Intrusion detection isn’t just software—it means monitoring your network to discover attacks. Sometimes that infiltration comes from places you’d never expect.

Who's Lookin' At You?

Intrusion detection isn’t just software—it means monitoring your network to discover attacks. Sometimes that infiltration comes from places you’d never expect.

• By Roberta Bragg
• February 01, 2000

The process of monitoring a network with the goal of discovering an attack is called intrusion detection. It involves four basic efforts:

• Examining packets entering or traveling across your network for known attack patterns.
• Monitoring or comparing known sensitive areas (system files and registries) to known uncompromised snapshots.
• Evaluating network systems for evidence of compromised attack, such as promiscuous network cards or the existence of known executable files or services.
• Examining entry point systems such as mail servers and Web servers for the existence of viral agents, Trojans in email attachments, or Web page scripts.

You may want to install an intrusion detection product or a suite of them. Many products claim to be intrusion detection panaceas, and some are very good. This isn’t a review of them. Instead, I’ll provide an overview of the process of establishing and maintaining an intrusion detection system. Although I recommend that you purchase and install some kind of commercial system, merely doing that isn’t enough. You can’t rely on that system to always detect and stop attacks in progress or to find compromised systems. Intrusion detection systems aren’t products you set up and ignore. You must also respond to alerts, look for evidence of attacks the system failed to recognize, and constantly update it.

Source of Attacks

Where does your network connect to the external world? Through Internet access? Dial-out modems? Direct lines to business partners? Users log off their workstations at night and servers get secured, right? At major choke-points, host-type intrusion detection systems can be used. These systems protect a particular system from common types of attacks. Specialized systems scan email for viruses; monitor Web servers and generic systems; or look for critical file exploits, system file changes, system configuration changes, Trojan horses, buffer overflows, and registry modifications. The point here is to attempt to catch and thwart the attack just as it breaches your defenses. A good place for an intrusion detection system is between your firewall and your network.

Attacks can come from internal or external sources; external attacks may breach perimeter detection. Network intrusion detection systems are designed to look for suspicious activity on your network, including devices such as routers and switches. These systems look for things such as network cards set to promiscuous mode (explained shortly), abnormal amounts of traffic, and, by sampling packets on your network, attack patterns.

Types of Attacks

In addition to complex denial-of-service or penetration strikes (which require a sophisticated understanding of transport protocols at the packet level), consider the prospect of viral and Trojan horse attacks. A virus is code that changes something in your system; a Trojan horse masquerades as something innocent. Both can easily be attached to ordinary email. They rapidly infiltrate the network or arrive in software and, theoretically, attack our systems from Web pages with embedded scripts. Both often infiltrate our systems as a result of a little social engineering—the email attachment that masquerades as a game or the utility disk a friend passes along.

What to Protect

Primary points of attack in vulnerable systems include mail servers, Web servers, and other access paths to your network. Additional systems that may require scrutiny are servers with sensitive information. Is it realistic to protect every access point? Well, do you have locks on every window in your house? If you allow modems on desktop systems, place some kind of personal intrusion detection system on these workstations.

Set Up and Monitoring

The true value of intrusion detection systems is twofold. First, few of us know about all possible attacks and how to protect against them. A good intrusion detection system helps educate you, giving you a way to protect your systems without being a security guru. Second, the type and number of attacks can change constantly. Let the intrusion detection company be responsible for staying current on that. Choose a product that’s updateable and a company with the resources to constantly be on the lookout for new attack signatures.

This can include inexpensive products available to run on personal systems. Desktop anti-viral products are one such example. If these products are used religiously and updated regularly, they can reliably detect viral intrusions at the desktop level.

While a more sound approach may include some kind of system-level viral protection, such as an email scanner, this may not be possible for many small companies. One of the largest threats to systems administrator sanity in recent months has been the BackOrifice Trojan. Users can be tricked into installing the server side of this product on their machines, thereby allowing anyone with the BackOrifice client to administer the infected machine remotely. Most anti-viral agents can now locate and remove BackOrifice from systems; in addition, other products can act as a BackOrifice server and detect attempted connections to infected machines.

By the way, be sure to obtain training on the use of intrusion detection systems. Proper installation and management is essential. Any system will find false positives on occasion; you’ll need to know how to separate the true from the false.

Maintaining Vigilance

So your system’s up and you’re ready to respond. What next? I assume you’re taking steps already to protect yourself from attack, and that you’re monitoring alerts from your systems and know what to do. I’m even going to assume that you’re not relying on a single system but are using other tools as well. You’re also educating users on how to avoid manipulation, right? So can you relax now? To ensure the reliability of your intrusion detection system, start with the following steps.

• Ensure integrity—An intrusion detection system is a great big challenge to any hacker worth his salt. First, he knows you have something to protect. Second, if he can compromise the intrusion detection system, he thinks he’s home free. It’s like snipping the wires for the alarm system on the movie star’s house. Regularly ensure that your intrusion detection software hasn’t been compromised. Audit all critical systems files, especially operating system files, on a regular basis. Look for directory and files changes that can’t be accounted for. Some intrusion detection systems have such audit features.
• Continue auditing efforts—Regularly inspect all system logs and review notifications from system monitoring mechanisms. Look for unexpected behavior from processes. To do this, you need to understand the normal behavior of processes running on your systems. In a stable system, is a process suddenly creating access violations or shutting down? Is it not performing scheduled activities? Are there unknown processes running? (You should understand all processes running on your systems.)
• Question the existence of hardware—Was it always there? When was it installed? What’s it doing there? An additional hub where none should be can mean a rogue system. A small black box could be an office UPS system added by office personnel to protect a desktop system—or an unauthorized router connecting intruders or masking intrusions.
• Look for signs of unauthorized access—Look for things where they shouldn’t be. Suspect workstations that are turned on when employees are absent, especially if sick or on vacation.
• Review user reports of unusual events—Don’t pass off this good source of information as “stupid user events.” Users may not know intimate details of the system, but they usually know what’s normal activity for their software and hardware.
• Assume that someone has broken in—The objective of a software test is not to find that the software is flawless, but to find errors. The objective of intrusion detection is to find evidence of a break-in—before any system is compromised, one hopes, but realistically, after the fact. If you assume someone’s already in, you won’t stop in your relentless crusade to throw the bums out. All’s quiet on the intrusion detection system front? Use alternative tools and methodologies to look for evidence of successful attacks.

Finding, installing, and setting up good intrusion detection software doesn’t mean you can relax. Intrusion detection means much more. Remember to sniff packets for patterns, keep an eye on sensitive areas like the registry, evaluate network systems for evidence of comprised attacks, and continually monitor entrance points. As with all network security, you’ll need to continue eternal vigilance. Intrusion detection is merely another method of helping you monitor the gates.