Monitoring, Logs, and IDS (Lesson 15)

Question 1

Unix Log Files

Answer 1

syslog – the system log
sulog – records actions to switch users (su)
utmp – keeps track of users currently logged on
wtmp – stores historical data on login, logout, shutdown, and restart events.
lastlog – tracks each user’s most recent login time and the point of origin of the user. Successful and unsuccessful logins can be tracked.
-At login, this information (about the last login) is often displayed

Question 2

Four major methods attempted to perform intrusion detection:

Answer 2

User Profiling
Intruder Profiling
Signature Analysis
Action-based (attack “signatures”)

Question 3

User Profiling - Types of activity to record may include

Answer 3

CPU and I/O usage
Connect time and time of connection as well as duration
Location of use
Command usage
Mailer usage
Editor and compiler usage
Directories and files accessed/modified
Errors
Network activity

Question 4

Intruder Profiling

Answer 4

When an intruder first gains access the action often taken is to check to see who else is on, will examine files and directories, …
Can also apply to insiders gaining access to files they are not authorized to access.

Question 5

Signature Analysis

Answer 5

Just as an individual has a unique written signature which can be used for identification purposes, individuals also have a “typing signature”.
This technique requires special equipment.
Variation on this is to watch for certain abbreviations for commands and common errors.

Question 6

MIDAS

Answer 6

Multics Intrusion Detection and Alerting System

Question 7

Network Profile

Answer 7

which systems normally connect to which others using what service.
During a 2 month period, 110,000 connections analyzed at UC-Davis, NSM correctly identified over 300 intrusions, only 1% had been detected by admins.

Question 8

NSM

Answer 8

Network Security Monitor

Question 9

DIDS

Answer 9

Distributed IDS

Question 10

CSM

Answer 10

Cooperating Security Monitors

Question 11

4 General Types of IPS

Answer 11

Inline NIDS
Layer Seven Switches
Application Firewall/IDS
Deceptive Applications

Question 12

Layer Seven Switch

Answer 12

Due to bandwidth intensive content, some switching now going on a layer seven (e.g. load balancers) where application traffic can be examined.
Decisions can be made as to whether data is sent.
Good for preventing DOS