Intrusion Detection

Disgruntled Goat sent us a review of Intrusion Detection, a text sure to be of interest to all those working in organizations. The author is a former NSA employee and has written this book as a text to convince upper-level types of the need for security and actually paying attention to it. Click below to read more. Intrusion Detection author Rebecca Gurley Bace pages 339 publisher Macmillan Technical Publishing, o01/2000 rating 9/10 reviewer Disgruntled Goat, disgruntled_goat@hotmail.com ISBN 1-57870-185-6 summary Very good InfoSec handbook for suits and junior suits. The Scenario Security books, quite frankly, are pretty much a dime a dozen, most of which are written by people in IT field security. What immediately separates this book from the rest is the background of the author. Ms. Bace is an ex-government employee, spending 12 years in everyone's favorite spook organization, the National Security Agency. She led the Computer Misuse and Anonmaly Detection (CMAD) Research Program for six years at the NSA. She also collaborated on Computer Crime : A Crimefighter's Handbook by Dr. David Icove of the FBI. She also won the Distinguished Leadership Award in 1995 from the NSA.

What's Bad? This book is sort of dry reading. It's akin to reading college CS textbooks for pleasure. Or law books. What I didn't like is the fact that she wasn't real clear on the distinction of "hackers", nor how she describes them. She worries that "hackers" wish to "corrupt the trust process". And the focus for the book is not primarily for techies. It's designed for CIO smacking. Generally, if you're in an organization like mine, your CIO has very little technical background. So, good for CIO bashing.
And, it's $50 also.

What's Good? This is good if you're in a position where you need to convince management of security threats. It's also good for the kiddies who want to get an idea of what to look for when they're gunning for targets to disrupt.
What made this good for me was the fact that I could have points to show to management for InfoSec issues. I work in a hospital and we tend to attract a large amount of famous people as patients. If something damaging was leaked to the media about a famous person's medical condition that was potentially embarassing, we're looking at a good multi-million dollar lawsuit. This book isn't a by-the-book "How to protect your systems", but more of a book on what to safeguard, and how to detect patterns that may indicate patterns of unauthorized usage.
One of the things that I liked was the chapter on Legal Issues. One of the sections in the chapter was "What Real Cases Have Taught Us". It did a few page review on Mitnick's case, cut and dry. It shows that Shimomura was no rocket scientist, and with cooperation from the courts, you can bust almost anyone. But it did bring up several good points, such as obtaining court orders, how laws work, and how it can be considered evidence.

So What's In It For Me? If you're a script kiddie, probably nothing. But for those who are achin' to topple some network, this may be for you.

For those with functioning brains who have vested interests in InfoSec and protecting their organization from people who wish to do harm, and getting real security info, rather than from those half-assed "Security Experts" like JohnP, then pick this up.

Pick this book up at ThinkGeek.

Table of Contents

1. The History of Intrusion Detection
2. Concepts and Definitions
3. Information Sources
4. Analysis Schemes
5. Responses
6. Vulnerability Analysis: A Special Case
7. Technical Issues
8. Understanding the Real-World Challenge
9. Legal Issues
10. For Users
11. For Strategists
12. For Designers
13. Future Needs

Comments

whois nsa.gov

[dattaway]

TCP connection to 'www.nsa.gov' failed, No Such Agency?

Re:Intrusion Detection - An Analysts' Approach

[n3rd]

I know this isn't exactly what you're looking for, but I purchased a copy of O'Reilly's book Practical UNIX and Internet Security 2nd Edition and have found it to be very useful. This book covers almost everything (accounts, passwords, auditing, logging, backups, physical security, file system, etc etc etc) and is well written (I expect no less from ORA). I also purchased a copy of the book you are referring to, and even though it was not very well written, the "real world" examples of TCP/IP and UDP/IP attacks were a good way to put all I knew about TCP/IP in theory into real world situations. Oh yeah, and from the book, I also know how to disconnect people from IRC now (love them RSTs!).

Deception ToolKit

[MinaInerz]

One the more interesting Intrusion Detection concepts I've seen in recent times is the Deception ToolKit. What this program does is "fakes" a bunch of commonly exploited security holes on your system - even though those holes aren't actually there. This is could prove to be very good at catchin script kiddies who run sendmail break-in scripts, etc. A very interesting concept, indeed - I don't know how well it works, though. Anybody out there with any opinions on this piece of software?


Dear IRS,
I am writing to you to cancel my subscription.

Re:Deception ToolKit

[Jonathan White]

The concept is not new, it's called a honeypot. It allows you to trick the attacker into thinking he found a weakness.

There are many ways to respond after the attacker tries to exploit it. One of the more common is to log whatever info you can get and try to pursue him.

It's main usefulness with script kiddies lies in that the attacker will be off trying to figure out wtf is wrong with his shellcode while you have the FBI kick in his door.

However against more organized attacks from more powerful entities (governments, corporations) it can only serve as an obfuscator and an early warning system.

Computer Security by Gov't

[witchking]

Having read Clifford Stoll's book (The Cuckoo's Egg) I believe that government employees suffer a credibility problem when discussing computer security issues. In his book, Stoll describes the arrogance of government staff who would not take him seriously when he detailed the security breaches he had found. Although I haven't read the book being reviewed here, I would also highly recommend Stoll's book to those who are interested in this issue (IMHO).

Re:Computer Security by Gov't

[dingbat_hp]

That's the problem with Stoll's approach. He starts with a minute error and insists that it's a consequence of something untoward.

These days we all work on Web Time. If it's not done and dusted by Monday, it will be obsolete by Tuesday. No-one has the time to chase pennies. Even individual fraudsters aren't hunted down - I've met ecomm retailers who simply couldn't chase single frauds and would only go after something that looked like a volume syndicate. For the one-offs, the only thing they had the time and money to cope with was letting the item be shipped and then swallow the back-charge from the cc company. RealShopping outlets have taken a similar line for years - they just accept a certain level of stock wastage.

There's also the volume issue. In Stoll's day a hack attempt was done by a hacker who created the tools himself. Now we're drowned under a barrage of dull script kiddies and bad NT holes. It's a panic out there ! I'd regard a serious probe from a skilled old-school hacker as a welcome and interesting diversion.

Hacker/cracker - we lost that argument. Get over it.

Re:VIIDS

[DoomHaven]

I am assuming that you think IDS (intrusion detection systems) are "physical" intrusion detection systems (meaning that they detect someone physically trespassing on the premise) instead of "network" intrusion detection systems (that they detect crackers "trepassing" on the premise's network). So, just to clarify, we are talking about "electronic" intrusions here, okay?

Just to toss out a couple half decent links on intrusion detection systems, for those who are interested:

This is a good link that compares a few commerical network IDSs
This is a shitty test suite for network IDSs

Damn, I thought I had more. Oh well, enjoy!

The author is well connected

[griffjon]

I met her briefly at RSA2000 (...and got a signed copy, heh.) (should I ebay it?).

Anyway, when I met her, Peter Neumann (yes, /that/ Peter Neumann, borrowed my copy to flip through and see the references to him and to check the TOC for topics covered. He seemed pleased... I haven't had time to read the book yet, though I've flipped through and seen various references to SATAN and similar...

Intrusion Detection

[sss12]

If you really want to learn how to secure your network, learn how to break in to one. If you aren't interested enough to learn this highly versatile skill, you are in the wrong industry and your company is allowing the wrong people to make their security decisions for them.

PHB's and security...

[jburroug]

Ack. Recently during a department meeting our security guy was explaining to our PHB the steps he has taken to protect our general purpose internet server (web, ftp, email primairly) He told her about how we use ipchains firewall rules to protect the system and started talking about the IDS we recently installed (portsentry by Psionic Software which is some pretty impressive softare, and it's GPL'd) and how it responds to a portscan, which is to drop the route to the attacker completely by appending the ipchains ruleset. She initially told him to remove portsentry and the firewall rules because she "didn't like the idea of denying anyone access to our resources"
I think a book like this could be very useful in such situations when the person in charge simply doesn't grasp the basic principles of network security (or really networks in general.) And if reading it doesn't help it sounds big and heavey enough to be used as an effective LART. ;->

Re:PHB's and security...

[Kaa]

and how it [portsentry] responds to a portscan, which is to drop the route to the attacker completely by appending the ipchains ruleset.

Not to defend your PHB, but a lot of people consider this to be a misfeature. The problem is with DOS by spoofed attacks. If you don't want host B to talk to host A and A is running portsentry, just spoof attack from B to A.

Nmap, for example, has an option to spoof attack source and warns about the potential side effects on portsentry.

Kaa

InfoSec

[348]

I thought the review was right on. I've read the book also and the biggest problem I have is convincing senior management that information security is paramount and should be treated as such. This book helped me a lot in this effort, it brought me from port level scanning conversations and helped me make the communication much more generic in terms that my management understood.

The main InfoSec problem out there today is that the people who control where the IT money is spent, don't always understand the risks associated with ignoring or cutting back on proactive security measures. This book gave me a different way to present. I'd strongly recommend it to both InfoSec folks as well at senior IT management.

Never knock on Death's door:

Intrusion detection software:

[Last Warrior]

If you are considering investing in intrusion detection software, there are a number of drawbacks that you should be aware of before you rely too heavily on these security methods.

1. IDS systems are notorious for dropping packets. Attacks to your network can be missed when the bandwith utilization on your network exceeds a certain percentage. Many IDS systems are only reliable in this fashion up to 10Mb connections.

2. Intrusion detection programs generally will not reorder packets. Any attacks with fragmented packets, out of order packets, and so on will often slip by without being detection. This is also a good way to penetrate a firewall packet filtering rule that does not reorder/reassemble packets.

3. IDS systems tend uto use a string matching algorithm to detect network attacks ( such as a phf or php ) and variances in the attack string can also potentially bypass the IDS without generating an event.

An intrusion detection system is a good tool to top off your networks security policy.. It should not replace human intervention or other security measures including a firewall and proactive network scanning.

LW