Intrusion Detection

Disgruntled Goat sent us a review of Intrusion Detection, a text sure to be of interest to all those working in organizations. The author is a former NSA employee and has written this book as a text to convince upper-level types of the need for security and actually paying attention to it. Click below to read more. Intrusion Detection author Rebecca Gurley Bace pages 339 publisher Macmillan Technical Publishing, o01/2000 rating 9/10 reviewer Disgruntled Goat, disgruntled_goat@hotmail.com ISBN 1-57870-185-6 summary Very good InfoSec handbook for suits and junior suits. The Scenario Security books, quite frankly, are pretty much a dime a dozen, most of which are written by people in IT field security. What immediately separates this book from the rest is the background of the author. Ms. Bace is an ex-government employee, spending 12 years in everyone's favorite spook organization, the National Security Agency. She led the Computer Misuse and Anonmaly Detection (CMAD) Research Program for six years at the NSA. She also collaborated on Computer Crime : A Crimefighter's Handbook by Dr. David Icove of the FBI. She also won the Distinguished Leadership Award in 1995 from the NSA.

What's Bad? This book is sort of dry reading. It's akin to reading college CS textbooks for pleasure. Or law books. What I didn't like is the fact that she wasn't real clear on the distinction of "hackers", nor how she describes them. She worries that "hackers" wish to "corrupt the trust process". And the focus for the book is not primarily for techies. It's designed for CIO smacking. Generally, if you're in an organization like mine, your CIO has very little technical background. So, good for CIO bashing.
And, it's $50 also.

What's Good? This is good if you're in a position where you need to convince management of security threats. It's also good for the kiddies who want to get an idea of what to look for when they're gunning for targets to disrupt.
What made this good for me was the fact that I could have points to show to management for InfoSec issues. I work in a hospital and we tend to attract a large amount of famous people as patients. If something damaging was leaked to the media about a famous person's medical condition that was potentially embarassing, we're looking at a good multi-million dollar lawsuit. This book isn't a by-the-book "How to protect your systems", but more of a book on what to safeguard, and how to detect patterns that may indicate patterns of unauthorized usage.
One of the things that I liked was the chapter on Legal Issues. One of the sections in the chapter was "What Real Cases Have Taught Us". It did a few page review on Mitnick's case, cut and dry. It shows that Shimomura was no rocket scientist, and with cooperation from the courts, you can bust almost anyone. But it did bring up several good points, such as obtaining court orders, how laws work, and how it can be considered evidence.

So What's In It For Me? If you're a script kiddie, probably nothing. But for those who are achin' to topple some network, this may be for you.

For those with functioning brains who have vested interests in InfoSec and protecting their organization from people who wish to do harm, and getting real security info, rather than from those half-assed "Security Experts" like JohnP, then pick this up.

Pick this book up at ThinkGeek.

Table of Contents

1. The History of Intrusion Detection
2. Concepts and Definitions
3. Information Sources
4. Analysis Schemes
5. Responses
6. Vulnerability Analysis: A Special Case
7. Technical Issues
8. Understanding the Real-World Challenge
9. Legal Issues
10. For Users
11. For Strategists
12. For Designers
13. Future Needs

Comments

Re:Intrusion Detection - An Analysts' Approach

[n3rd]

I know this isn't exactly what you're looking for, but I purchased a copy of O'Reilly's book Practical UNIX and Internet Security 2nd Edition and have found it to be very useful. This book covers almost everything (accounts, passwords, auditing, logging, backups, physical security, file system, etc etc etc) and is well written (I expect no less from ORA). I also purchased a copy of the book you are referring to, and even though it was not very well written, the "real world" examples of TCP/IP and UDP/IP attacks were a good way to put all I knew about TCP/IP in theory into real world situations. Oh yeah, and from the book, I also know how to disconnect people from IRC now (love them RSTs!).

Deception ToolKit

[MinaInerz]

One the more interesting Intrusion Detection concepts I've seen in recent times is the Deception ToolKit. What this program does is "fakes" a bunch of commonly exploited security holes on your system - even though those holes aren't actually there. This is could prove to be very good at catchin script kiddies who run sendmail break-in scripts, etc. A very interesting concept, indeed - I don't know how well it works, though. Anybody out there with any opinions on this piece of software?


Dear IRS,
I am writing to you to cancel my subscription.

Re:Deception ToolKit

[Jonathan White]

The concept is not new, it's called a honeypot. It allows you to trick the attacker into thinking he found a weakness.

There are many ways to respond after the attacker tries to exploit it. One of the more common is to log whatever info you can get and try to pursue him.

It's main usefulness with script kiddies lies in that the attacker will be off trying to figure out wtf is wrong with his shellcode while you have the FBI kick in his door.

However against more organized attacks from more powerful entities (governments, corporations) it can only serve as an obfuscator and an early warning system.

Re:VIIDS

[DoomHaven]

I am assuming that you think IDS (intrusion detection systems) are "physical" intrusion detection systems (meaning that they detect someone physically trespassing on the premise) instead of "network" intrusion detection systems (that they detect crackers "trepassing" on the premise's network). So, just to clarify, we are talking about "electronic" intrusions here, okay?

Just to toss out a couple half decent links on intrusion detection systems, for those who are interested:

This is a good link that compares a few commerical network IDSs
This is a shitty test suite for network IDSs

Damn, I thought I had more. Oh well, enjoy!

Re:PHB's and security...

[Kaa]

and how it [portsentry] responds to a portscan, which is to drop the route to the attacker completely by appending the ipchains ruleset.

Not to defend your PHB, but a lot of people consider this to be a misfeature. The problem is with DOS by spoofed attacks. If you don't want host B to talk to host A and A is running portsentry, just spoof attack from B to A.

Nmap, for example, has an option to spoof attack source and warns about the potential side effects on portsentry.

Kaa

Intrusion detection software:

[Last Warrior]

If you are considering investing in intrusion detection software, there are a number of drawbacks that you should be aware of before you rely too heavily on these security methods.

1. IDS systems are notorious for dropping packets. Attacks to your network can be missed when the bandwith utilization on your network exceeds a certain percentage. Many IDS systems are only reliable in this fashion up to 10Mb connections.

2. Intrusion detection programs generally will not reorder packets. Any attacks with fragmented packets, out of order packets, and so on will often slip by without being detection. This is also a good way to penetrate a firewall packet filtering rule that does not reorder/reassemble packets.

3. IDS systems tend uto use a string matching algorithm to detect network attacks ( such as a phf or php ) and variances in the attack string can also potentially bypass the IDS without generating an event.

An intrusion detection system is a good tool to top off your networks security policy.. It should not replace human intervention or other security measures including a firewall and proactive network scanning.

LW