Chapter 8

Question 1

One of the most publicized threats to security is the ____

Answer 1

Intruder

Question 2

• Individuals or members of an organized crime group with a goal of financial reward

Answer 2

Intruders

Question 3

Intruders’ activities are

Answer 3

• identity theft
• theft of financial credentials
• corporate espionage
• data theft
• Data ransoming

Question 4

• are either individuals, usually working as insiders, or members of a larger group of outsider attackers, who are motivated by social or political causes
• also known as hacktivists (low skill level)
• aim of their attacks is often to promote and publicize their cause

Answer 4

Activists ( Class of Intruders )

Question 5

• groups of hackers sponsored by governments to conducts espionage or sabotage activities
• Also known as Advanced Persistent Threats (APTs) due to the covert nature and persistence over extended periods involved with any attacks in this class
• Widespread nature and scope of these activities by a wide range of countries

Answer 5

State-Sponsored Organization ( Class of Intruders )

Question 6

• hackers with minimal technical skill who primarily use existing attack
• they likely comprise the largest number of attackers, including many criminal and activist attackers
• Given their use of existing known tools, these attackers are the easiest to defend against
• also know as “script-kiddies” due to their existing scripts (tool)

Answer 6

Apprentice

Question 7

• Hackers with sufficient technical skills to modifyand extend attack toolkits to use newly discovered, or purchased, vulnerabilities
• They may be able to locate new vulnerabilities to exploit that are similar to some already known
• Hackers with suck skills are likely found in all intruder classes
• adapt tools for use by ohers

Answer 7

• Journeyman

Question 8

• Hackers with high-level technical skills capable of discovering brand new categories of vulnerabilities
• Write new powerful attack toolkits
• Some of the better known classical hackers are of this level
• some are employed by state-sponsored organizations
• defending against these attacks is of the highest difficulty

Answer 8

Master

Question 9

Examples of intrusion

Answer 9

Remote root compromise
Web server defacement
Guessing/cracking passwords
Copying databases containing credit card numbers
Viewing sensitive data without authorization
Running a packet sniffer
Distributing pirated software
Using an unsecured modem to access internal network
Impersonating an executive to get information
Using an unattended workstation

Question 10

intruder behaviour

Answer 10

• Target acquisition and information gathering
• Initial access
• Privilege escalation
• Information gathering or system exploit
• Maintaining access
• Covering tracks

Question 11

a security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts to gain, access to a system without having authorization

Answer 11

Security Intrusion

Question 12

A security service that monitors and analyzes system events for the purpose of finding, and providing real-time or near real-time warning of, attempts to access system resources in an authorized manner

Answer 12

• Intrusion Detection

Question 13

Kinds of Intrusion Detection System (IDS)

Answer 13

• Host-based IDS
• Network-based IDS
• Distributed or hybrid IDS

Question 14

Monitors the characteristics of a single host for suspicious activity

Answer 14

Host-based IDS

Question 15

Monitors network traffic and analyzes network, transport, and application protocols to identify suspicious activity

Answer 15

Network-based IDS

Question 16

Combines information from a number of sensors, often both host and network based, in a central analyzer that is able to better identify and respond to intrusion activity

Answer 16

Distributed or hybrid IDS

Question 17

Intrusion Detection System comprises three logical components

Answer 17

• Sensors (collect data)
• Analyzers (determine if intrusion has occurred)
• User-interface (view output or control system behaviour)

Question 18

IDS requirements

Answer 18

• Run continually
• Be fault tolerant
• Resist subversion
• Impose a minimal overhead on system
• Configured according to system security policies
• adapt to changes in systems and users
• Scale to monitor large numbers of systems
• Provide graceful degradation of service
• Allow dynamic reconfiguration

Question 19

• Involves the collection of data relating to the behavior of legitimate users over a period of time
• Current observed behavior is analyzed to determine whether this behavior is that of a legitimate user or that of an intruder

Answer 19

Anomaly approach

Question 20

• Uses a set of known malicious data patterns or attack rules that are compared with current behavior
• Also known as misuse detection
• Can only identify known attacks for which it has patterns or rules

Answer 20

Signature/Heuristic detection

Question 21

Analysis approach:

Answer 21

• Anomaly Approach

- Signature/Heuristic detection

Question 22

Anomaly Detection

Answer 22

• Statistical
• Knowledge-based
• Machine learning

Question 23

Analysis of the observed behavior using univariate, multivariate, or time-series models of observed metrics

Answer 23

• Statistical

Question 24

Approaches use an expert system that classifies observed behavior according to a set of rules that model legitimate behavior

Answer 24

Knowledge-based

Question 25

Approaches automatically determine a suitable classification model from the training data using data mining techniques

Answer 25

• Machine learning

Question 26

• Match a large collection of known patterns of malicious data against data stored on a system or in transit over a network
• The signatures need to be large enough to minimize the false alarm rate, while still detecting a sufficiently large fraction of malicious data
• Widely used in anti-virus products, network traffic scanning proxies, and in NIDS

Answer 26

Signature approaches

Question 27

• Involves the use of rules for identifying known penetrations or penetrations that would exploit known weaknesses
• Rules can also be defined that identify suspicious behavior, even when the behavior is within the bounds of established patterns of usage
• Typically rules used are specific
• SNORT is an example of a rule-based NIDS

Answer 27

Rule-based heuristic identification

Question 28

• Adds a specialized layer of security software to vulnerable or sensitive systems
• Can use either anomaly or signature and heuristic approaches
• Monitors activity to detect suspicious behavior

Answer 28

Host-Based Intrusion Detection (HIDS)

Question 29

fundamental component of intrusion detection is the sensor that collects data

Answer 29

Data Sources and Sensors

Question 30

Common data sources include:

Answer 30

System call traces
Audit (log file) records
File integrity checksums
Registry access