Cyber Security Management

c
5. Firewall and Intrusion Detection

Sosina M.
1
Intrusion
❑A significant security problem for networked systems is hostile, or at least unwanted,
trespass by users or software.
❑User trespass can take the form of
▪ unauthorized logon to a machine
▪ acquisition of privileges or performance of actions beyond those that have been
authorized.
❑Software trespass can take the form of a virus, worm, or Trojan horse

Cybersecurity Management 2
Intruders
❑Three classes of intruders:
❑Masquerader:
▪ An individual who is not authorized to use the computer and who penetrates a system’s
access controls to exploit a legitimate user’s account
▪ outsider
❑Misfeasor:
▪ A legitimate user who accesses data, programs, or resources for which such access is not
authorized, or who is authorized for such access but misuses his or her privileges
▪ insider
❑Clandestine user:
▪ An individual who seizes supervisory control of the system and uses this control to evade
auditing and access controls or to suppress audit collection
▪ insider/outsider
Cybersecurity Management 3
Intruders

❑Intruder attacks range from the benign to the serious.

❑ At the benign end of the scale, there are many people who simply wish to explore
internets and see what is out there.
❑At the serious end are individuals who are attempting to read privileged data, perform
unauthorized modifications to data, or disrupt the system.

Cybersecurity Management 4
Intrusion
❑Examples of intrusion
▪ Performing a remote root compromise of an e-mail server
▪ Defacing a Web server
▪ Guessing and cracking passwords
▪ Copying a database containing credit card numbers
▪ Viewing sensitive data, including payroll records and medical information, without
authorization
▪ Running a packet sniffer on a workstation to capture usernames and passwords

Cybersecurity Management 5
Intruder Behavior Patterns
❑The techniques and behavior patterns of intruders are constantly shifting
▪ exploit newly discovered weaknesses and evade detection and countermeasures
❑Hackers
▪ Those who hack into computers do so for the thrill of it or for status.
▪ The hacking community is a strong meritocracy in which status is determined by level of
competence.
❑CRIMINALS
▪ Organized groups of hackers have become a widespread and common threat to Internet-based
systems.
▪ These groups can be in the employ of a corporation or government but often are loosely affiliated
gangs of hackers
❑INSIDER ATTACKS
▪ Insider attacks are among the most difficult to detect and prevent.
▪ Employees already have access and knowledge about the structure and content of corporate
databases

Cybersecurity Management 6
Intrusion Techniques
❑Most initial attacks use system or software vulnerabilities that allow a user to execute
code that opens a back door into the system.
❑Alternatively, the intruder attempts to acquire information that should have been
protected.
❑In some cases, this information is in the form of a user password.
▪ With knowledge of some other user’s password, an intruder can log in to a system and
exercise all the privileges accorded to the legitimate user.
o Typically, a system must maintain a file that associates a password with each authorized user.
o If such a file is stored with no protection, then it is an easy matter to gain access to it and
learn passwords

Cybersecurity Management 7
Intrusion Techniques
❑Techniques for learning passwords
▪ Try default passwords used with standard accounts that are shipped with the system.
▪ Exhaustively try all short passwords (those of one to three characters).
▪ Try words in the system’s online dictionary or a list of likely passwords. Examples of the
latter are readily available on hacker bulletin boards.
▪ Collect information about users, such as their full names, the names of their spouse and
children, pictures in their office, and books in their office that are related to hobbies.
▪ Try users’ phone numbers, Social Security numbers, and room numbers.
▪ Try all legitimate license plate numbers for this state.
▪ Use a Trojan horse to bypass restrictions on access.
▪ Tap the line between a remote user and the host system.

Cybersecurity Management 8
Intrusion detection
❑Inevitably, the best intrusion prevention system will fail - a system’s second line of
defense is intrusion detection
▪ If an intrusion is detected quickly enough, the intruder can be identified and ejected from
the system before any damage is done or any data are compromised
▪ An effective intrusion detection system can serve as a deterrent, so acting to prevent
intrusions

❑Intrusion detection enables the collection of information about intrusion techniques

that can be used to strengthen the intrusion prevention facility.
❑Intrusion detection is based on the assumption that the behavior of the intruder differs
from that of a legitimate user in ways that can be quantified

Cybersecurity Management 9
Intrusion detection
❑Profiles of Behavior of Intruders and Authorized Users
▪ Although the typical behavior of an intruder differs from the typical behavior of an
authorized user, there is an overlap in these behaviors.

Cybersecurity Management 10
Intrusion detection
Statistical anomaly detection:
❑ Involves the collection of data relating to the behavior of legitimate users over a period of
time.
❑Then statistical tests are applied to observed behavior to determine with a high level of
confidence whether that behavior is not legitimate user behavior.
▪ Threshold detection:
o This approach involves defining thresholds, independent of user, for the frequency of occurrence
of various events.
▪ Profile based:
o A profile of the activity of each user is developed and used to detect changes in the behavior of
individual accounts

❑effective against masqueraders, who are unlikely to mimic the behavior patterns of the
accounts they appropriate.
▪ On the other hand, such techniques may be unable to deal with misfeasors

Cybersecurity Management 11
Intrusion detection
Rule-based detection:
❑Involves an attempt to define a set of rules that can be used to decide that a given
behavior is that of an intruder.
▪ Anomaly detection:
o Rules are developed to detect deviation from previous usage patterns.
▪ Penetration identification:
o An expert system approach that searches for suspicious behavior.

❑In practice, a system may exhibit a combination of both approaches to be effective

against a broad range of attacks.

Cybersecurity Management 12
Audit Records
❑Some record of ongoing activity by users must be maintained as input to an intrusion
detection system
❑Native audit records:
▪ Virtually all multiuser operating systems include accounting software that collects information on
user activity.
❑Detection-specific audit records:
▪ A collection facility can be implemented that generates audit records containing only that
information required by the intrusion detection system.
❑Example detection-specific audit records
▪ Subject: Initiators of actions (process, user, group)
▪ Action: Operation performed by the subject on or with an object
▪ Object: Receptors of actions. (E.g., files, programs, messages, etc)
▪ Exeption-Condition: Denotes which, if any, exception condition is raised on return.
▪ Resource-Usage: A list of quantitative elements in which each element gives the amount used of
some resource (e.g., number of lines printed or displayed, number of records read or written,
processor time, I/O units used, session elapsed time).
▪ Time-Stamp: Unique time-and-date stamp identifying when the action took place.

Cybersecurity Management 13
Statistical Anomaly Detection
❑Profile-based anomaly detection focuses on characterizing the past behavior of
individual users or related groups of users and then detecting significant deviations.
❑A profile may consist of a set of parameters, so that deviation on just a single
parameter may not be sufficient in itself to signal an alert.
▪ The foundation of this approach is an analysis of audit records.
o First, the designer must decide on a number of quantitative metrics that can be used to
measure user behavior.
o An analysis of audit records over a period of time can be used to determine the activity profile
of the average user
▪ The audit records provide input to the intrusion detection function in two ways
o The audit records serve to define typical behavior.
o Current audit records are the input used to detect intrusion.

Cybersecurity Management 14
Statistical Anomaly Detection
❑Examples of metrics that are useful for profile-based intrusion detection are the
following:
▪ Counter: A nonnegative integer that may be incremented but not decremented until it is
reset by management action.
o E.g., the number of logins by a single user during an hour, the number of times a given
command is executed during a single user session, and the number of password failures
during a minute.
▪ Gauge: A nonnegative integer that may be incremented or decremented.
o used to measure the current value of some entity.
o Examples include the number of logical connections assigned to a user application and the
number of outgoing messages queued for a user process
▪ Interval timer: The length of time between two related events
o E.g.,the length of time between successive logins to an account
▪ Resource utilization: Quantity of resources consumed during a specified period.

Cybersecurity Management 15
Statistical Anomaly Detection
❑Given these general metrics, various tests can be performed to determine whether
current activity fits within acceptable limits
▪ The mean and standard deviation of a parameter over some historical period
▪ A multivariate model is based on correlations between two or more variables.
o Intruder behavior may be characterized with greater confidence by considering such
correlations (for example, processor time and resource usage, or login frequency and session
elapsed time).
▪ A Markov process model is used to establish transition probabilities among various states.
o As an example, this model might be used to look at transitions between certain commands.

Cybersecurity Management 16
Rule-Based Intrusion Detection
❑Rule-based techniques detect intrusion by observing events in the system and
applying a set of rules that lead to a decision regarding whether a given pattern of
activity is or is not suspicious.
❑Rule-based anomaly detection
▪ historical audit records are analyzed to identify usage patterns and to generate
automatically rules that describe those patterns.
▪ Current behavior is then observed, and each transaction is matched against the set of rules
to determine if it conforms to any historically observed pattern of behavior
▪ In order for this approach to be effective, a rather large database of rules will be needed.

Cybersecurity Management 17
Rule-Based Intrusion Detection
❑Rule-based penetration identification
▪ The key feature of such systems is the use of rules for identifying known penetrations or
penetrations that would exploit known weaknesses
▪ Heuristic rules that can be used to assign degrees of suspicion to activities
o Users should not read files in other users’ personal directories.
o Users must not write other users’ files
o Users who log in after hours often access the same files they used earlier.
o Users do not generally open disk devices directly but rely on higher-level operating system
utilities.
o Users should not be logged in more than once to the same system.
o Users do not make copies of system programs.

Cybersecurity Management 18
The Base-Rate Fallacy
❑To be of practical use, an intrusion detection system should detect a substantial
percentage of intrusions while keeping the false alarm rate at an acceptable level.
❑In general, if the actual numbers of intrusions is low compared to the number of
legitimate uses of a system, then the false alarm rate will be high unless the test is
extremely discriminating.
❑A study of existing intrusion detection systems indicated that current systems have not
overcome the problem of the base-rate fallacy.

Cybersecurity Management 19
Distributed Intrusion Detection
❑Until recently, work on intrusion detection systems focused on single-system
standalone facilities
❑Although it is possible to mount a defense by using stand-alone intrusion detection
systems on each host, a more effective defense can be achieved by coordination and
cooperation among intrusion detection systems across the network
❑Major issues
❑A distributed intrusion detection system may need to deal with different audit record
formats.
❑One or more nodes in the network will serve as collection and analysis points for the
data from the systems on the network.
▪ Thus, either raw audit data or summary data must be transmitted across the network.
o Therefore, there is a requirement to assure the integrity and confidentiality of these data.

Cybersecurity Management 20
Distributed Intrusion Detection
❑Either a centralized or decentralized architecture can be used.
❑Centralized architecture
▪ there is a single central point of collection and analysis of all audit data.
▪ eases the task of correlating incoming reports but creates a potential bottleneck and single
point of failure.
❑Decentralized architecture
▪ there are more than one analysis centers, but these must coordinate their activities and
exchange information.

Cybersecurity Management 21
Distributed Intrusion Detection
❑Architecture for Distributed Intrusion Detection

Cybersecurity Management 22
Honeypots
❑Honeypots are decoy systems that are designed to lure a potential attacker away from
critical systems.
❑Honeypots are designed to
▪ divert an attacker from accessing critical systems
▪ collect information about the attacker’s activity
▪ encourage the attacker to stay on the system long enough for administrators to respond
❑These systems are filled with fabricated information designed to appear valuable but
that a legitimate user of the system wouldn’t access.
▪ Thus, any access to the honeypot is suspect.
▪ The system is instrumented with sensitive monitors and event loggers that detect these
accesses and collect information about the attacker’s activities.

Cybersecurity Management 23
Firewalls
❑Firewalls can be an effective means of protecting a local system or network of systems from
network-based security threats while at the same time affording access to the outside world via
wide area networks and the Internet.
❑The need for firewalls
▪ Internet access provides benefits to an organization, however it enables the outside world to reach
and interact with local network assets.
▪ This creates a threat to the organization.
▪ While it is possible to equip each workstation and server on the premises network with strong
security features, such as intrusion protection, this may not be sufficient and in some cases is not
cost-effective
▪ A widely accepted alternative or at least complement to host-based security services is the firewall
❑The firewall is inserted between the premises network and the Internet to establish a
controlled link and to erect an outer security wall or perimeter.
▪ protects the premises network from Internet-based attacks and provides a single choke point where
security and auditing can be imposed.
❑ The firewall may be a single computer system or a set of two or more systems that cooperate
to perform the firewall function.

Cybersecurity Management 24
Firewalls characteristics

❑All traffic from inside to outside, and vice versa, must pass through the firewall.
❑Only authorized traffic, as defined by the local security policy, will be allowed to
pass.
❑The firewall itself is immune to penetration.
▪ This implies the use of a hardened system with a secured operating system.

Cybersecurity Management 25
Firewall services
❑Service control:
❑Determines the types of Internet services that can be accessed, inbound or outbound.
▪ may filter traffic on the basis of IP address, protocol, or port number
❑Direction control:
▪ Determines the direction in which particular service requests may be initiated and allowed
to flow through the firewall
❑User control:
▪ Controls access to a service according to which user is attempting to access it.
❑Behavior control:
▪ Controls how particular services are used

Cybersecurity Management 26
Packet Filtering Firewall
❑A packet filtering firewall applies a set of rules to each incoming and outgoing IP
packet and then forwards or discards the packet
❑Filtering rules are based on information contained in a network packet:
▪ Source IP address: The IP address of the system that originated the IP packet (e.g., [Link])
▪ Destination IP address: The IP address of the system the IP packet is trying to reach (e.g.,
[Link])
▪ Source and destination transport-level address: The transport-level (e.g., TCP or UDP) port
number, which defines applications such as SNMP or TELNET
▪ IP protocol field: Defines the transport protocol
▪ Interface: For a firewall with three or more ports, which interface of the firewall the packet came
from or which interface of the firewall the packet is destined for
❑The packet filter is typically set up as a list of rules based on matches to fields in the IP or
TCP header.
▪ If there is a match to one of the rules, that rule is invoked
▪ If there is no match to any rule, then a default action is taken

Cybersecurity Management 27
Packet Filtering Firewall
❑Advantage of a packet filtering firewall
▪ Simplicity
▪ packet filters typically are transparent to users and are very fast
❑Weaknesses of packet filter firewalls
▪ Because packet filter firewalls do not examine upper-layer data, they cannot prevent
attacks that employ application-specific vulnerabilities
▪ Most packet filter firewalls do not support advanced user authentication schemes
▪ Packet filter firewalls are generally vulnerable to attacks and exploits that take advantage
of problems within the TCP/IP specification and protocol stack, such as network layer
address spoofing
▪ due to the small number of variables used in access control decisions, packet filter
firewalls are susceptible to security breaches caused by improper configurations.

Cybersecurity Management 28
Packet Filtering Firewall
❑Some of the attacks that can be made on packet filtering firewalls
❑IP address spoofing:
▪ The intruder transmits packets from the outside with a source IP address field containing an address of
an internal host.
▪ The countermeasure - discard packets with an inside source address if the packet arrives on an external
interface.
❑Source routing attacks:
▪ The source station specifies the route that a packet should take as it crosses the Internet.
▪ The countermeasure - discard all packets that use this option.
❑Tiny fragment attacks:
▪ The intruder uses the IP fragmentation option to create extremely small fragments and force the TCP
header information into a separate packet fragment
▪ designed to circumvent filtering rules that depend on TCP header information.
▪ Typically, a packet filter will make a filtering decision on the first fragment of a packet.
o All subsequent fragments of that packet are filtered out solely on the basis that they are part of the packet
▪ The counter measure - enforcing a rule that the first fragment of a packet must contain a predefined
minimum amount of the transport header

Cybersecurity Management 29
Stateful Inspection Firewalls
❑A traditional packet filter makes filtering decisions on an individual packet basis and
does not take into consideration any higher layer context
❑Example Stateful Firewall Connection State Table

o Some stateful firewalls also keep track of TCP sequence numbers to prevent attacks that
depend on the sequence number,
Cybersecurity Management 30
Application-Level Gateway
❑An application-level gateway, also called an application proxy, acts as a relay of
application-level traffic
❑The user contacts the gateway using a TCP/IP application, such as Telnet or FTP, and
the gateway asks the user for the name of the remote host to be accessed.
❑When the user responds and provides a valid user ID and authentication information,
the gateway contacts the application on the remote host and relays TCP segments
containing the application data between the two endpoints.
❑If the gateway does not implement the proxy code for a specific application, the
service is not supported and cannot be forwarded across the firewall.
❑A prime disadvantage of this type of gateway is the additional processing overhead on
each connection.

Cybersecurity Management 31
Circuit-Level Gateway
❑Can be a stand-alone system or it can be a specialized function performed by an
application-level gateway for certain applications
❑Does not permit an end-to-end TCP connection (similar to application level gateway)
❑The gateway sets up two TCP connections,
▪ one between itself and a TCP user on an inner host
▪ one between itself and a TCP user on an outside host
❑Once the two connections are established, the gateway typically relays TCP segments
from one connection to the other without examining the contents.
❑A typical use of circuit-level gateways is a situation in which the system administrator
trusts the internal users.
▪ The gateway can be configured to support application-level or proxy service on inbound
connections and circuit-level functions for outbound connections

Cybersecurity Management 32
Types of firewalls

Cybersecurity Management 33
Firewall basing
❑Firewall functionality can also be implemented as a software module in a router or LAN
switch. In this section
❑Bastion Host
▪ A bastion host is a system identified by the firewall administrator as a critical strong point in the
network’s security.
o Typically, the bastion host serves as a platform for an application-level or circuit-level gateway
❑Host-Based Firewalls
▪ a software module used to secure an individual host.
o Such modules are available in many operating systems or can be provided as an add-on package
▪ filter and restrict the flow of packets
▪ A common location for such firewalls is a server.
▪ Advantages
o Filtering rules can be tailored to the host environment
o Protection is provided independent of topology
o Used in conjunction with stand-alone firewalls

Cybersecurity Management 34
Firewall basing
❑Personal Firewall
▪ Controls the traffic between a personal computer or workstation on one side and the
Internet or enterprise network on the other side.
▪ Typically, the personal firewall is a software module on the personal computer
▪ In home environment with multiple computers connected to the Internet, firewall
functionality can also be housed in a router that connects all of the home computers to
internet

Cybersecurity Management 35
Firewall location and configurations
❑DMZ (demilitarized zone) Networks
❑Systems that are externally accessible
but need some protections are usually
located on DMZ networks.
▪ Typically, the systems in the DMZ
require or foster external connectivity,
such as a corporate Web site, an e-mail
server, or a DNS (domain name system)
server.

Cybersecurity Management 36
Firewall location and configurations
❑Distributed Firewalls
❑A distributed firewall configuration involves
stand-alone firewall devices plus hostbased
firewalls working together under a central
administrative control
❑Web servers that need less protection because they
have less critical information on them could be
placed in an external DMZ

Cybersecurity Management 37