Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
291
13. Availability and main characteristics of physical protection of the
informatization object (premises where protected information is processed
and information media are stored).
14. Availability and readiness of design and operational
documentation for the informatization object and other initial data on the
certified informatization object that affects information security.
Experience shows that the listed initial data is clearly not enough to
carry out work on analyzing the security of AS, and the list given in the RD
of the State Technical Commission needs to be expanded and specified.
Article 14 of the above list involves the provision of other initial data on the
informatization object that affects the security of information. It is these
“additional” data that are the most significant for assessing the current state
of affairs in ensuring nuclear safety. Their list includes the following types
of documents:
Additional documentation:
1. Regulatory and administrative documentation for carrying out
routine maintenance.
2. Regulatory and administrative documentation to ensure the security
policy.
3. Job descriptions for administrators, technical support engineers, and
security services.
4. Procedures and plans for preventing and responding to attempts at
unauthorized access to information resources.
5. Corporate network topology diagram indicating IP addresses and
block diagram.
6. Data on the structure of information resources, indicating the degree
of criticality or confidentiality of each resource.
7. Placing information resources on the corporate network.
8. User organizational structure diagram.
9. Diagram of the organizational structure of service departments.
10. Layout of data lines.
11. Schemes and characteristics of power supply and grounding
systems for AS facilities.
292
12. Data on the network management and monitoring systems used.
13. Project documentation:
14. Functional diagrams.
15. Description of automated functions.
16. Description of the main technical solutions.
17. Operational documentation: User and administrator manuals for
the software and hardware used for information security (IS) (if necessary).
When analyzing the configuration of means of protecting the external
perimeter of a LAN and managing internetwork interactions, special
attention is paid to the following aspects determined by their configuration:
• setting up access control rules (network packet filtering rules) on
firewalls and routers;
• used schemes and configuration of authentication parameters;
• setting up event registration system parameters;
• the use of mechanisms to conceal the topology of the protected
network, including network address translation (NAT), masquerading and
the use of the split DNS system;
• setting up attack notification and response mechanisms;
• availability and operability of integrity monitoring means;
• versions of the software used and the presence of installed software
correction packages.
Methods for analyzing information system security
Detection of malicious activity [15]
By malicious activity we mean both attacks (obviously contrary to
any security policy) and actions that violate the security policy of a specific
organization through abuse of existing authority. The separation of two
types of malicious activity seems appropriate to us for the reason that the
configuration for detecting attacks can be done by the supplier of the active
audit system (attacks are universal), while each organization has its own
293
security policy (if, of course, it exists). Customers will have to tune in to it
themselves.
To detect malicious activity, they have tried and are trying to use
several universal technologies: expert systems, neural networks, pattern
matching, finite state machines, etc. One of the first and is still the most
used — the technology for detecting signatures of malicious actions. The
idea is to somehow define the characteristics of malicious behavior (called
signatures), and then monitor the flow of events to look for a match with
predefined patterns. In more serious developments, expert systems have
been used for over ten years, based on sets of rules that define more powerful
languages.
The biggest challenge for a signature-based approach is detecting
previously unknown attacks, as new threats appear almost every day. You
can fight them in two ways.
First, you can regularly update the set of signatures. Here, in addition
to completeness, the frequency of updates is critical. Signatures of new
attacks should be provided to customers’ orders of magnitude faster than
patches from manufacturers of compromised hardware or software
products. In practice, this means updating within 24 hours, but not once a
month. Otherwise, active audit systems begin to resemble a fig leaf rather
than a means of protecting against real threats.
Secondly, it is possible to combine the signature approach with
methods for detecting anomalous activity (see below). An attack or abuse of
authority is almost always an anomaly. The task is not to miss it and not to
raise false alarms too often.
Detection of abnormal activity
Quite a lot of methods have been proposed to identify anomalous
activity: neural networks, expert systems, statistical approach.
The statistical approach can be divided into cluster and factor analysis,
as well as discriminant (classification) analysis. Without going into details,
we point out that the literal application of these methods does not give good
294
results; it is necessary to take into account the specifics of the subject area —
active auditing.
Statistical analysis (subject to the reservations made) seems to be the
most promising, partly “by contradiction”, due to the shortcomings inherent
in other approaches.
Neural networks have two main problems:
1) incomprehensibility of the results: the neural network makes a
decision, but does not explain why it was made;
2) lack of adequate training material: it is impossible to create a
database of all types of anomalies.
The main disadvantage of expert systems is their inability to identify
(and, therefore, repel) unknown attacks.
The statistical approach also has problems:
1) relatively high probability of false alarms (atypical behavior does
not always mean malicious intent);
2) poor performance in cases where user actions do not have a specific
pattern, when users commit malicious actions from the very beginning
(malicious actions are typical), and finally, when the user gradually changes
the pattern of his behavior towards malicious actions.
However, these problems can be dealt with.
Detection of anomalous activity using statistical methods is based on
comparing short-term behavior with long-term behavior. To do this, the
values of some parameters of the operation of subjects (users, applications,
equipment) are measured. The parameters may differ in nature; The
following groups can be distinguished:
• categorical (changed files, executed commands, port number, etc.);
• numeric (processor time, memory size, number of files viewed,
number of bytes transferred, etc.);
• intensity values (number of events per unit of time);
• distribution of events (such as file access, printing, etc.).
Analysis algorithms can work with heterogeneous values, or they can
convert all parameters to one type (for example, dividing the value area into
a finite number of subareas and treating all parameters as categorical). The
295
choice of performance characteristics to measure is a very important point.
On the one hand, an insufficient number of recorded parameters can lead to
an incomplete description of the subject’s behavior and to a large number of
missed attacks; on the other hand, too many features to track will require
too much memory and slow down the analysis algorithm.
Parameter measurements are accumulated and converted into
profiles — descriptions of the work of subjects. The essence of converting
multiple measurement results into profiles is information compression. As
a result, only a few values of statistical functions should remain from each
parameter, containing the data necessary for the analyzing algorithm. In
order for profiles to adequately describe the behavior of a subject, it is
necessary to discard old parameter values when recalculating the values of
statistical functions. To do this, as a rule, one of two methods is used:
Sliding window method — measurement results for a certain period of
time (for long-term profiles — several weeks, for short-term profiles —
several hours) are saved. When new results are added, old ones are
discarded. The main disadvantage of the sliding window method is the large
amount of stored information.
Weighted sum method — when calculating the values of statistical
functions, older data is included with smaller weights (as a rule, new
function values are calculated using a recurrent formula, and there is no need
to store a large amount of information). The main disadvantage of the
method is the lower quality of description of the subject’s behavior than in
the sliding window method.
So, long-term profiles contain information about the behavior of
subjects over the past few weeks; they are usually recalculated once a day,
when the system load is minimal. Short-term profiles contain information
about behavior over the past few hours or even minutes; they are
recalculated when new measurement results arrive.
Comparisons between short-term and long-term profiles can be made
in different ways. You can simply check whether all short-term values fall
within the confidence intervals constructed using the long-term profile.
However, in this case, anomalies distributed over several parameters may
296
go unnoticed. Therefore, it is preferable to analyze profiles in aggregate.
Further, the characteristics being measured are generally not independent,
so it would be desirable for the influence of the parameters on the decision
about the typicality of behavior to be proportional to the degree of their
independence.
A useful numerical characteristic is the number of errors recorded. In
this case, not only malicious behavior is detected, but also malfunctions and
failures of hardware and programs, which can also be considered a violation
of information security. Of course, it is advisable to measure the volume of
network traffic as well. Deviations in both directions are abnormal (too
much traffic — the service is used for malicious purposes, too little — the
availability of the service is impaired).
For network traffic and some other events, intensity is a useful class
of quantities.
For the success of a statistical approach, the correct choice of subjects
whose behavior is analyzed is important. For example, it is advisable to
analyze the behavior of services or their components (for example, access
of anonymous users to an FTP service). Compared to individual users, the
behavior of services is more stable, and services are important for the
information security of an organization. There is no point in analyzing
network traffic “in general”; it also needs to be structured by the types of
supported services (plus service issues of the network and transport levels,
such as establishing connections).
Responding to suspicious activity
Once a malicious signature or unusual activity is detected, an
appropriate response must be selected. For many reasons, it is convenient
for the response component to contain its own logic, filtering alarms and
correlating messages coming from the analysis subsystems. For an active
audit, the following are equally dangerous:
• missing attacks means that proper protection is not provided;
• a large number of false alarms — this means that active auditing will
be quickly disabled.
297
When choosing a response, it is especially important to determine the
root cause of the problems. For network systems this is especially difficult
due to the possibility of spoofing addresses in packets. This example shows
that powerful tools that try to influence an attacker can themselves become
an indirect way to carry out attacks.
Quieter, but also quite effective measures are preferable, such as
blocking malicious network traffic using firewalls (a number of active audit
systems can manage the configuration of screens) or forcefully terminating
the user’s session. Of course, even here remains the danger of punishing an
innocent person, so the security policy of each organization should
determine what is more important — not to miss a violation or not to offend
a loyal user.
From a rapid response perspective, traditional measures involving
informing the administrator are not particularly effective. They are good in
the long term, for global security analysis by a team of professionals. Here,
active audit merges with passive auditing, ensuring compression of
registration information and its presentation in a form convenient for
humans.
A reasonable response to suspicious activity may include increasing
the granularity of protocols and activating integrity controls. In principle,
these are passive measures, but they will help to understand the causes and
course of development of the violation, so that it will be easier for a person
to choose a “preventive measure.”
Security system testing methods
Testing of the AS protection system is carried out to check the
effectiveness of the protection mechanisms used in it, their resistance to
possible attacks, and also to find vulnerabilities in the protection.
Traditionally, two main testing methods are used:
1) testing using the “black box” method;
2) testing using the “white box” method.
298
Black box testing assumes that the testing party does not have any
special knowledge about the configuration and internal structure of the test
object. In this case, all known types of attacks are implemented against the
test object, and the stability of the protection system against these attacks is
checked. The testing methods used emulate the actions of potential attackers
trying to hack the security system. The main testing tool in this case is
network scanners that have databases of known vulnerabilities.
The “white box” method involves drawing up a testing program based
on knowledge about the structure and configuration of the test object.
During testing, the presence and operability of security mechanisms,
compliance of the composition and configuration of the protection system
with security requirements and existing risks are checked. Conclusions
about the presence of vulnerabilities are made based on an analysis of the
configuration of the security tools and system software used, and then tested
in practice. The main analysis tool in this case is the software agents of
system-level security analysis tools, discussed below.
7.2.4. Security analysis tools
The arsenal of software tools used to analyze the security of speakers
is quite wide. Moreover, in many cases, freely distributed software products
are in no way inferior to commercial ones. It is enough to compare the noncommercial Nessus scanner with its commercial counterparts.
One of the methods for automating the processes of analyzing and
monitoring the security of distributed computer systems is the use of
intelligent software agent technology. The protection system is based on a
console/manager/agent architecture. A software agent is installed on each of
the monitored systems, which performs the appropriate software settings
and verifies their correctness, monitors the integrity of files, the timeliness
of installation of software correction packages, and also performs other
useful tasks to monitor the security of the system. Agents are managed over
the network by a manager program.
299
Managers are the central components of such systems. They send
control commands to all agents in the domain they control and store all data
received from agents in a central database. The administrator manages
managers using a graphical console, which allows them to select, configure
and create security policies, analyze changes in system state, rank
vulnerabilities, etc. All interactions between agents, managers and the
management console are carried out using a secure client-server protocol.
This approach was used to build a comprehensive security management
system for the organization, Symantec ESM.
Another widely used method of security analysis is active testing of
security mechanisms by emulating the actions of an attacker to attempt
network intrusion into the AS. For these purposes, network scanners are
used that emulate the actions of potential violators. The work of network
scanners is based on a database containing a description of known
vulnerabilities of the OS, firewall, routers and network services, as well as
algorithms for carrying out intrusion attempts (attack scenarios). The Nessus
and Symantec NetRecon network scanners discussed below are worthy
representatives of this class of security analysis software tools.
Thus, security analysis software can be divided into two classes. The
first class, to which network scanners belong, is sometimes called networklevel security analysis tools. The second class, which includes all the other
tools discussed here, is sometimes called system-level security analysis
tools. These classes have their own advantages and disadvantages, and in
practice they complement each other.
For the network scanner to function, only one computer is required
that has network access to the systems being analyzed, therefore, unlike
products built on software agent technology, there is no need to install its
own agent (one for each OS) on each system being analyzed.
The disadvantages of network scanners include the large amount of
time required to scan all network computers from one system and the
creation of a large load on the network. Additionally, it is generally difficult
to distinguish a scanning session from actual attack attempts. Network
scanners are also successfully used by attackers.
300
Security analysis systems built on intelligent software agents are
potentially more powerful tools than network scanners. However, despite
all its advantages, the use of software agents cannot replace network
scanning, so it is better to use these tools together. In addition, scanners are
a simpler, more accessible, cheaper, and in many cases more effective
means of security analysis.
Protection parameters analysis tools
(Security Benchmarks)
The level of protection of computer systems from security threats is
determined by many factors. In this case, one of the determining factors is
the adequacy of the configuration of system and application software,
information security tools and active network equipment to existing risks.
The listed AS components have hundreds of parameters, the values of which
affect the security of the system, which makes their manual analysis a
difficult task. Therefore, in modern systems, specialized software is often
used to analyze the configuration parameters of system and application
software, hardware and information security tools.
The analysis of security parameters is carried out using templates
containing lists of parameters and their values that must be set to ensure the
required level of security. Different templates define configurations for
different software and hardware.
Regarding commercial corporate networks connected to the Internet,
we can talk about a certain basic level of security, which in most cases can
be considered sufficient. The development of specifications (templates) for
the configuration of the most common system software, allowing to ensure
a basic level of security, is currently carried out by representatives of the
international community represented by organizations and individuals
professionally involved in the issues of information security and AS audit,
under the auspices of the international organization Internet Security Center
(Center of Internet Security). At the moment, the following specifications
(Security Benchmarks) have been completed or are under development:
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]