IDSIPS and Mitigating Technologies for Endpoint Threats Intrusion

IDS/IPS and Mitigating Technologies for Endpoint Threats

Intrusion Detection Systems (IDSs) 1. An attack is launched on a network that has a sensor deployed in promiscuous IDS mode; therefore copies of all packets are sent to the IDS sensor for packet analysis. However, the target machine will experience the malicious attack. 2. The IDS sensor, matches the malicious traffic to a signature and sends the switch a command to deny access to the source of the malicious traffic. 3. The IDS can also send an alarm to a management console for logging and other management purposes. Switch 1 2 Sensor 3 Management Console Target

Intrusion Prevention Systems (IPSs) 1 1. An attack is launched on a network that has a sensor deployed in IPS mode (inline mode). 2. The IPS sensor analyzes the packets as they enter the IPS sensor interface. The IPS sensor matches the malicious traffic to a signature and the attack is stopped immediately. 3. The IPS sensor can also send an alarm to a management console for logging and other management purposes. 4. Traffic in violation of policy can be dropped by an IPS sensor. 2 4 Sensor Bit Bucket 3 Management Console Target

IDS vs IPS

IDS vs IPS (2)

IDS vs IPS (3)

Network-Based Implementation CSA MARS VPN Remote Worker Firewall VPN IPS CSA VPN Remote Branch Iron Port CSA Web Server Email Server DNS CSA

Host-Based Implementation CSA MARS VPN Management Center for Cisco Security Agents Remote Worker Firewall VPN IPS CSA VPN Remote Branch Agent Iron Port CSA CSA Web Server Email Server DNS CSA

Cisco Security Agent Corporate Network Application Server Agent Firewall Untrusted Network Agent SMTP Server Agent Web Server DNS Server Management Center for Cisco Security Agents video

Comparing HIPS and Network IPS Advantages § Is host-specific § Protects host after decryption HIPS § Provides application-level encryption protection § Is cost-effective § Not visible on the network Network § Operating system independent IPS § Lower level network events seen Disadvantages § Operating system dependent § Lower level network events not seen § Host is visible to attackers § Cannot examine encrypted traffic § Does not know whether an attack was successful

IDS/IPS Platforms

IDS/IPS Selection Factors • Factors that impact a sensor selection and deployment: • • Amount of network traffic Network topology Security budget Available security staff • Size of implementation • Small (branch offices) • Large • Enterprise

Understanding Triggers • False Positive – triggered but traffic is not malicious or important to the safety of the network • False Negative – malicious traffic but no trigger • True Positive – malicious traffic detected and sensor triggered (IDS – report, IPS – drop/block) • True Negative – normal traffic and no trigger (normal behavior)

Identifying Malicious Traffic on the Network Advantages Disadvantages Signaturebased Detection • Easy configuration • No detection of unknown signatures • Fewer false positives • Initially a lot of false positives • Good signature design • Signatures must be created, updated, and tuned Anomalybased Detection • Simple and reliable • Generic output • Customized policies • Policy must be created Policy-based Detection • Easy configuration • Can detect unknown attacks • Window to view attacks Honey Pot. Based Detection • Difficult to profile typical activity in large networks • Traffic profile must be constant • Dedicated honey pot server • Distract and confuse attackers • Honey pot server must not be trusted • Slow down and avert attacks • Collect information about attack

Possible Responses

Which Actions the Sensors Should Take • Become laborious as the number of signatures kept increasing – track and manage the individual actions for each signature • Solutions? • Let the sensor consider how significant the risk is and take appropriate actions. How? • Risk rating

Risk Rating Calculation Factors

Circumventing and IDS/IPS

Cisco IPS Solutions • Locally Managed Solutions: • Cisco Router and Security Device Manager (SDM) • Cisco IPS Device Manager (IDM) • Centrally Managed Solutions: • Cisco IDS Event Viewer (IEV) • Cisco Security Manager (CSM) • Cisco Security Monitoring, Analysis, and Response System (MARS)

Cisco Router and Security Device Manager Monitors and prevents intrusions by comparing traffic against signatures of known threats and blocking the traffic when a threat is detected Lets administrators control the application of Cisco IOS IPS on interfaces, import and edit signature definition files (SDF) from Cisco. com, and configure the action that Cisco IOS IPS is to take if a threat is detected

Cisco IPS Device Manager • A web-based configuration tool • Shipped at no additional cost with the Cisco IPS Sensor Software • Enables an administrator to configure and manage a sensor • The web server resides on the sensor and can be accessed through a web browser

Cisco IPS Event Viewer • View and manage alarms for up to five sensors • Connect to and view alarms in real time or in imported log files • Configure filters and views to help you manage the alarms. • Import and export event data for further analysis.

Cisco Security Manager • Powerful, easy-to-use solution to centrally provision all aspects of device configurations and security policies for Cisco firewalls, VPNs, and IPS • Support for IPS sensors and Cisco IOS IPS • Automatic policy-based IPS sensor software and signature updates • Signature update wizard

Cisco Security Monitoring Analytic and Response System • An appliance-based, allinclusive solution that allows network and security administrators to monitor, identify, isolate, and counter security threats • Enables organizations to more effectively use their network and security resources. • Works in conjunction with Cisco CSM.

Mitigation Technologies for Endpoint Threats

Layered Defense Scenario Endpoint security: Provides identity and device security policy compliance Communications security: Provides information assurance Perimeter security: Secures boundaries between zones Network Core network security: Protects against malicious software and traffic anomalies, enforces network policies, and ensures survivability Disaster recovery: Offsite storage and redundant architecture

Most Common Types of Malicious Software • Computer viruses • Worms • Mailers and massmailer warms • Logic bombs • Trojan horses • Back doors • Exploits • Downloaders • Spammers • Key loggers • Rootkits • Ransomware

Hardware and Software Encryption for Endpoint Data • Email encryption

Encrypting Endpoint Data at Rest