computer intrusion

You asked ?if your job responsibilities were in the area of intrusion prevention? and it so happens that is one of the many areas of my job responsibilities, but I have many duties, so the top 5 are perhaps:

1. I do not want this responsibility to be eating into my total time to the point that it seriously impairs my abiltity to do the rest of my job. Fortunately management has aquired one of the types of computer systems that is particularly resistant to computer intrusion, such that we donot have to do a lot of the work that is native to other types of computers. However, we have placed software packages on it that do not work at the highest levels of computer security, so I do have some work to handle the gap.

2. There is the issue of what it is legal for a computer administrator to do to monitor the privacy of users ? capturing keystrokes, capturing screen images, recording a log of everything they did, as evidence of something they might have done wrong. When the user in question is innocent, this is inappropriate behavior, but when the user is an intruder it is appropriate for the purpose of gathering evidence, but how do we gain experience in this & where is it documented what we may & may not do so that we gather evidence that is appropriate to put a stop to the hacker, perhaps even get the hacker in jail, without we ourselves doing any action that is actionable or inappropriate? The details of what is doable vary with combination of operating system, and tools on the system, but the documentation I have seen is very generic in terms that are not relevant to many systems.

#1 Biggest challenge: Explaining to the boss why security is important. Most users see security as an obstacle to their work, and poorly planned security measures certainly can be. It is important to make the boss understand the potential cost and probability of an incident that hasn't happened yet. Security allows users to do their jobs because their data is safe, and that's a tough one to make users understand.

#2. User compliance. You can tell them what they should and shouldn't do, but it's tough to enforce. Our users did things they knew they shouldn't, because the boss wouldn't do anything to them after they were caught.

#3. Staff training. I haven't seen many organizations where the security guy didn't spend part of his time as the computer-fix-it guy. That's okay, but it means he won't be as good at either job, and that means risk on the security side.

#4. Policies. Your policies have to be clear and specific, but also reasonably short. If they're too long, nobody will read them, and if they're too complicated, nobody will understand them. Get the lawyers to review them, to ensure you'll be able to enforce (or ask the boss to enforce) the policy when someone breaks it.

#5. Tools. There are some greattools out there. Some are easier to use than others, and they're all expensive. We couldn't figure out SMS, so we bought Intel LANDesk to remotely manage our clients. We got our hands on a demo copy of ISS RealSecure, which allowed us to show the boss that we were under attack. He let us buy the real thing for real-time automated response, and ISS Internet Scanner for proacive assessment & inspections. There are other tools out there which do similar things, but I can't imagine getting the job done without such tools, and the resources to train with them.

Don

I have spent a year working on this & heard every argument possible. Most people think wrongly about intrusions. Recently I wrote a paper on this and published it.

Intrusive attacks are quite methodical. Hackers use 9 steps to attack a system. Intrusion prevention is only the first two steps that involve footprinting and probing then possibly a third step where they collect login account info. Beyond that they have already penetrated the network and are conducting more advanced activities. At that point you have failed to prevent the intrusion.

Also you need to look at the 11 types of probes or scans. Then using SNMP traps or other triggers automate alerts and blocking techniques. The blocking techniques will stall the intruders while you are alerted to the activity. However, the attack could occur slowly over months so you must keep a trend going and monitor for that type of attack as well. Also the attack could come so fast and furious that you do not have time to respond. ADDOS attack is automated and can occur in 5 seconds. within an hour the attackers can have 10000 zombie machines at thier disposal.

In short your five challenges are:

1. Identify your operating requirements through your ports.
2. Develop automated alerts and blocking techniques for your network config.
3. Keep years of history and routine plot for trends against time, ports, and services.
4. Isolate critical information and services using alternative protocols to TCP/IP
5. Establish a DMZ and trap the intruders in a honey pot or other decoy methods.

Defending the networks is very much like conventional warfare. You want to channelize, demoralize, defeat, and deny the enemy of his objectives while being in his face about it through tactic, skill, and agility. Do not worry so much about where he has been instead you should worry about where he is.

Some types of intrusion many people miss include the use of:

Emmanation
Threshold currents
BOTS
Cross scripting and Java attacks

Emmanation is the use of electromagnetic radiation to collect information from the systems. The monitors typically radiate as ANSI code sets are written to the phosphorous screen. This radiation can be collected and the display can be reconstructed in a parking lot van.

Threshold currents are a real threat. Keyboards are encoded with ASCII character sets sent via electrical signals to the CPU. These signals create 'noise' that goes out on the power lines and can be filtered for the key strokes. Also a creative virus can collect data from the system, encode it, and fire it out over the power supply in lieu of the NIC card. The data can then be collected elsewhere from a close by electric outlet on the same circuit.

BOTS are very effective and methodical data collection programs that have 'raped' entire databases of information. The U.S. SupremeCourt is hearing a case now.

Cross scripting and Java attacks are web based attacks used as delivery mechanisms for back doors and virus programs.

Many people simply do not understand the scope and legality of intrusions. this is Unfortunate.An enterprising techie could build a highly profitable business around this alone as the market is really wide open.

Check the eCommerce Discussion List at its sign-up page:

http://www.year2000.com/ecommerce

Select the archives ? click READ for latest & work backwards or fill in SEARCH with a word like ?Security? then click SEARCH to start at postings relevant to your Search. I posted ?Computer Security Myths? yesterday, which discussed Security hole in Win 9x, how to plug internet security holes on your PC, where to get DoD Security Standards document, and the reasons why I believe that it is a myth to believe that most enterprises are really interested in computer security. My post to the eCommerce Discussion List was far in excess of the TR message list limitations, which is why I am sharing the link here.