Practical intrusion analysis: prevention and detection for the twenty-first century

✍ Scribed by Trost, Ryan

• Publisher: Addison-Wesley Professional
• Year: 2009;2010
• Tongue: English
• Leaves: 481
• Edition: 1. print
• Category: Library

✦ Synopsis

"Practical Intrusion Analysisprovides a solid fundamental overview of the art and science of intrusion analysis." -Nate Miller, Cofounder, Stratum SecurityThe Only Definitive Guide to New State-of-the-Art Techniques in Intrusion Detection and PreventionRecently, powerful innovations in intrusion detection and prevention have evolved in response to emerging threats and changing business environments. However, security practitioners have found little reliable, usable information about these new IDS/IPS technologies. InPractical Intrusion Analysis, one of the field's leading experts brings together these innovations for the first time and demonstrates how they can be used to analyze attacks, mitigate damage, and track attackers. Ryan Trost reviews the fundamental techniques and business drivers of intrusion detection and prevention by analyzing today's new vulnerabilities and attack vectors. Next, he presents complete explanations of powerful new IDS/IPS methodologies based on Network Behavioral Analysis (NBA), data visualization, geospatial analysis, and more. Writing for security practitioners and managers at all experience levels, Trost introduces new solutions for virtually every environment. Coverage includes Assessing the strengths and limitations of mainstream monitoring tools and IDS technologies Using Attack Graphs to map paths of network vulnerability and becoming more proactive about preventing intrusions Analyzing network behavior to immediately detect polymorphic worms, zero-day exploits, and botnet DoS attacks Understanding the theory, advantages, and disadvantages of the latest Web Application Firewalls Implementing IDS/IPS systems that protect wireless data traffic Enhancing your intrusion detection efforts by converging with physical security defenses Identifying attackers' "geographical fingerprints" and using that information to respond more effectively Visualizing data traffic to identify suspicious patterns more quickly Revisiting intrusion detection ROI in light of new threats, compliance risks, and technical alternatives Includes contributions from these leading network security experts: Jeff Forristal, a.k.a. Rain Forest Puppy, senior security professional and creator of libwhisker
Seth Fogie, CEO, Airscanner USA; leading-edge mobile security researcher; coauthor ofSecurity WarriorDr. Sushil Jajodia, Director, Center for Secure Information Systems; founding Editor-in-Chief,Journal of Computer SecurityDr. Steven Noel, Associate Director and Senior Research Scientist, Center for Secure Information Systems, George Mason University Alex Kirk, Member, Sourcefire Vulnerability Research Team

✦ Table of Contents

Cover......Page 1
Contents......Page 8
Preface......Page 16
Chapter 1 Network Overview......Page 26
Brief History of the Internet......Page 27
Layered Protocols......Page 28
TCP/IP Protocol Suite......Page 35
Internet Protocol......Page 39
Addressing......Page 46
IP Addresses......Page 47
IPv6......Page 52
Summary......Page 54
Chapter 2 Infrastructure Monitoring......Page 56
Network-Analysis Tools......Page 57
Packet Sniffing......Page 60
SPANs (Port Mirroring)......Page 65
Network Taps......Page 68
To Tap or to SPAN......Page 73
Defense-in-Depth......Page 75
Summary......Page 76
Chapter 3 Intrusion Detection Systems......Page 78
IDS Groundwork......Page 79
DoS Attacks......Page 80
IP Fragmentation......Page 82
TCP Stream Issues......Page 83
Target-Based Reassembly......Page 84
Two Detection Philosophies: Signature and Anomaly Based......Page 85
Snort: Signature-Based IDS......Page 86
Two Signature Writing Techniques......Page 92
Bro: An Anomaly-Based IDS......Page 99
Similarities Between the Systems......Page 107
Summary......Page 110
A Vulnerability Is Born......Page 112
FlashGet Vulnerability......Page 113
Collecting a Sample Packet Capture......Page 115
Packet Analysis and Signature-Writing......Page 120
Detection Tuning......Page 125
Performance Tuning......Page 126
CitectSCADA ODBC Server Buffer Overflow: Metasploit......Page 129
FastStone Image Viewer Bitmap Parsing......Page 134
Libspf2 DNS TXT Record Size Mismatch......Page 139
Summary......Page 142
Chapter 5 Proactive Intrusion Prevention and Response via Attack Graphs......Page 144
Overview of Approach......Page 146
Illustrative Example......Page 147
Limitations......Page 150
Network Attack Modeling......Page 151
Attack Simulation......Page 155
Optimal Network Protection......Page 159
Vulnerability Mitigation......Page 160
Attack Graph Visualization......Page 162
Security Metrics......Page 164
Intrusion Detection Guidance......Page 166
Attack Prediction and Response......Page 169
Acknowledgments......Page 172
Endnotes......Page 173
Chapter 6 Network Flows and Anomaly Detection......Page 176
IP Data Flows......Page 177
NetFlow Operational Theory......Page 178
A Matter of Duplex......Page 180
Cisco IOS NetFlow and Flexible NetFlow......Page 181
sFlow: More Data, But Less Frequency......Page 184
Internet Protocol Flow Information Export (IPFIX)......Page 186
It’s a Virtual World......Page 187
Endless Streams of Data......Page 189
Behavioral Analysis and Anomaly Detection......Page 192
IDS and NetFlow......Page 197
Signature Updates......Page 198
IDS System Resources......Page 199
Syslog and NetFlow......Page 203
Technology Matrix......Page 205
Summary......Page 207
Endnotes......Page 208
Chapter 7 Web Application Firewalls......Page 210
Web Threat Overview......Page 211
Why a WAF?......Page 214
Positive Security Model......Page 216
Negative Security Model......Page 217
Virtual Patching Model......Page 218
Output Detection Model/Content Scrubbing......Page 219
Manual Entry......Page 220
ModSecurity Rule Sets......Page 221
VA+WAF Example:WhiteHat Security and F5 Networks......Page 226
WAF Realities......Page 228
IDS/IPS != WAF......Page 229
WAFs Do Not Fix Bad Logic......Page 230
Summary......Page 231
References......Page 232
Why a Wireless IDS?......Page 234
Wireless Intrusion Detection/Prevention Realities......Page 237
Overlay......Page 238
Combined AP/WIDS......Page 239
Wireless IDS Events......Page 240
Unauthorized Activity......Page 241
Active Recon/Cracking......Page 242
DoS Attacks......Page 246
Limitations......Page 249
Isolation......Page 250
WEP Cloaking (WEP Chaffing)......Page 253
Location Detection......Page 254
Honeypot......Page 256
Sniffers......Page 258
Endnote......Page 259
Chapter 9 Physical Intrusion Detection for IT......Page 260
Assumed, Yet Overlooked......Page 261
A Parallel Universe to IT Security......Page 264
Physical Security Background......Page 266
Common Physical Access Control Components......Page 268
This Is Not Your Father’s CCTV......Page 280
Old Habits Die Hard......Page 284
Convergence of Physical and Logical Security......Page 285
How Convergence Works......Page 286
HSPD-12: Convergence Trial by Fire......Page 290
A Look at Some Vendor Offerings......Page 291
Intrusion Detection Examples in a Converged Environment......Page 295
Endnotes......Page 299
Chapter 10 Geospatial Intrusion Detection......Page 300
Current Uses of Geocoding......Page 303
Introduction to Geographic Information Systems......Page 304
Framework for Cooperation......Page 307
Map Projection......Page 308
Raster Versus Vector......Page 310
Vector Data Model......Page 312
Spatial Point Pattern Analysis......Page 313
Classes of Spatial Analysis......Page 314
Point Process Statistics......Page 315
Dynamics of a Professional Attack......Page 318
Cornerstone Theory......Page 320
Example of Attack Steps and Methods......Page 321
Geocoding Techniques......Page 324
Geocoding Limitations......Page 340
Accuracy......Page 341
GeoLocation Intelligence Vendors......Page 342
Case Study of Geographic Intrusion Detection......Page 345
Breakdown of the Steps......Page 347
Summary......Page 369
Endnotes......Page 370
References......Page 371
Chapter 11 Visual Data Communications......Page 372
Introduction to Visualization......Page 373
Developing a Visualization Strategy......Page 380
User Audiences......Page 381
Statistical Graphing Techniques......Page 386
Scalability......Page 390
Installation and Support......Page 391
Data Management......Page 393
Security Event Visualization......Page 395
Example Graphs......Page 396
Starlight Visual Information System......Page 403
ETRI: VisNet and VisMon......Page 406
Use-Case: Security Audit......Page 410
Summary......Page 412
Terminology......Page 413
Reference......Page 415
Chapter 12 Return on Investment: Business Justification......Page 416
Not If, But When......Page 418
CoBIT Framework......Page 419
ISO 27001/27002 Frameworks......Page 420
ITIL Framework......Page 421
Health Insurance Portability and Accountability Act of 1996 (HIPAA)......Page 422
Payment Card Industry Data Security Standard (PCI-DSS)......Page 423
Federal Information Security Management Act of 2002 (FISMA)/National Institute of Standards and Technology......Page 424
Security Breaches......Page 425
Breach Costs......Page 426
Data Breaches and the Law......Page 427
ROI as a Unifying Benchmark......Page 429
Cost Breakdown......Page 430
Cost-Benefit Analysis: Building an Economic Model......Page 433
Gain from Investment......Page 434
Cost of Investment......Page 438
Net Present Value......Page 439
Internal Rate of Return......Page 441
ROI Versus NPV Versus IRR......Page 442
Benefits of MSSPs......Page 443
Downfalls of MSSPs......Page 444
The Financial Aspect of an MSSP......Page 447
Cyber Liability Insurance (CLI)......Page 451
CLI Coverage Types......Page 453
Loss of Revenue Insurance......Page 454
Media Liability Insurance......Page 455
CLI Underwriting Process......Page 456
Summary......Page 457
Endnotes......Page 459
Appendix: Bro Installation Guide......Page 460
Compiling and Building Options......Page 462
Operations Use......Page 463
References......Page 465
A......Page 466
C......Page 467
D......Page 468
F......Page 469
H......Page 470
I......Page 471
M......Page 472
N......Page 473
P......Page 474
Q–R......Page 475
S......Page 476
T......Page 478
W–Z......Page 479