Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Books Media Networking Book Reviews

Intrusion Prevention and Active Response 88

Posted by timothy from the let-'em-have-it dept.
nazarijo writes "The security world has been taken by storm by intrusion prevention system (IPS) products in the past couple of years. After all, a typical intrusion detection system (IDS) only alerts you that something malicious may have happened, and an IPS reacts to it and can prevent the attack. Action in this scenario is obviously preferred to a passive bystander. Still, the IPS solution space is confusing to many." Read on for the rest of Nazario's review of a book designed to erase that confusion.
Intrusion Prevention and Active Response: Deploying Network and Host IPS
author Michael Rash, Angela D. Orebaugh, Graham Clark, Becky Pinkard, and Jake Babbin
pages 424
publisher Syngress
rating 7
reviewer Jose Nazario
ISBN 193226647X
summary An overview of host- and network-based IPS solutions


The June, 2003, report from Gartner on the death of IDS set off a lot of security industry activity. Everyone was busy trying to either defend the IDS product space, reposition their products as IPS devices, or trying to dismiss the Gartner position. Many security engineers had to suddenly evaluate the IPS products on the market and make purchase and deployment decisions, as well. However, there's been a lack of understanding of this marketspace for some time. If you've been curious about this technology, you may want to look at Intrusion Prevention and Active Response: Deploying Network and Host IPS to help you understand these solutions.

It would have been relatively easy to write a book that simply covered one facet of the IPS product space, such as network IPS systems. However, the authors have chosen to try and write a comprehensive overview of the tools currently available for both the network and the host, as well as ways in which they can be attacked and the scenarios they work in. While the book focuses on open source tools, including the Snort IPS extensions, the techniques apply to closed source, commercial tools as well.

In general I found Intrusion Prevention to be a decent first book on the subject, although a bit unfocused in its delivery. At times it seems to try and bite off more than it can chew, or go off on a tangent for too long (such as the many pages of nmap options), but in general the book does a fair job of delivering its promise. Through it you'll get a good overview of many of the technologies present in the IPS marketspace and what they offer. If you're up to it, you'll even learn a few ways to test the tools and weed out the snake oil vendors.

The book is heavy on actual system output and configuration examples. I like the explicit packet captures and snort rules, I think they go a long way towards illustrating the premise of an IPS system. As is somewhat common with Syngress press books, the formatting is a bit off at times (sometimes it's too wide or slips over the page boundary at the wrong time), but if you can work past that you're rewarded with a useful example.

For host-based IPS solutions, the book covers a number of approaches that aren't always evident as IPS techniques. Various stack protection mechanisms, including LD_PRELOAD techniques like Libsafe, GCC modifications such as StackGuard, and kernel modifications like LIDS, PaX, RBAC and GrSecurity are all described.

By now you can see that the book is pretty Linux and open source centric. This isn't too bad at all, since the basic functionality is present in most of the commercial tools, as well. These can include inline network data modification and reactions or application integrity checking tools. The open source versions, while they sometimes have fewer features, are excellent representatives of this technology.

The book really comes together in chapter 8, 'Deploying Open Source IPS Solutions.' Several vulnerable systems are set up, deployed in a fictitious network, and protected through a variety of IPS solutions which work together to create a layered security model. If the network can detect the attack, it's dropped or modified to remove the offending bits. If the malicious data gets through to the host, the host-level IPS tools remediate the problem. All in all a nice example chapter.

The discussion on how to evade IPS devices was a bit lacking, unfortunately. It seems squeezed in, and doesn't have the same level of detail as other chapters on similar topics. Detailed descriptions of the layer 3, 4 and application layer obfuscation techniques would have been useful to help explain this complex topic.

Before you begin thinking that the authors are entirely gung-ho on IPS technologies, they spend a long time discussing how they can be fooled and how they are fundamentally prone to false positives. This tempered stance is valuable, and they recommend that you take a limited set of functionality from your IDS system and make it reactive in your IPS.

There are only a couple of books that cover IPS technologies to any significant degree, and this appears to be the only one solely devoted to discussing IPS approaches for both the host and network. To that end, the authors have done a pretty good job of introducing the reader to what an IPS can give them, how to evaluate it, and what to expect in the real world. While the book itself has some production and layout problems, the material is worthwhile and will give the reader much-needed advice.

You can purchase Intrusion Prevention and Active Response: Deploying Network and Host IPS from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
This discussion has been archived. No new comments can be posted.

Intrusion Prevention and Active Response More

Intrusion Prevention and Active Response

Comments Filter:

  • I'm sorry... (Score:5, Insightful)

    by Saint Aardvark ( 159009 ) * on Friday September 09, 2005 @03:24PM (#13521308) Homepage Journal
    ...but when you (or the authors) say "solution", do you mean:

    program? identity token? software? shelf? algorithm? application? office suite? server hardware? server software? virus scanner? product? network? method? word processor? network protocol? scheduling software? email client? vendor? invention? operating system? windows manager? website? web application? authoring software? network client? web browser? API? ABI? encoding standard? bug tracking software? revision control system? wiki? contact manager?

    (Yep, stolen shamelessly from an earlier journal entry.)

    • An IBM Consultant [huhcorp.com] could tell you better what a "solution" entails.
    • solution generally means "bullshit".

    • Re:I'm sorry... (Score:5, Insightful)

      by Bogtha ( 906264 ) on Friday September 09, 2005 @03:40PM (#13521453)

      "Solution" means "whatever is capable of solving the problem". So in the context of "Still, the IPS solution space is confusing to many.", it means "choosing between all the different methods of detecting and responding to intrusions is confusing to many".

      Yeah, I know that "solution" is an over-used buzzword. But that doesn't mean all uses of it are nonsensical. Solution is a vague term because it's a vague concept. In some contexts, it could be a library, in others it could be a platform.

      • And in still others, it could be a Supreme Court decision.
      • "Solution" means "whatever is capable of solving the problem".

        No, solution is a word spoken only by the salesman (and perhaps the most brainwashed of his customers) and it means "the thing I have to sell right now."

        I like to give vendors the buzzword challenge: they pick a buzzword from a hat and if they speak it during their pitch, out the door they go. Favorites: solution, technology, and enterprise.

      • "Space" is an overused buzzword too. Does it mean market?, Field?, Profession?. Using the word "space" after certain nouns and adjectives makes the non-techie feel techie.

  • write-up says it all (Score:5, Insightful)

    by Lord Ender ( 156273 ) on Friday September 09, 2005 @03:27PM (#13521341) Homepage
    Like the submittor said, IDSs will inform you when something that may be bad has happened. IPSs will block traffic which may be bad. All of these systems have false positives. All of them will eventually block something really important that shouldn't be blocked. And all will eventually lead you to be fired because of that reason. And none of them will detect an intelligent, targeted attack.
    • IDS/IPS and other signature based systems are yesterday's news. NBAD is where it is at when it comes to detecting targetted attacks.

      • NBAD? [google.com]

        National Bank of Abu Dhabi?
        National Bass Association of the Deaf?

        Oh, wait... Network Behavior Anomaly Detection -- for those who didn't know.
         
        • I have one of these devices. It produces lots of nice, pretty graphs and SHIT TONS OF FALSE POSITIVES.

          NBAD=worthless for large networks. large networks are too big and too dynamic for any software to decide what is "normal"

    • IPSs will block traffic which may be bad. All of these systems have false positives. All of them will eventually block something really important that shouldn't be blocked. And all will eventually lead you to be fired because of that reason. And none of them will detect an intelligent, targeted attack.

      Bzzzzzt! Wrong! Thanks for playing. There are indeed IPS systems that will detect intelligent, targeted attacks. They work by knowing what talks to what on your network and finding anomalous behavior. Sur

    • While everything you say is true, I submit that it is not a full view of the picture. I've been studying IPS for over a year now for a government study that has recently been given the go ahead for a large scale pilot program.

      Modern IPS do more than Snort does, which is more or less signature detection (please, I'm aware of the protocol anomaly stuff Snort does, but let's be honest with ourselves and say that it is limited in scope). IPS today have the concept of a "Vulnerability Filter" or "Virtual Pat

  • Action in this scenario is obviously preferred

    This is not necessarily true, and I'm not just talking about honeynets/honeypots, either.
    • i agree i constatly watch the network traffic..

      one day i found someone trying to get into one of our jetdirect print servers.. i am not sure why or even if they knew it was a printserver - to be honest it looked like some script kiddy just trying things to breake a telnet server..

      i watched for a little bit, then went to close the port off and then realized.. what is the worst he can do . print something.. paper is cheep toner is cheep . mabey i will mail it to him if he manages to print something..

      nothin
      • i watched for a little bit, then went to close the port off and then realized.. what is the worst he can do . print something.

        FYI, you're wrong about the worst case... it's been demonstrated that one can get an HP printer to send a copy of everything printed to a remote printer or other IP... Do you really want your TPS reports stolen?

  • My Intrusion Prevention System (Score:5, Funny)

    by Spy Handler ( 822350 ) on Friday September 09, 2005 @03:41PM (#13521456) Homepage Journal
    infect the systems at work with my pwn trojans so other peeps' trojans get crowded out... like how your good intestinal bacteria keep out bad bacteria.

  • Action is almost always preferred... (Score:5, Insightful)

    by squarooticus ( 5092 ) on Friday September 09, 2005 @03:42PM (#13521468) Homepage
    ...when there truly has been an intrusion, but the underlying system may be complex enough that the intrusion detection software can't be entirely sure something unauthorized is happening, and the consequences of preventing access might outweigh the risk of automatic action.

    The real problem with the IDS/IPS space is false positives, because they are a non-starter for many businesses, including mine.
  • Sort of on opic in a way, but what do people think of Cisco's IPS/Firewall/Solutions?

    I do read some bad things about them, but nothign that explains why (other than price) And most the good stuff is usually marketing.

    • a Cisco pix box is great - it (the cheep one) has two ether ports (some have more) on it packets go in both sides and it just collects them - have no idea what it does with them.. figured mabey they are trying to get enough to create their own black hole but not sure.

      • The Church of Cisco, most holy retainers of the sacred IOS, are pleased that you like they almost-so-holy PIX product. In the name of the IOS, the Ethernet Hub and the Resellers. Amen.

    • Re:What do people think of Cisco's IPS/Firewall/So (Score:1, Insightful)

      by Anonymous Coward
      I fight with 50+ Cisco IDS devices every day. Run far, far away.

      These devices are as dumb as they come with poor support, poor management control, buggy software. We steer customers away from active traffic blocking as it more often than not will block legimate traffic. To the customer it appears they have intermittent traffic failures as different support groups will be unaware of the blocking capabilities and chase their tails for hours.

      Proper profiling and signature tuning can only take it so far befo
    • They usualy only track about 10% of traffic. They are also extreamly dificult to manage. Snort, Snort based, or Dragon IDSs are the only decent ones on the market. ~gp

  • My Girlfriend has a great IDS (Score:1, Funny)

    by Anonymous Coward
    which always somehow spits out the message "baby not now I'm sleeping"....

  • IPS (Score:4, Insightful)

    by j_kenpo ( 571930 ) on Friday September 09, 2005 @03:43PM (#13521480)
    Prevention eventually fails

    Quit looking for the security silver bullet.
    • the point is to help minimize your risks. depending on your thresholds for false positives and how many of those you get, an IDP is a fucking godsend. I personally know of two networks tied at the hip (legally, physically and contractually etc) but seperate in management and mission etc and the only real difference between them is that the one running a commercial IDP (e.g., not Snort; I know the company, and the products, but am avoiding mentioning them for the slashvertising BS) and the other isn't. The o

  • This stuff can't cope (Score:1, Interesting)

    by Anonymous Coward
    Those page-the-admin-in-his-sleep systems assume an intrusion is spread over minutes and can be dealt with like a cop intervening during a burglary.

    Next-gen intrusion will be scripted/automated to such a level that everything the hacker wanted to do will be done after 1 second.

    This stuff can't cope with that kind of attack. Only a secure system can.

  • Put your network on autopilot? (Score:5, Interesting)

    by Watchman_ds ( 238262 ) on Friday September 09, 2005 @03:46PM (#13521492) Journal
    In a former life (large financial company), we looked closely at IPS as a possibility. The big concern was that IPS was based on IDS and it still had way too many false positives and false negatives.

    So hooking that stuff up to the "Emergency Shutoff" switch for even rarely used network services was a little scary. We had some events where we put in router rules by hand (block this traffic or that traffic), and they still broke applications we never dreamed of.

    In the end, we decided to funnel all of those types of actions through our 24x7 command center. The delay caused by human response time was worth the tradeoff for not killing our own network.
     

    • Re:Put your network on autopilot? (Score:4, Insightful)

      by foolish ( 46697 ) on Friday September 09, 2005 @04:25PM (#13521788)
      That's the thing about the modern IPSes though.

      You don't plug and pray. You install and interate as you learn the product. You don't turn the tool to IPS everything mode from the get go.

      You start out in IDS mode, monitoring for everything. Then you decide which of the types of alerts it is capturing properly, say worms in this instance.

      Then you flip the bit for IPS mode for those signatures or anolomies ONLY. And the traffic of that specific type gets blocked, not everything to or from the hosts. Specific traffic only.

      If you get reports of something getting blocked, you 'detune' it to IDS mode until you can figure out why it is triggering. Luckily you can get packet capture for most of the enterprise IPSes, so it is usually fairly easy to peg why something false-positived. Some even have an emergency 'flip to IDS mode only'.

      You iterate this process until you have a comfort level for the IPS and IDS balancing act. Sigs or types of traffic you're worried false positive too much? Keep them in IDS mode or feedback to the provider that you're getting too much noise! Pretty sure that something on Kazaa ports using Kazaa commands is probably Kazaa or a Kazaa worm? Use IPS to block that specific traffic.

      None of the enterprise network people I've talked to would enable to 'Big Red Button' automation script, though. Definitely have the SoC or NoC check the alert and then have them make routing changes. Otherwise, just let the IPS drop/reset the 'bad' traffic.

      The 'unknown application breakage' is definitely a problem, especially the closer to the data core you get. I would slowly enable things one at a time, and take a slow and steady approach. The last thing you want to do is break some 100M USD application because you set a sig to block!

      As other posters have commented, this does relatively little against a well prepared intruder, but it will hopefully clear off the bottom 90% of your incidents so that you can watch or react to things in a more focused manner. Also, some of the IPSes do check for common single intruder commands , like rm -rf /, su to root, etc.
    • Conventional IDS/IPS products are mired in false positives because they attempt to enumerate attack traffic. You can't enumerate an infinite set. This is the negative model. The negative model is useful for detecting the attack that you know about but haven't completely patched for yet. This is a good place to deploy current IPS. To go beyond this, define the traffic that you DO expect to see, and derive attacks by what is left. This is the positive model. Real world detection systems never achieve g
  • while ( fatass_ex-hacker_CEO ) {
      read_Gartner_reports()
      panic()
      fire_engineers()
      rename_products( latest_trend )
      }
    Still bitter, party of one.
  • I don't have a spare PC to use as a linux firewall, so assuming windows what is the best firewall with IPS? Sygate has been bought out and Kerio's stopped developing their firewall. What firewall w/ IPS is left for windows thats decent?
  • I've deployed both TippingPoint (now 3COM) and Lucid IPS and am quite happy with both.
    No false positives to date. Med.>Large company.

  • "Active" Response? (Score:4, Funny)

    by Hasai ( 131313 ) on Friday September 09, 2005 @04:35PM (#13521909)
    When I was serving in the military, the term "active response" to an intrusion meant a half-dozen pissed-off MPs with automatic weapons.
     
    ....I'm not all-that sure the military doesn't have the right idea, either....
    • When I was serving in the military, the term "active response" to an intrusion meant a half-dozen pissed-off MPs with automatic weapons.
      Members of Parlaiment with automatic weapons? (yes, I know what you mean, but mine has a funnier visual).
  • The best detection and prevention I have found to date is simply watching tcpdump and taking action manually.

    If you find watching lines of packet information less than thrilling, you could try out something like the Cube of Potential Doom.
    http://sourceforge.net/projects/net3d/ [sourceforge.net]

    Although, I'm surprised to see this project go stagnant.

  • A so-called "Intrusion Prevention System" is at heart and in practice, just a firewall.

    Amusingly, it's a firewall with a default open policy. Sure, it inspects the contents of packets instead of making its decisions based on address and port information alone, which is a good thing in itself. But then an IPS by default allows everything else.

    If you want the hell of signature-based anti-virus (signature lag all the way up to signature lack) as your primary network protection, by all means, ditch your real
    • I've just attended an IPS presentation by 3Com.. I don't see any difference what IPS does and common IDS. But imo, IPS is a kind of combination of firewall, anti virus, and anti spyware/mallware. Not really a great thing, but I like the marketing idea to introduce "the IPS".
      The very interesting part of the presentation was the lucky draw, with prize an Ipod shuffle. :)
  • If you're lucky, your application is good enough it doesn't need IPS. Used to have some BSD boxes just sitting on the internet, no firewall, running postfix and running BIND 8 with no recursion.

    Day after day these boxes were subjected to all kinds of indignitites, and BSD woud just laugh in their general direction. Their only vulnerability was to properly executed DDoS attacks, which, as previous posters have pointed out, most IDS/IPS products are hard to configure against without running the risk of, say,

  • IPS/IDS and firewall are the dumbest ideas.... (Score:3, Insightful)

    by Dark Coder ( 66759 ) on Friday September 09, 2005 @06:17PM (#13522744)
    Marcus Ranum said it best: Six dumbest Ideas in Computing Security. [ranum.com]

    Having worked on the 10Gbps IPS, I can tell you that this is becoming a rapidly dumb idea (along with firewall). My experience in signature writing was telling me that this is becoming an exercise in futility.

    If you can ascertain that your network-based application are secured (via code-review), none of these ancillary cash-burning network security add-on infrastructures would matter. A fool is soon parted with his money.

    Spending some time reviewing the application code may be more cost effective.

    Web Server? Go tinyHTTP. Fewer codes, less (or no) exploits.

    Simplify, simplify, simplify (K.I.S.S.)

    Sheesh.

  • "Active response" is dangerous (Score:4, Interesting)

    by Alex Belits ( 437 ) * on Saturday September 10, 2005 @02:15AM (#13524873) Homepage
    The problem with all those things is that they are only good for making HORRIBLY INSECURE BUT RELIABLE system into KINDA INSECURE AND NOT RELIABLE AT ALL.

    Think of it. Why should a system change its behavior when an attack is detected? Because the normal behavior is not secure enough? But then why should it change back when attack ends? Because the "secure" behavior can possibly include blocking something that should be available. There is no other possibility -- if there was, system would just run in a "secure" mode all the time, and there would be no need to sell a complex product to turn it on and off.

    But then whoever can trigger "secure" mode for any particular set of addresses (what usually can be done blindly), can do it deliberately and cause a massive DoS. But what if "IPS" is smart enough to detect a "blind" attack? Then it's better! The only way to distinguish between "blind" attack from a spoofed address and a real attack is by keeping track of all connections and packet history. Create a horribly confusing sequence of packets, and you have anti-IPS equivalent of SYN flood. And then when "IPS" box is out of its RAM, start a real attack. Because you know that IPS was built for a reason -- someone have left his system insecure.

  • Sourcefire and RNA (Score:4, Insightful)

    by PGillingwater ( 72739 ) on Saturday September 10, 2005 @03:51AM (#13525140) Homepage
    I've worked with IDS for more than 8 years, and Snort for at least 6 years. Currently, I recommend Sourcefire [sourcefire.com] to my customers. Why? Well, Snort with commercial support is great, but it's not enough. Sourcefire however developed RNA, which does passive network protocol analysis, and builds a knowledge base of vulnerbilities and hosts -- and allows IDS rules to be tuned according to relevance. (Note that RNA doesn't help when it comes to IPS.)


    Having said that, I am generally against deploying any fully-automated IPS responses, due to the possibilities of false positives and potential for new attack vectors (i.e., a crafty attacker using the defenses against you.)


    Until expert systems are as smart as experienced IDS analysts, the best defense is a dedicated team of people who deploy early-warning systems, and who watch the network carefully, 24x7, aided by tools like RNA. If you're really serious about security, however, you will develop two teams: Read Team and Blue Team. Let one handle defense, the other run attacks, and let the games begin... and don't forget to cycle people between the teams!

Slashdot Top Deals

Neutrinos have bad breadth.

Close