An IDS is not one thing—it is a collection of items that come together to make the overall solution. The IDS is formed by a series of components that make an effective solution designed to monitor the network or system for a range of intrusions. If you zoom out a bit, you can see that an IDS is not even centered or resident on a single system; it is distributed across a group of systems, each playing a vital role in monitoring the network.

In the solution that forms an IDS, there are a number of components, each with its own responsibilities. These components are responsible for monitoring for intrusion, but also are capable of performing other functions, such as the following:

When you move from vendor to vendor, the features that are part of the IDS will vary in scope, capability, and implementation. Some IDSs offer only a subset of the features mentioned here, and others offer substantially more. All IDSs do tend to have the same components no matter which vendor is manufacturing the device.

The most visible component of an IDS is the command console, which represents the component where the system administrator manages and monitors the system. This is where the administrator carries out the day-to-day tasks of monitoring, tuning, and configuring the system in order to maintain optimal performance. The command console may be accessed from anywhere or have its access restricted to a specific system for security purposes.

Working in concert with and monitored by the command console is the network sensor. The network sensor is a discrete software application that runs on a designated device or system as needed. This sensor is essentially the same as a sniffer in that it runs in conjunction with a network card in promiscuous mode. The sensor has the ability to monitor traffic on a specific segment of the network due to the same restrictions that are placed on sniffers. This is why placement of a network sensor is so important: Placement of a sensor on the incorrect network segment could result in a critical segment not being monitored. Figure 15-1 illustrates the components of a NIDS.

Another mechanism that works with an IDS is a hardware-based device known as a network tap. This device resides on the network and appears physically very similar to a hub or switch, but as part of an IDS it can be of value. A network tap has certain characteristics that make it unique; for example, it has no Internet Protocol (IP) address, it sniffs traffic, and it can be used by an IDS to collect traffic that is used to generate alerts. The main benefit of placing a network tap on the network in conjunction with an IDS such as a NIDS is that it will enhance the security and detection capabilities of the system.

Figure 15-1. Components of a NIDS.

An effective and robust alert generation and notification system is required to let the network owner know what is occurring when an attack happens. Alert notification and generation will occur when an event or some activity happens that needs the attention of the security or network administrator. The alerts that are generated can be delivered to the system owner using popup alerts, audio alerts, pagers, text messages and e-mail.

How does an IDS function? The intrusion detection process is a combination of information gathered from several processes. The process is designed to respond to packets sniffed and analyzed. In this example, the information is sniffed from an Ethernet network with a system running the sensor operating in promiscuous mode, sniffing and analyzing packets off of a local segment.

In the following steps, an IDS using a signature-based detection method is used to detect an intrusion and alert the system owner:

Figure 15-2. Components of a HIDS.

A HIDS is designed to monitor the activity on a specific system. Many vendors offer this type of IDS so the features vary wildly, but the basic components are the same.

The first component of a HIDS is the command console, which acts much like its counterpart on the NIDS. This piece of software is the component that the network administrator will spend the most time with. Here the administrator will configure, monitor, and manage the system as needs change.

The second component in the HIDS is the monitoring agent software. This agent is responsible for monitoring the activities on a system. The agent will be deployed to the target system and monitor activities such as permission usage, changes to system settings, file modifications, and other suspicious activity on the system. Figure 15-2 illustrates the components of a HIDS.

When setting up an IDS, it is necessary to define the goals of the system prior to deploying it into production. As with any technology of this level of complexity, some planning is required to make things work properly and effectively. The first step in ensuring that an IDS is working as it should is to set goals. Two goals that are common are response capability and accountability.

When an IDS recognizes a threat or other suspicious activity it must respond in some fashion. The IDS receives the data, analyzes it, and then compares it to known rules or behaviors and when a match is found some response must occur. The question you must answer is what this action will be; in this case, an alert.

Reponses can include any number of potential actions, depending on what your goal may happen to be. Some common responses include sending an alert to the administrator as a text message or e-mail, but this is not the only option. Additionally the IDS will log the event by placing an entry in a log file for later review and retrieval. In most cases, an organization would choose to place information in a log or event log because it provides additional benefits for the business—including the ability to analyze data historically and plan for expenditures. However, logs are not used only for planning budgets. They are also very useful in determining the effectiveness of security measures. Remember that an IDS detects attacks or suspicious activity after it has already occurred. If it has occurred, it means it has gotten around or passed through security measures unimpeded, in which case you need to know why and how it happened.

Having the proper response in place is an important detail to address, and without a response plan in place the system loses its effectiveness. But this is not the only required element because you must establish accountability, too. As part of network security policy, you must define a process in which the source and cause of an attack are identified and investigated. This process is necessary due to the potential need to pursue legal action, not to mention the need for finding out the source and cause of the attack in order to adjust your defenses to prevent the problem from happening again.

While an IDS is capable of performing a number of tasks in the realm of monitoring and alerting system administrators to what is happening on their network, it does have its limitations. You should always be aware of the strengths and weaknesses of the technologies you are working with, and IDSs are no exception. Knowing these limitations will also make sure that you use the technology correctly and it is addressing the issues it was designed to address.

An IDS provides a way of detecting an attack, but not dealing with it. That is the responsibility of something known as an IPS, which will be discussed later. An IDS is extremely limited as to the actions it can take when an attack or some sort of activity occurs. An IDS observes, compares, and detects the intrusion and will report it; it then becomes your responsibility to follow up. All the system can do is warn you if something isn't right; it can't give you the reasons why.

As a security professional, you will have to make it a point to review the IDS logs for suspicious behavior and take the necessary action. You are responsible for the follow-up and action.

Information from an IDS can be quite extensive and can be generated quite rapidly, and this data requires careful analysis in order to ensure that every potentially harmful activity is caught. You will have the task of developing and implementing a plan to analyze the sea of data that will be generated and ensuring that any questionable activity is caught.

The next step beyond an IDS is an IPS. An IPS is a device that is used to protect systems from attack by using different methods of access control. This system is an IDS with additional abilities that make it possible to protect the network.

The devices that were originally developed as a way to extend the capabilities were already present in an IDS. When you look at IDS in all its forms you see that it is a passive monitoring device that offers limited response capabilities. An IPS provides the ability to analyze content, application access, and other details to make determinations on access. For example, an IPS can provide additional information that would yield insight into activities on overly active hosts, bad logon activities, access of inappropriate content, and many other network and application layer functions.

Responses that an IPS can use in response to an attack include:

IPSs come in different forms, each offering a unique set of abilities:

Firewalls function by controlling the flow of traffic between different zones. Their methods can vary, but the goal is still to control the flow of traffic. Figure 15-3 illustrates this process.

Firewalls are typically described by their vendors as having all sorts of advanced and complex features in an effort to distinguish them from their competitors. Vendors have found creative ways to describe their products in an effort to sound compelling to potential customers.

Firewalls can operate in one of three basic modes:

Packet filtering represents what could be thought of as the first generation of firewalls. Firewalls that used packet filtering could only do the most basic analysis of traffic, which meant that it was granting or denying access based on limited factors such as IP address, port, protocol, and little else. The network or security administrator would create what amounts to very primitive rules by today's standards that would permit or deny traffic.

Figure 15-3. A firewall in action.

The downside of this type of device is that the filtering was performed by examining the header of a packet and not the contents of a packet. While this setup worked, it still left the door open for attacks to be performed. For example, a filter could be set up to deny File Transfer Protocol (FTP) access outright, but a rule could not be created to block specific commands within FTP. This resulted in an all-or-nothing scenario.

A firewall may also use a stateful packet inspection (SPI). In this setup, the attributes of each connection are noted and stored by the firewall, these attributes are commonly known as describing the state of the connection. These attributes typically contain details such as the IP addresses and ports involved in the connection and the sequence numbers of packets crossing the firewall. Of course, recording all these attributes helps the firewall get a better handle on what is occurring, but this comes at the cost of additional processing and extra load on the central processing unit (CPU) on the firewall device or system. The firewall is responsible for keeping track of a connection from the time it is created until it is finished, at which point the connection information is discarded by the firewall.

SPI offers the ability to track connections between points and this is where the power of this technique lies. In this technique, tracking the state of connection provides a means of ensuring that connections that are improperly initiated or have not been initiated correctly are ignored and not allowed to connect. A proxy firewall is a type of firewall that functions as a gateway for requests arriving from clients. Client requests are received at the firewall, at which point the address of the final server is determined by the proxy software. The application proxy performs translation of the address and additional access control checking and logging as necessary, and then connects to the server on behalf of the client.

On the surface it sounds as if firewalls can do a lot just by controlling the flow of traffic; while this is true, they can't do everything. There are some things firewalls are not suited to performing and understanding, and understanding these limitations will go a long way toward letting you get the most from your firewall. Some companies in the past have made the ill-conceived decision to buy a firewall and set it up without asking what they are protecting from what and if the device will be able to do so. Unfortunately, a lot of companies have purchased firewalls, installed them, and later on wondered why security didn't improve.

The following areas represent the types of activity and events that a firewall will provide little or no value in stopping:

There are many different options for installing firewalls, and understanding each way is key to getting the correct deployment for your organization. The following describes different options for firewall implementation:

Figure 15-6. Screened host.

Figure 15-7. A DMZ.

In an organization it is possible that some services such as a Web server, DNS, or other resource may be required to be accessed by those outside the network. By its very nature this setup makes it so these systems are more vulnerable to attack as the outside world has access to them. In order to provide a means of protection, a DMZ is used to allow outside access while at the same time providing some protection. A DMZ can allow these hosts to be accessed by the outside world, although the outer firewall in the DMZ provides only limited connectivity to these resources. Additionally, even though those outside the firewall have access to the resources, they do not have any access to the internal network or this access is highly restricted being given only to specific hosts on the internal network.

To appreciate the utility of a firewall, consider the situation without this structure. If a single firewall were in place, the publicly accessible resources would be on the internal network, which would mean that anyone outside the network gaining access to the resources would in essence be on the internal network. Conversely, if the resources were moved outside the firewall, there would be little if any protection for them as access would be tough to control.

Before you charge out and put a firewall in place, you need a plan that defines how you will configure the firewall and what is expected. This is the role of policy. The policy you create will be the blueprint that dictates how the firewall is installed, configured, and managed. It will make sure that you are addressing the correct problems in the right way and that nothing unexpected is occurring.

For a firewall to be correctly designed and implemented, the firewall policy will be in place ahead of time. The firewall policy will represent a small subset of the overall organizational security policy. The firewall policy will fit into the overall company security policy in some fashion and uphold the organization's security goals, but enforce and support those goals with the firewall device.

The firewall policy you create will usually approach the problem of controlling traffic in and out of an organization in two ways. The first option when creating a policy and the firewall options that support it is to implicitly allow everything and explicitly deny only those things that you do not want. The other option is to implicitly deny everything and allow only those things you know you need. The two options represent drastically different methods of configuring the firewall. In the first option you are allowing everything unless you say otherwise, while the second will not allow anything unless you explicitly say otherwise. One is much more secure by default than the other.

Consider the option of implicit deny, which is the viewpoint that assumes all traffic is denied, except that which has been identified as explicitly being allowed. Usually this turns out to be much easier in the long run for the network/security administrator. For example, visualize creating a list of all the ports Trojans use plus all the ports your applications are authorized to use, and then creating rules to block each of them. Contrast that with creating a list of what the users are permitted to use and granting them access to those services and applications explicitly.

There are many different ways to approach the creation of firewall policy, but the ones that tend to be used the most are known as Network Connectivity Policy, the Contracted Worker Statement, and the Firewall Administrator Statement.

What is the goal of a honeypot? It can be twofold and will vary depending on who is deploying it. The honeypot can act as a decoy that looks attractive enough to an attacker that it draws attention away from another resource that is more sensitive, giving you more time to react to the threat. A honeypot can also be used as a research tool by a company to gain insight into the types and evolution of attacks and give them time to adjust their strategies to deal with the problem.

The problem with honeypots? They need to look attractive, but not so attractive that an attacker will know that they are being observed and that they are attacking a noncritical resource. Ideally you want an attacker to view the resource as vulnerable and not so out of place that they can detect that it is a ruse. When you configure a honeypot, you are looking to leave out patches and do minor configuration options someone might overlook and that an attacker will expect to find with a little effort.

A honeypot is a single system put in place to attract an attack and buy you more reaction time in the event of an attack. Under the right conditions, the honeypot will assist you in detecting an attack earlier than you would normally and allow you to shut it down before it reaches production systems.

A honeypot also can be used to support an additional goal: logging. By using a honeypot correctly and observing the attacks that take place around it, you can build a picture from the logs that will assist you in determining the types of attacks that you will be facing. Once this information is gathered and a picture is built, you can start to build a better picture of the attacks and then plan and defend accordingly.

Building upon the core goal of a honeypot, which is to look like an attractive target, the next step is a honeynet, which builds on the lessons and goals of the honeypot and the goals from one vulnerable system to a group of vulnerable systems or a network.

One of the issues that comes up when discussing honeypots and honeynets is the issue of legality. Basically the question is if you put a honeypot out where someone can attack it and does so, can you prosecute for a crime and would the honeypot be admissible as evidence? Some people feel that this is a cut-and-dried issue of entrapment, but others feel otherwise. Let's look at this a little more closely to understand the issue.

It has been argued that honeypots are entrapment because when you place one out in public you are enticing someone to attack it—at least that's the theory. In practice, attorneys have argued this point a handful of times without success due to certain points that have come up in other cases. Consider the police tactic of placing undercover female officers on a street corner playing the role of a prostitute. When officers stand there they simply wait and don't talk to anyone about engaging in any sort of activity, but when people approach the officer and ask about engaging in an illicit activity, they are arrested. A honeypot would be the same situation. No one forces attackers to go after honeypots; the attackers decide to do so on their own.

Administrative controls are those that fit in the area of policy and procedure. What you will find here are the rules that individuals and the company will follow to ensure a safe and consistently secure working environment. Listed in this section are some of the more common administrative controls that you would expect to see in practice:

Working in concert with administrative controls are technical controls that help enforce security in the organization. The technical controls you use will work with your other controls to create a robust security system. While there are a range of technical security controls, a handful stand out as more common than others.

Preventive logical controls include:

Access control software is software designed to control access to and sharing of information and applications. Software in this category can enforce access using one of three methods: discretionary access control (DAC), role based access control (RBAC), and mandatory access control (MAC).

Malware has become a considerable threat to organizations. Anti-malware solutions are essential tools in protecting the security of an organization with many organizations moving towards robust centralized applications designed to safeguard against software.

Passwords are another technical control; in fact, they may be the most common type of technical control in use. Interestingly enough, it may be the least effective, as users have been known to post passwords on monitors, choose simple passwords, and do other things that make passwords insecure. The idea is to use strong passwords as a preventive technical control. Passwords should be supplemented with other controls and even additional authentication mechanisms such as tokens or biometrics.

Security tokens are devices used to authenticate a user to a system or application. These devices take the form of hardware devices such as cards, fobs, and other types of devices. These types of devices can take many forms, including smart cards, key fobs, or cards. Tokens are intended to provide an enhanced level of protection by making the user present two forms of authentication—typically the token and a password or personal identification number (PIN)—that identify him or her as the owner of a particular device. If so equipped, the device will display a number on an LCD display which uniquely identifies the user to the service, allowing the logon. The identification number for each user is changed frequently at a predefined interval, which typically is one minute to five minutes or longer.

These devices can be used by themselves, but they are frequently used in conjunction with other controls such as passwords.

Biometrics is another type of access control mechanism. It provides the ability to measure the physical characteristics of a human being. Characteristics measured here include fingerprints, handprints, facial recognition, and similar methods.

Data backup is another form of control that is commonly used to safeguard assets. Never overlook the fact that backing up critical systems is one of the most important tools that you have at your disposal. Such procedures provide a vital protection against hardware failure and other types of system failure.

Not all backups are created equal and the right backup makes all the difference:

Physical security controls represent one of the most visible forms of security controls. Controls in this category include barriers, guards, cameras, locks, and other types of measures. Ultimately physical controls are designed to more directly protect the people, facilities, and equipment than the other types of controls do.

Some of the preventative security controls include the following:

Generally you can rely on your power company to provide your organization power that is clean, consistent, and adequate, but this isn't always the case. Anyone who has worked in an office building has noticed a light flicker, if not a complete blackout. Alternate power sources safeguard against these problems to different degrees.

Hurricane Katrina showed us how devastating a natural disaster can be, but the disaster wasn't just the hurricane; it was the flood that came with it. You can't necessarily stop a flood, but you can exercise flood management strategies to soften the impact. Choosing a facility in a location that is not prone to flooding is one option that you have available. Having adequate drainage and similar measures can also be of assistance. Finally, mounting items such as servers several inches off of the floor can be a help as well.

Fences are a physical control that represents a barrier that deters casual trespassers. While some organizations are willing to install tall fences with barbed wire and other features, it is not always the case. Typically the fence will be designed to meet the security profile of the organization, so if your company is a bakery instead of one that performs duties vital to national security, the fence design will be different as there are different items to protect.

Guards provide a security measure that can react to the unexpected as the human element is uniquely able to do. When it comes down to it, technology can do quite a bit, but it cannot replace the human element and brain. Additionally, once an intruder makes the decision to breach security, guards are a quick responding defense against them actually reaching critical assets.

The most common form of physical control is the ever-popular lock. Locks can take many forms including key locks, cipher locks, warded locks, and other types of locks—all designed to secure assets.

Fire suppression is a security measure that is physical and preventative. Fire suppression cannot stop a fire, but it can prevent substantial damage to equipment, facilities, and personnel.