Slashdot Mirror
Intrusion Detection
Disgruntled Goat sent us a review of Intrusion Detection, a text sure to be of interest to all those working in organizations. The author is a former NSA employee and has written this book as a text to convince upper-level types of the need for security and actually paying attention to it. Click below to read more.
Intrusion Detection
author
Rebecca Gurley Bace
pages
339
publisher
Macmillan Technical Publishing, o01/2000
rating
9/10
reviewer
Disgruntled Goat, disgruntled_goat@hotmail.com
ISBN
1-57870-185-6
summary
Very good InfoSec handbook for suits and junior suits.
The Scenario
Security books, quite frankly, are pretty much a dime a dozen, most of which are
written by people in IT field security. What immediately separates this book from
the rest is the background of the author. Ms. Bace is an ex-government employee,
spending 12 years in everyone's favorite spook organization, the National Security Agency. She led the Computer Misuse
and Anonmaly Detection (CMAD) Research Program for six years at the NSA. She also collaborated
on Computer Crime : A Crimefighter's Handbook by Dr. David Icove of the FBI. She also won the Distinguished Leadership Award in 1995 from the NSA.
And, it's $50 also.
What made this good for me was the fact that I could have points to show to management for InfoSec issues. I work in a hospital and we tend to attract a large amount of famous people as patients. If something damaging was leaked to the media about a famous person's medical condition that was potentially embarassing, we're looking at a good multi-million dollar lawsuit. This book isn't a by-the-book "How to protect your systems", but more of a book on what to safeguard, and how to detect patterns that may indicate patterns of unauthorized usage.
One of the things that I liked was the chapter on Legal Issues. One of the sections in the chapter was "What Real Cases Have Taught Us". It did a few page review on Mitnick's case, cut and dry. It shows that Shimomura was no rocket scientist, and with cooperation from the courts, you can bust almost anyone. But it did bring up several good points, such as obtaining court orders, how laws work, and how it can be considered evidence.
For those with functioning brains who have vested interests in InfoSec and protecting their organization from people who wish to do harm, and getting real security info, rather than from those half-assed "Security Experts" like JohnP, then pick this up.
What's Bad? This book is sort of dry reading. It's akin to reading college CS textbooks for pleasure. Or law books. What I didn't like is the fact that she wasn't real clear on the distinction of "hackers", nor how she describes them. She worries that "hackers" wish to "corrupt the trust process". And the focus for the book is not primarily for techies. It's designed for CIO smacking. Generally, if you're in an organization like mine, your CIO has very little technical background. So, good for CIO bashing.
And, it's $50 also.
What's Good? This is good if you're in a position where you need to convince management of security threats. It's also good for the kiddies who want to get an idea of what to look for when they're gunning for targets to disrupt.
What made this good for me was the fact that I could have points to show to management for InfoSec issues. I work in a hospital and we tend to attract a large amount of famous people as patients. If something damaging was leaked to the media about a famous person's medical condition that was potentially embarassing, we're looking at a good multi-million dollar lawsuit. This book isn't a by-the-book "How to protect your systems", but more of a book on what to safeguard, and how to detect patterns that may indicate patterns of unauthorized usage.
One of the things that I liked was the chapter on Legal Issues. One of the sections in the chapter was "What Real Cases Have Taught Us". It did a few page review on Mitnick's case, cut and dry. It shows that Shimomura was no rocket scientist, and with cooperation from the courts, you can bust almost anyone. But it did bring up several good points, such as obtaining court orders, how laws work, and how it can be considered evidence.
So What's In It For Me? If you're a script kiddie, probably nothing. But for those who are achin' to topple some network, this may be for you.
For those with functioning brains who have vested interests in InfoSec and protecting their organization from people who wish to do harm, and getting real security info, rather than from those half-assed "Security Experts" like JohnP, then pick this up.
Pick this book up at ThinkGeek.
Table of Contents- The History of Intrusion Detection
- Concepts and Definitions
- Information Sources
- Analysis Schemes
- Responses
- Vulnerability Analysis: A Special Case
- Technical Issues
- Understanding the Real-World Challenge
- Legal Issues
- For Users
- For Strategists
- For Designers
- Future Needs
TCP connection to 'www.nsa.gov' failed, No Such Agency?
the post anonymous button would be nice right now...
anyway, VIIDS = visual imagery and intrusion detection systems: ie. my current job. (yes, also government)
this much i will tell you, the majority of the equipment used (and i don't know about NSA) but for priority A and B resources (being Nucelar Weapons and Armed Fighters/Weapons Storage areas, etc.) DO NOT have all that hi-tech junk you see on tv. up until recently our annunciator system was a hunk of metal developed by the navy back in the 60-70's. the rest is mainly motion detectors, sensors, etc.
These aren't used so much to prevent ppl from getting in, but also to deter admitance. (Don't worry though, should u get in, there are cops in there still who have full athority to shoot you). In fact almost daily i see a sign that states "Use of Deadly Force is Authorized".
As far as if you were to try and hack the computer annunciator systems, well, first you'd have to get access to them, they're not on an outside network, so good luck there.
basically, if someone once this stuff bad enough, they can get it. It will however take them alot of work, and also would result in probably a lot of damage to the equipment to get it out of the area.
to all the would be's who think they want to try, good luck, and i hope you can run fast cuz i'll shoot your ass too.
I recently bought this (different book, same topic) after seeing it recommended strongly on Amazon by one of these "security analysts". However, it covered some old stuff (Mitnick for crying out loud!) as well as gave a general read around of various topics, but it wasn't really what I was hoping for (something more practical would be nice). Yes, my day job is a security researcher, but this was bought outside of that. If anyone can find a practical guide to unix security or unix intrusion detection that wasn't written before 1999 that's actually useful (not A Hacker's Guide To Protecting Your Network, by Anonymous, or whatever its called) please let me know.
One the more interesting Intrusion Detection concepts I've seen in recent times is the Deception ToolKit. What this program does is "fakes" a bunch of commonly exploited security holes on your system - even though those holes aren't actually there. This is could prove to be very good at catchin script kiddies who run sendmail break-in scripts, etc. A very interesting concept, indeed - I don't know how well it works, though. Anybody out there with any opinions on this piece of software?
Dear IRS,
I am writing to you to cancel my subscription.
Network Intrusion Detection: An Analyst's Handbook
by Stephen Northcutt
ISBN: 0735708681
Excellent book on intrusion detection.
Having read Clifford Stoll's book (The Cuckoo's Egg) I believe that government employees suffer a credibility problem when discussing computer security issues. In his book, Stoll describes the arrogance of government staff who would not take him seriously when he detailed the security breaches he had found. Although I haven't read the book being reviewed here, I would also highly recommend Stoll's book to those who are interested in this issue (IMHO).
"Ever get the feeling you've been cheated?" - John Lydon, San Francisco 1978
I met her briefly at RSA2000 (...and got a signed copy, heh.) (should I ebay it?).
/that/ Peter Neumann, borrowed my copy to flip through and see the references to him and to check the TOC for topics covered. He seemed pleased... I haven't had time to read the book yet, though I've flipped through and seen various references to SATAN and similar...
Anyway, when I met her, Peter Neumann (yes,
Returned Peace Corps IT Volunteer
If you really want to learn how to secure your network, learn how to break in to one. If you aren't interested enough to learn this highly versatile skill, you are in the wrong industry and your company is allowing the wrong people to make their security decisions for them.
Title: Maximum Linux Security
Publisher: SAMS Publishing
Author: Anonymous
ISBN: 0-672-31670-6
LOCCCN: 99-61434
First Printing: September 1999
Pages: 743
Micro-Review: Definitely worth buying, reading, and implementing.
Ack. Recently during a department meeting our security guy was explaining to our PHB the steps he has taken to protect our general purpose internet server (web, ftp, email primairly) He told her about how we use ipchains firewall rules to protect the system and started talking about the IDS we recently installed (portsentry by Psionic Software which is some pretty impressive softare, and it's GPL'd) and how it responds to a portscan, which is to drop the route to the attacker completely by appending the ipchains ruleset. She initially told him to remove portsentry and the firewall rules because she "didn't like the idea of denying anyone access to our resources" ;->
I think a book like this could be very useful in such situations when the person in charge simply doesn't grasp the basic principles of network security (or really networks in general.) And if reading it doesn't help it sounds big and heavey enough to be used as an effective LART.
"Listen: We are here on Earth to fart around. Don't let anybody tell you any different!" - Kurt Vonnegut
The main InfoSec problem out there today is that the people who control where the IT money is spent, don't always understand the risks associated with ignoring or cutting back on proactive security measures. This book gave me a different way to present. I'd strongly recommend it to both InfoSec folks as well at senior IT management.
Never knock on Death's door:
More race stuff in one place,
than any one place on the net.
Here's some facts about the NSA in google's cache. It also talks about its yearly electrical use --ever see small buildings with a massive underground network with massive electrical feeds? What do they do in there? Maryland seems like a spooky place to live.
There are lots of things that are a secret. They would tell you, but they'd have to kill you.
I've read this book, and the review is dead on in my opinion. It's a nice general overview of the subject matter, and like a college textbook or stereo instruction manual, it reads very dry. I'd suggest it to people with no real knowledge of the world of security as a realistic look on the problems that need to be tackled. However this book is in no ways a way to be taught how to solve said problems.
1. IDS systems are notorious for dropping packets. Attacks to your network can be missed when the bandwith utilization on your network exceeds a certain percentage. Many IDS systems are only reliable in this fashion up to 10Mb connections.
2. Intrusion detection programs generally will not reorder packets. Any attacks with fragmented packets, out of order packets, and so on will often slip by without being detection. This is also a good way to penetrate a firewall packet filtering rule that does not reorder/reassemble packets.
3. IDS systems tend uto use a string matching algorithm to detect network attacks ( such as a phf or php ) and variances in the attack string can also potentially bypass the IDS without generating an event.
An intrusion detection system is a good tool to top off your networks security policy.. It should not replace human intervention or other security measures including a firewall and proactive network scanning.
LW
It's not GPL'd... it's free for non-commercial use.
Is it just my connection, or did we /. the NSA web site?
very informative post there.
Also, there's a fundamental problem with all of these honeypot systems. Say you're running a web server, no ssl or any weird stuff, and have locked it down to JUST port 80. You get portscanned, maybe a kiddie devotes a few seconds trying the best port-80 hacks.
OTOH, you have a honeypot or port listener running, and you pop up like a glowing beacon in the night as, well, a honeypot worthy of much, much attention.
Of course if your server's already a mound of tantalizing open ports, the loss in making it (look) more attractive are less in comparison with being able to capture kiddies, or at least scare them with lawyers.
Returned Peace Corps IT Volunteer
http://bejtlich.home.texas.net/intv2-1.txt
The author takes a different view on some of Stephen Northcutt's analysis, especially regarding reset scans. (He says they don't really exist.)
Is that based on an earlier book called "Maximum Security" also published by SAMS and written by anon?
If so, then what are the differences? I've got a copy of "Maximum Security" and it's great.
--
Simon
The cool thing is that the only product that could do both (BlackICE Sentry) is also available as a $40 personal version (BlackICE Defender) that you can install on your own (Windoze) machine. It includes a personal firewall to boot and is really easy to use. It also has extensive anti-evasion technique to solve problem number 3 that you mention. Go to networkice.com and download a copy of it if you don't believe me.
You should check out the IDS FAQ. It has tones of easy to understand, but technical information. The site has a bunch of other infosec information.
So while it has it's uses, it's not much good if you have downloaded a trojaned program from Jo Bloggs quick and dirty software archive.
I'm not saying that this makes it useless - just that if you install it, you shouldn't allow yourself to develop a false sense of security.
For real security, why mess with traditional ACL systems (UNIX, Windows, etc)?
REAL security can only be achieved with PURE capability systems.
EROS-OS implements a HIGH-PERFORMANCE pure capability system as a research project. This is the direction OS's should be going for real security, AND performance, too.