Intrusion Detection Flashcards
Intrusion detection is based on the assumption that the behavior of the intruder differs from that of a legitimate user in ways that can be quantified. (T/F)
True
o be of practical use an IDS should detect a substantial percentage of intrusions while keeping the false alarm rate at an acceptable level. (T/F)
True
An inline sensor monitors a copy of network traffic; the actual traffic does not pass through the device.(T/F)
False
A common location for a NIDS sensor is just inside the external firewall.(T/F)
True
Network-based intrusion detection makes use of signature detection and anomaly detection.(T/F)
True
A _______ monitors the characteristics of a single host and the events occurring within that host for suspicious activity.
host-based IDS
_______ involves an attempt to define a set of rules or attack patterns that can be used to decide if a given behavior is that of an intruder.
Signature detection
_______ involves the collection of data relating to the behavior of legitimate users over a period of time.
Anomaly detection
A(n) ______ is inserted into a network segment so that the traffic that it is monitoring must pass through the sensor.
inline sensor
The ______ is the IDS component that examines the data collected by the sensor for signs of unauthorized or undesired activity or for events that might be of interest to the security administrator.
analyzer
Intrusion Defined
any attack that aims to compromise the security goals of an organization
Intrusion Examples
• Performing a remote root compromise of an e-mail server
• Defacing a Web server with inappropriate web contents
• Guessing and cracking passwords
• Stealing a database containing credit card numbers
• Reading sensitive data, including payroll records and medical information,
without authorization
• Running a packet sniffer on a workstation to capture usernames and passwords
• Using a permission error on an anonymous FTP server to distribute pirated
software and music files
• Dialing into an unsecured modem and gaining internal network access
• Posing as an executive, calling the help desk, resetting the executive’s e-mail
password, and learning the new password
• Using an unattended, logged-in workstation without permission
Firewalls distinguished from IDS
Firewalls and IDS’s are both part of a network security system. A firewall is designed to prevent an intrusion and an IDS is designed to detect an intrusion.
F - tries to stop intrusion from happening
I - tries to evaluate an intrusion after it has happened
I -watches for intrusions that start within the system
F -limits access between networks to prevent intrusion
Classes of Intruders
Cyber criminals
Activists
State-sponsored organizations
Other
Intruder skill levels
Apprentice
Journeyman (sfficient to modify and extend attack toolkits)
Master (high level skill, discovering new categories of vulnerabilities, writing new attack toolkits)
intruders typically use steps from a common attack methodology
Target Acquisition and Information Gathering:
- -that is, the attacker identifies and characterizes the target systems using publicly available information, both technical and non-technical, and use network exploration tools to map target resources.
- -Initial Access: this is typically accomplished by exploiting a remote network vulnerability, e.g., by guessing weak authentication credentials used in a remote service, or via the installation of malware on the system using some form of social engineering or drive-by-download.
• Privilege Escalation:
–Actions taken on the system, typically via a local access vulnerability, to increase the privileges available to the attacker to enable their more powerful attacks on the target system.
• Information Gathering or System Exploit:
–Actions by the attacker to access or modify information or resources on the system, or to navigate to another target system.
• Maintaining Access:
–Actions such as the installation of backdoors or other malicious software, or through the addition of covert authentication credentials or other configuration changes to the system, to enable continued access by the attacker after the initial attack.
• Covering Tracks:
–Where the attacker disables or edits audit logs, to remove evidence of attack activity, and uses rootkits and other measures to hide covertly installed files or code.
Components of Intrusion Detection
Sensors
Analyzers
User Interface
