshold. For instance, you would not want to generate an alert every time someone from outside your network pings a server using the PING program. However, if the pings seemed more frequent, or exceeded a predetermined threshold, you would want to generate an alert. Analyzer The analyzer is the component or process that analyzes the data collected by the sensor. The analyzer is looking for suspicious activity. Analyzers work by monitoring events and determining whether unusual activities are occurring, or they can use a rules-based process that is established when the IDS is configured. Data Source The data source is the raw information that the IDS uses to detect suspicious activity. The data source may include audit files, systems logs, or the network traffic as it occurs. Event An event is an occurrence in a data source that indicates that a suspicious activity has occurred. An event may generate an alert. Events are logged for future reference. Events will also typically trigger a notification that something unusual may be happening in the network. An IDS might begin logging events if the volume of inbound e-mail connections suddenly spikes. This event might be an indication that someone is probing your network. The event might trigger an 2 _________________________________________________________________________

_____________________________________________________________Chapter-5___________ alert if a deviation from normal network traffic patterns occurs or if an activity threshold has been crossed. Manager The manager is the component or process the operator uses to manage the IDS. The IDS console is a manager. Configuration changes in the IDS are made by communicating with the IDS manager. Notification Notification is the process or method by which the IDS manager makes the operator aware of an alert. This might include a graphic display highlighting the traffic or an e-mail sent to the administrative staff of the network. Operator The operator is the person primarily responsible for the IDS. Sensor A sensor is the IDS component that collects data from the data source and passes it to the analyzer for analysis. A sensor can be a device driver on a system, or it can be an actual black box that is connected to the network and reports to the IDS. The important thing to remember is that the sensor is a primary data collection point for the IDS.

Network-Based IDS
A Network-based IDS (N-IDS) approach to IDS attaches the system to a point in the network where it can monitor and report on all network traffic. This can be in front of or behind the firewall, as shown. Placing the N-IDS in front of the firewall provides monitoring of all network traffic going into the network. This approach allows a huge amount of data to be processed, and it allows you to see all of the traffic that is coming into the network. Putting the N-IDS behind the firewall only allows you to see the traffic that penetrates the firewall. Although this approach reduces the amount of data processed, it does not allow you to see all of the attacks that might be developing.

The N-IDS can be attached to a switch or a hub, or it can be attached to a tap. Figure illustrates a connection to the network using a hub. Many hubs and switches provide a monitoring port for troubleshooting and diagnostic purposes. This port may function in a manner similar to a tap. The advantage of the tap approach is that the IDS is the only device that will be using the tap.

_________________________________________________________________________

_____________________________________________________________Chapter-5___________

Host-Based IDS
A Host-based IDS (H-IDS) is designed to run as software on a host computer system. These systems typically run as a service or as a background process on the computer system. H-IDS systems will examine the machine logs, systems events, and applications interactions. H-IDS systems do not normally monitor incoming network traffic to the host. H-IDS systems are very popular on servers that use encrypted channels or channels to other servers. Figure illustrates an HIDS installed on a server. Notice that the H-IDS interact with the logon audit and kernel audit files. The kernel audit files are used for process and application interfaces.

Two major problems with H-IDS are not easily overcome. The first problem involves a compromise of the system. If the system is compromised, the log files that the IDS uses to report to may become corrupt or inaccurate. This may make fault determination difficult or the system unreliable. The second major problem with H-IDS is that it must be deployed on each system that needs it. This can create a headache for administrative and support staff. One of the major things that H-IDS provide is the potential to keep checksums on files. They can be used to inform system administrators that files have been altered by an attack. This makes recovery easier because determining where tampered has occurred is easier. 4 _________________________________________________________________________

_____________________________________________________________Chapter-5___________

Honey Pots
A honey pot is a computer that has been designated as a target for computer attacks. The purpose of a honey pot is to allow itself to succumb to an attack. During the process of "dying," the system can be used to gain information about how attacks develop and what methods were used to institute the attack. The benefit of a honey pot system is that it will draw attackers away from a higher value system or it will allow administrators to gain intelligence about an attack strategy. Honey pot systems are not normally secured or locked down. If they came straight out of the box with an operating system and applications software, they may be configured as is. Elaborate honey pot systems can contain information and software that might entice an attacker to probe deeper and take over the system. In fact, if not configured properly, a honey pot system can be used to launch attacks against other systems. There are several initiatives in the area of honey pot technology. One of the more interesting involves a project called honeynet. This organization has created a whole synthetic network that can be run on a single computer system and is attached to a network using a normal NIC card. The honey- net system looks like an entire corporate network, complete with applications and data, all of which are fake. A honeypot is a trap that attracts potential attackers. It is designed so as to do the following: Divert the attention of a potential of a potential intruder from critical systems. Collect information about the intruders actions. Provide encouragement to the intruder so as to stay on for some time, allowing the administrator to detect this and swiftly act on it. Do not allow legitimate users to know about or access them.

Password Management
Password Protection: The frontline of defense against intruders is the password system. Virtually all multi-user system requires that a user provide not only a name or identifier (ID) but also a password. The password serves to authenticate the ID of the individual logging on to the system. In turn, the ID provides security in the following way: The ID determines whether the user is authorized to gain access to a system. The ID determines the privileges accorded to the user. The ID is used in what is referred to s discretionary access control..

Vulnerability of password (See slides)

_________________________________________________________________________

_____________________________________________________________Chapter-5___________

Operating System Security

What is System Hardening? System hardening is a step by step process of securely configuring a system to protect it against unauthorized access, while also taking steps to make the system more reliable. Operating Systems (OS) and Network Operating Systems (NOS) hardening refers to the process of making the environment more secure from attacks and intruders System hardening is necessary since "out of the box", some operating systems tend to be designed and installed primarily to be easy to use rather than secure. Most but not all systems can have security measures enabled that will make them suitable for high security, high reliability environments. System hardening is the process of securely configuring the system against the unauthorized access, intruders, hackers and other security vulnerabilities. System hardening makes the computer system more reliable, secure, and efficient and gives the optimized performance. Computer systems are often vulnerable to the outside threats. The main purpose of the system hardening is to reduce the security risks as much as possible. System hardening provides the following benefits.

In case of system failure you can recover faster. Inefficiencies in the system configurations are detected. Fewer system failures or delays. Efficiency, reliability, security and the optimized performance of your system.

6 _________________________________________________________________________

_____________________________________________________________Chapter-5___________

appropriate password

Steps for securing UNIX/Linux

The UNIX environment and its derivatives are some of the most installed server products in the history of the computer industry. Over a dozen different versions of UNIX are available; the most popular is a product called Linux. 1. Linux, and UNIX when properly configured, provide a high level of security. The major challenge with the UNIX environment is configuring it properly. 2. UNIX includes almost every protocol, service, and capability that computer scientists have designed. Most of the services should be turned off when they are not needed. Turn them off by running a script during system startup. The script will configure the protocols, and it will determine which services are started. 3. All UNIX security is handled at the file level. Files and directories need to be established properly in order to ensure correct access permissions. The file structure is hierarchical by nature, and when a file folder access level is set, all of the subordinate file folders usually inherit this access. This inheritance of security is established by the systems administrator or by a user who knows how to adjust directory permissions. 4. Keeping patches and updates current is essential in the UNIX environment. You can accomplish this by regularly visiting the developer's website and downloading the latest fixes. 5. Linux also provides a great deal of activity logging. These logs are essential in establishing patterns of intrusion. _________________________________________________________________________ 7

_____________________________________________________________Chapter-5___________ 6. An additional method of securing Linux systems is accomplished by adding TCP wrappers. TCP wrappers are a low-level logging package designed for UNIX systems. Wrappers provide additional detailed logging on activity using a specific protocol. Each protocol or port must have a wrapper installed for it. Wrappers are then used to record activities and deny access to the service or server.

Operating System Updates

Product updates are typically provided by operating system manufacturers. In both cases, public and private, updates help keep operating systems up to the most current revision level. Researching updates is important, and when possible so is getting feedback from other users before you install an update. Three different types of updates are discussed here: hotfixes, service packs, and patches. Hotfixes The term hotfix is used to describe a repair that is made to a system during normal operation. A hotfix might entail moving data from a bad spot on the disk and remapping the data to a new sector. This would prevent data loss and loss of service. This type of repair may also involve reallocating a block of memory if, for example, a memory problem occurred. This would allow the system to continue normal operations until a permanent repair could be made. Microsoft refers to a bug fix as a hotfix. This involves the replacement of files with an updated version. Service Packs A service pack is a comprehensive set of fixes consolidated into a single product. A service pack may be used to address a large number of bugs or to introduce new capabilities in an operating system. When installed, a service pack will usually contain a number of file replacements. Make sure you check related websites to verify that the service pack works properly. Sometimes a manufacturer will release a service pack before it has been thoroughly tested. An untested service pack can cause extreme instability in an operating system or, even worse, render it inoperable. One large operating system manufacturer released a service pack for a popular server product three times before they got it right. This service pack, when installed caused many systems to become inoperable. The service pack took down the entire server farm of a large ISP. Many users lost their servers for several days while everything was sorted out and repaired. Patches A patch is a temporary or "quick fix" to a program. Patches may be used to temporarily bypass a set of instructions that have malfunctioned. Several operating systems manufacturers issue patches that can either be manually applied or applied using a disk file to fix a program. When you are working with customer support on a technical problem with an operating system or applications product, customer service may have you actually go into the code and make alterations to the binary files that run on your system. Double-check each change to prevent catastrophic failures due to improperly entered code. 8 _________________________________________________________________________