Title: Intrusion Detection and Prevention Systems
Course: IN 2001 Principle of Information Assurance > Section: Module 7: Chapter Seven

Intrusion Detection and Prevention Systems
1. An IDS detects a violation of its configuration and activates an alarm.
2. System administrators can choose the configuration of the various alerts and the associated alarm levels for each type of alert.
3. Many IDSs enable administrators to configure the systems to notify them directly of trouble via e-mail or pagers.
4. The systems can also be configured to notify an external security service organization of a “break-in.”

IDPS Terminology
1. Alert or Alarm: An indication that a system has just been attacked and/or continues to be under attack.
2. False Attack Stimulus: An event that triggers alarms and causes a false positive when no actual attacks are in progress.
3. False Negative: The failure of an IDS system to react to an actual attack event.
4. False Positive: An alarm or alert that indicates that an attack is in progress or that an attack has successfully occurred when, in fact, there has been no such attack.
5. Noise: The ongoing activity from alarm events that are accurate and noteworthy but not necessarily significant as potentially successful attacks.
6. Site Policy: The rules and configuration guidelines governing the implementation and operation of IDSs within the organization.
7. Site Policy Awareness: An IDS’s ability to dynamically modify its site policies in reaction or response to environmental activity.
8. True Attack Stimulus: An event that triggers alarms and causes an IDS to react as if a real attack was in progress.
9. Confidence Value: A value associated with an IDS’s ability to detect and identify an attack correctly.
10. Alarm Filtering: The process of classifying the attack alerts that an IDS produces in order to distinguish and sort false positives from actual attacks more efficiently.

Why Use an IDS?
1. There are several reasons to use an IDS:
  - To prevent problem behaviors by increasing the perceived risk of discovery and punishment for those who would attack or otherwise abuse the system
  - To detect attacks and other security violations that are not prevented by other security measures
  - To detect and deal with the preambles to attacks
  - To document the existing threat to an organization
  - To act as quality control for security design and administration, especially of large and complex enterprises
  - To provide useful information about intrusions that do take place, allowing improved diagnosis, recovery, and correction of causative factors

Types of IDP Systems
1. IDSs operate as network-based, host-based, or application-based systems.
2. A network-based IDS is focused on protecting network information assets.
3. A host-based version is focused on protecting the server or host’s information assets.
4. The application-based model works on one or more host systems that support a single application and is oriented to defend that specific application from special forms of attack.
5. All IDSs use one of two detection methods:
  - Signature-based
  - Statistical anomaly-based
6. Network-Based IDPS
  - A network-based IDPS (NIDPS) resides on a computer or appliance connected to a segment of an organization’s network and monitors network traffic on that network segment, looking for indications of ongoing or successful attacks
  - When a situation occurs that the network-based IDS is programmed to recognize as an attack, it responds by sending notifications to administrators
  - When examining the packets transmitted through an organization’s networks, a NIDPS looks for attack patterns within network traffic, such as large collections of related items that are of a certain type, which could indicate that a denial-of-service attack is underway or it looks for the exchange of a series of related packets in a certain pattern, which could indicate that a port scan is in progress
  - NIDPSs are installed at a specific place in the network (such as on the inside of an edge router) from where it is possible to watch the traffic going into and out of a particular network segment
  - The NIDPS can be deployed to watch a specific grouping of host computers on a specific network segment, or it can be installed to monitor all traffic between the systems that make up an entire network
  - To determine whether or not an attack has occurred or may be underway, NIDPSs look for attack patterns by comparing measured activity to known signatures in their knowledge base
  - This is accomplished by the comparison of captured network traffic using a special implementation of the TCP/IP stack that reassembles the packets and applies protocol stack or application protocol verification.  In the process of protocol stack verification, the NIDSs look for invalid data packets
  - In application protocol verification, the higher-order protocols are examined for unexpected packet behavior or improper use.
7. Advantages of NIDPSs
  - Good network design and placement of NIDS devices can enable an organization to use a few devices to monitor a large network
  - NIDPSs are usually passive devices and can be deployed into existing networks with little or no disruption to normal network operations
  - NIDPSs are not usually susceptible to direct attack and in fact, may not be detectable by attackers
8. Disadvantages of NIDPSs
  - A NIDPS can become overwhelmed by network volume and fail to recognize attacks it might otherwise have detected
  - NIDPSs require access to all traffic to be monitored
  - NIDPSs cannot analyze encrypted packets, making some of the network traffic invisible to the process
  - NIDSs cannot reliably ascertain if an attack was successful or not.  Some forms of attack are not easily discerned by NIDPSs, specifically those involving fragmented packets
9. Network Behavior Analysis System Is a system that uses traffic flow data and baselines to determine when network attacks or other malicious traffic may be present on the monitored network.
10. Host-Based IDPS
  - A host-based IDPS (HIDPS) resides on a particular computer or server, known as the host and monitors activity only on that system
  - HIDPSs are also known as system integrity verifiers, as they benchmark and monitor the status of key system files and detect when an intruder creates, modifies or deletes monitored files
  - Most HIDPSs work on the principle of configuration or change management, which means they record the sizes, locations, and other attributes of system files.  The HIDPS then triggers an alert when one of the following changes occurs: file attributes change; new files are created; or existing files are deleted.
  - A HIDPS has an advantage over NIDPS in that it can usually be installed in such a way that it can access information that is encrypted when traveling over the network
  - A HIDPS relies on the classification of files into various categories and then applies various notification actions, depending on the rules in the HIDPS configuration
  - Managed HIDPSs can monitor multiple computers simultaneously by creating a configuration file on each monitored host and by making each HIDPS report back to a master console system, which is usually located on the system administrator’s computer
  - Advantages of HIDPSs:
    - A HIDPS can detect local events on host systems and also detect attacks that may elude a network-based IDPS
    - A HIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing
    - The use of switched network protocols does not affect a HIDPS.
    - A HIDPS can detect inconsistencies in how applications and systems programs were used by examining the records stored in audit logs.
  - Disadvantages of HIDPSs:
    - HIDPSs pose more management issues since they are configured and managed on each monitored host.  A HIDPS is vulnerable both to direct attacks and to attacks against the host operating system
    - A HIDPS is not optimized to detect multi-host scanning, nor is it able to detect the scanning of non-host network devices, such as routers or switches
    - A HIDPS is susceptible to some denial-of-service attacks
    - A HIDPS can use large amounts of disk space to retain the host OS audit logs, and to function properly, it may require disk capacity to be added to the system
    - A HIDPS can inflict a performance overhead on its host systems, and in some cases, may reduce system performance below acceptable levels

IDPS Detection Methods
1. IDPSs use a variety of detection methods to monitor and evaluate network traffic.
2. Three methods dominate: the signature-based approach, the statistical-anomaly approach, and the stateful packet inspection approach.
3. Signature-Based IDS
  - A signature-based IDS (also known as a knowledge-based IDS) examines data traffic in search of patterns that match known signatures—that is, preconfigured, predetermined attack patterns
  - Signature-based IDS technology is widely used because many attacks have clear and distinct signatures
  - The problem with the signature-based approach is that as new attack strategies are identified, the IDS’s database of signatures must be continually updated
4. Statistical Anomaly-Based IDS
  - The statistical anomaly-based IDS (stat IDS) or behavior-based IDS collects statistical summaries by observing traffic that is known to be normal. This normal period of evaluation establishes a performance baseline
  - Once the baseline is established, the stat IDS will periodically sample network activity and using statistical methods, compare the sampled network activity to this baseline.  When the measured activity is outside the baseline parameters, it is said to exceed the clipping level and the IDS will trigger an alert to notify the administrator.
  - The data that is measured from the normal traffic and is used to prepare the baseline can include variables such as host memory or CPU usage, network packet types and packet quantities
  - The advantage of the statistical anomaly-based approach is that the IDS can detect new types of attacks, because it is looking for abnormal activity of any type.  Unfortunately, however, these systems require much more overhead and processing capacity than signature-based ones, as they must constantly compare patterns of activity against the baseline.  Another drawback is that these systems may not detect minor changes to system variables and may generate many false positives
5. Stateful Protocol Analysis IDPS
  - According to SP 800-94, “Stateful protocol analysis (SPA) is a process of comparing predetermined profiles of generally accepted definitions of benign activity for each protocol state against observed events to identify deviations.  Stateful protocol analysis relies on vendor-developed universal profiles that specify how particular protocols should and should not be used.”
  - By storing relevant data detected in a session and then using that data to identify intrusions that involve multiple requests and responses, the IDPS can better detect specialized, multisession attacks.  This process is sometimes called deep packet inspection because SPA closely examines packets at the application layer for information that indicates a possible intrusion.
  - The analytical complexity of session-based assessments is the principal drawback to this type of IDPS method, which is further complicated by the amount of processing overhead in tracking multiple, simultaneous connections
  - Additionally, unless the protocol violates its fundamental behavior, this type of IDPS method may completely fail to detect the intrusion.  One final issue is the possibility that the IDPS may in fact cause problems with the protocol it’s examining, especially with client- and server-differentiated operations
6. Log File Monitors
  - Similar to a NIDS, a log file monitor (LFM) reviews the log files generated by servers, network devices, and even other IDSs for patterns and signatures in the log files that may indicate that an attack or intrusion is in process or has already succeeded
  - The patterns that signify an attack can be subtle and hard to distinguish when one system is examined in isolation, but they may be much easier to identify when the entire network and its systems are viewed holistically.  Of course, this approach will require the allocation of considerable resources since it will involve the collection, movement, storage and analysis of very large quantities of log data

IDPS Response Behavior

1. Once an IDS detects an anomalous network situation, it has a number of options, depending on the policy and objectives of the organization that has configured it, as well as the capabilities of the organization’s system.
2. IDS responses can be classified as active or passive. An active response is one in which a definitive action is initiated when certain types of alerts are triggered. IDSs with passive response options simply report the information they have already collected and wait for the administrator to take actions.
3. The following are some of the responses that an IDS can be configured to produce:
  - Audible / visual alarms
  - SNMP traps and plug-ins
  - E-mail messages
  - Pager or phone messages
  - Log entries
  - Evidentiary packet dumps
  - Take action against the intruder
  - Launch program
  - Reconfigure firewall
  - Terminate session
  - Terminate connection

Selecting IDS Approaches and Products
1. The wide array of intrusion detection products available today addresses a broad range of organizational security goals and considerations.
2. Given that range of products and features, the process of selecting products that represent the best fit for any specific organization’s needs is challenging.
3. The following questions may be useful when preparing a specification for acquiring and deploying an intrusion detection product.
4. Technical and Policy Considerations
  - What is your systems environment?
  - What are the technical specifications of your systems environment?
  - What are the technical specifications of your current security protections?
  - What are the goals of your enterprise?
  - How formal is the systems environment and management culture in your organization?
  - What are your security goals and objectives?
  - Is the primary concern of your organization to be protected from threats that originate outside of your organization?
  - Is your organization concerned about insider attacks?
  - Does your organization want to use the output of your IDS to determine new needs?
  - Does your organization want to use an IDS to maintain managerial control over network usage?
  - What is your existing security policy?
  - How is it structured?
  - What are the general job descriptions of your system users?
  - Does the policy include reasonable use policies or other management provisions?
  - Has your organization defined processes for dealing with specific policy violations?
5. Organizational Requirements and Constraints
  - What are the requirements that are levied from outside the organization?
  - Is your organization subject to oversight or review by another organization?
  - Are there requirements for public access to information on your organization’s systems?
  - Are there other security-specific requirements levied by law?
  - Are there internal audit requirements for security best practices or due diligence?
  - Is the system subject to accreditation?
  - Are there requirements for law enforcement investigation and resolution of security incidents?
  - What are your organization’s resource constraints?
  - What is the budget for acquisition and life cycle support of intrusion detection hardware, software and infrastructure?
  - Is there sufficient existing staff to monitor an IDS full time?
  - Does your organization have authority to instigate changes based on the findings of an IDS?
6. IDPSs Product Features and Quality of IDPSs
  - Is the product sufficiently scalable for your environment?
  - How has the product been tested?
  - Has the product been tested against functional requirements?
  - Has the product been tested against attack? Ask vendors for details of the security testing to which its products have been subjected.
  - What is the user level of expertise targeted by the product?
  - Is the product designed to evolve as the organization grows?
  - Can the product adapt to growth in user expertise?
  - Can the product adapt to growth and change of the organization’s systems infrastructure?
  - Can the product adapt to growth and change of the security threat environment?
  - What are the support provisions for the product?
  - What are commitments for product installation and configuration support?
  - What are commitments for ongoing product support?
  - Are subscriptions to signature updates included?
  - How often are subscriptions updated?
  - How quickly after a new attack is made public will the vendor ship a new signature?
  - Are software updates included?
  - How quickly will software updates and patches be issued after a problem is reported to the vendor?
  - Are technical support services included?
  - What are the contact provisions for contacting technical support?
  - Are there any guarantees associated with the IDS?
  - What training resources does the vendor provide as part of the product?
  - What additional training resources are available from the vendor and at what cost?

Strengths and Limitations of IDPSs
1. Intrusion detection systems perform the following functions well:
  - Monitoring and analysis of system events and user behaviors
  - Testing the security states of system configurations
  - Baselining the security state of a system, and then tracking any changes to that baseline
  - Recognizing patterns of system events that correspond to known attacks
  - Recognizing patterns of activity that statistically vary from normal activity
  - Managing operating system audit and logging mechanisms and the data they generate
  - Alerting appropriate staff by appropriate means when attacks are detected
  - Measuring enforcement of security policies that are encoded in the analysis engine
  - Providing default information security policies
  - Allowing non-security experts to perform important security monitoring functions
2. Intrusion detection systems cannot perform the following functions:
  - Compensating for weak or missing security mechanisms in the protection infrastructure
  - Instantaneously detecting, reporting, and responding to an attack when there is a heavy network or processing load
  - Detecting newly published attacks or variants of existing attacks
  - Effectively responding to attacks launched by sophisticated attackers
  - Automatically investigating attacks without human intervention
  - Resisting attacks that are intended to defeat or circumvent them
  - Compensating for problems with the fidelity of information sources
  - Dealing effectively with switched networks

Deployment and Implementation of an IDPS
1. Deploying and implementing an IDPS is not always a straightforward task. The strategy for deploying an IDPS should consider a number of factors, the foremost being how the IDPS will be managed and where it should be placed.
2. IDPS Control Strategies. An IDS can be implemented using one of three basic control strategies. A control strategy determines how an organization exerts influence and maintains the configuration of an IDS. The three commonly utilized control strategies are:
  - A centralized IDS control strategy implements and manages all IDS control functions in a central location
  - A fully distributed IDS control strategy distributes all control functions that are applied at the physical location of each IDS component
  - A partially distributed IDS control strategy combines the best of the other two strategies. While the individual agents can still analyze and respond to local threats, they report to a hierarchical central facility to enable the organization to detect widespread attacks
3. IDPS Deployment
  - Like the decision regarding control strategies, the decision about where to locate the elements of the intrusion detection systems can be an art in itself
  - As an organization selects an IDS and prepares for implementation, planners must select a deployment strategy that is based on a careful analysis of the organization’s information security requirements and that integrates with the organization’s existing IT infrastructure but, at the same time, causes minimal impact
  - NIDSs and HIDSs can be used in tandem to cover both the individual systems that connect to an organization’s networks and the networks themselves.
4. Deploying Network-Based IDPSs
  - NIST recommends four locations for NIDS sensors:
  - Location 1: Behind each external firewall in the network DMZ
    - IDS sees attacks that originate from the outside world and may penetrate the network’s perimeter defenses.
    - IDS can identify problems with the network firewall policy or performance.
    - IDS sees attacks that might target the Web server or ftp server, both of which commonly reside in this DMZ.
    - Even if the incoming attack is not detected, the IDS can sometimes recognize, in the outgoing traffic, patterns that suggest that the server has been compromised.
  - Location 2: Outside an external firewall
    - IDS documents the number of attacks originating on the Internet that target the network
    - IDS documents the types of attacks originating on the Internet that target the network
  - Location 3: On major network backbones
    - IDS monitors a large amount of a network’s traffic, thus increasing its chances of spotting attacks
    - IDS detects unauthorized activity by authorized users within the organization’s security perimeter
  - Location 4: On critical subnets
    - IDS detects attacks targeting critical systems and resources
    - This location allows organizations with limited resources to focus these resources on the network assets that have the greatest value
5. Deploying Host-Based IDPSs
  - The proper implementation of HIDSs can be a painstaking and time-consuming task, as each HIDS must be custom configured to its host systems
  - Deployment begins with implementing the most critical systems first. Installation continues until either all systems are installed or the organization reaches the planned degree of coverage it is willing to live with, with regard to the number of systems or percentage of network traffic
  - Just as technicians can install the HIDS in off-line systems to develop expertise and identify potential problems, users and managers can gain expertise and understanding of the operation of the HIDS by using a test facility
6. Measuring the Effectiveness of IDPSs
  - IDPSs are evaluated using four dominant metrics:
    - Thresholds
    - Blacklists and whitelists
    - Alert settings
    - Code viewing and editing
    - An evaluation of an IDS might read something like this: At 100 Mb/s, the IDS was able to detect 97% of directed attacks.
  - Since developing this collection can be tedious, most IDS vendors provide testing mechanisms that verify that their systems are performing as expected.  Some of these testing processes will enable the administrator to:
    - Record and retransmit packets from a real virus or worm scan
    - Record and retransmit packets from a real virus or worm scan with incomplete TCP/IP session connections (missing SYN packets)
    - Conduct a real virus or worm scan against an invulnerable system