Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
301
• Solaris (Level-1);
• Windows 2000 (Level-1);
• CISCO IOS Router (Level-1/Level-2);
• Linux (Level-1);
• HP-UX (Level-1);
• AIX (Level-1);
• Check Point FW-1/VPN-1 (Level-2);
• Apache Web Server (Level-2);
• Windows NT (Level-1);
• Windows 2000 Bastion Host (Level-2);
• Windows 2000 Workstation (Level-2);
• Windows IIS5 Web Server (Level-2).
In this list, the Level-1 specifications define the basic (minimum) level
of protection that is required to be provided for most systems with Internet
connections. Level 2 specifications define an advanced level of protection
required for systems that have high security requirements.
The listed specifications are the result of a generalization of global
experience in ensuring information security.
To analyze the configuration of speaker components for compliance
with these specifications, specialized testing software (CIS-certified scoring
tools) is used.
As an example, consider the specification of the basic level of
protection for the MS Windows OS and the corresponding software tools
for analyzing the OS configuration.
Network scanners
The main factor determining the security of an AS from security
threats is the presence of security vulnerabilities in the AS. Security
vulnerabilities can be caused by both errors in the configuration of AS
components and other reasons, which include errors and bugs in the
software code, lack of security mechanisms, their misuse or inadequacy to
existing risks, as well as vulnerabilities caused by human factor. The
302
presence of vulnerabilities in the AS security system ultimately leads to the
successful implementation of attacks that exploit these vulnerabilities.
Network scanners are perhaps the most accessible and widely used
security analysis tools. The main principle of their operation is to emulate
the actions of a potential attacker to carry out network attacks. Searching for
vulnerabilities by simulating possible attacks is one of the most effective
ways to analyze the security of an AS, which complements the results of
pattern-based configuration analysis performed locally using templates
(check lists). A scanner is a necessary tool in the arsenal of any administrator
or AS security auditor.
Modern scanners are capable of detecting hundreds of vulnerabilities
in network resources that provide certain types of network services. Their
predecessors are considered to be phone number scanners (war dialers),
which were used since the early 80s and have not lost their relevance to this
day. The first network scanners were simple Shell scripts that scanned
various TCP ports. Today they have evolved into mature software products
that implement many different scanning scenarios.
A modern network scanner performs four main tasks:
1) identification of available network resources;
2) identification of available network services;
3) identification of existing vulnerabilities of network services;
4) issuing recommendations to eliminate vulnerabilities.
The functionality of the network scanner does not include issuing
recommendations on how to use found vulnerabilities to carry out attacks
on network resources. The scanner’s ability to analyze vulnerabilities is
limited by the information that available network services can provide
it with.
The principle of operation of the scanner is to simulate the actions of
an attacker who analyzes the network using standard network utilities, such
as host, showmount, traceout, rusers, finger, ping, etc. In this case, known
vulnerabilities of network services, network protocols and OS are used to
carry out remote attacks on system resources and documenting successful
attempts.
303
Currently, there are a large number of both commercial and freely
distributed scanners, both universal and specialized, designed to detect only
a certain class of vulnerabilities. Many of them can be found on the Internet.
The number of vulnerabilities in modern scanner databases is slowly but
surely approaching 1 000.
One of the most advanced commercial products of this class is the
NetRecon network scanner from Symantec, whose database contains about
800 vulnerabilities of UNIX, Windows and NetWare systems and is
constantly updated via the Web. Consideration of its properties will allow
you to get an idea of all the products in this class.
NetRecon network scanner. The NetRecon network scanner is a
security administrator tool designed to examine the structure of networks
and network services and analyze the security of network environments.
NetRecon allows you to search for vulnerabilities in network services, OS,
firewalls, routers and other network components. For example, NetRecon
allows you to find vulnerabilities in network services such as ftp, telnet,
DNS, email, Web server, etc. This checks the versions and configurations
of services, their security from network threats and resistance to penetration
attempts. To search for vulnerabilities, both standard tools for testing and
collecting information about the configuration and functioning of the
network, and special tools that implement algorithms that emulate the
actions of an attacker to carry out network attacks are used.
The program runs in the Windows NT OS environment and has a
convenient graphical interface that allows you to define scanning
parameters, monitor the scanning progress, generate and view reports on
scanning results. The results are displayed in graphical and tabular form in
real time.
The reports generated by NetRecon contain detailed information about
the vulnerabilities found, including weak user passwords, exposure of
certain services to denial of service threats, OS configurations vulnerable to
network attacks, and many others. Along with messages about found
vulnerabilities and their descriptions, recommendations for eliminating
304
them are provided. The report on the scan results allows you to outline an
action plan to eliminate the identified deficiencies.
NetRecon independently determines the network configuration and
allows you to select network resources for scanning. Parallel scanning of all
network resources, scanning across a range of network addresses, scanning
of individual systems or subnets can be carried out. A scanning session can
include all types of scans or individual scans at the user's discretion. The
scanning depth is determined by the duration of the scanning session, which
is specified by the user. For example, checks associated with guessing user
passwords using a dictionary are time-consuming and cannot be completed
during a short scanning session.
NetRecon allows the user to track the vulnerability search path, which
is the sequence of checks performed by NetRecon that led to the
identification of a given vulnerability. The vulnerability search path allows
you to trace the actions of a possible intruder carrying out an attack on
network resources.
The database used by NetRecon contains descriptions of known
vulnerabilities and attack scenarios. It is regularly updated with new data.
This database is updated automatically through the Symantec Web site using
the LiveUpdate mechanism.
Network scanner NESSUS. The Nessus network scanner can be
considered as a worthy alternative to commercial scanners. Nessus is a
freely distributed and constantly updated software product. A convenient
graphical interface allows you to define the parameters of a scanning
session, monitor the scanning progress, create and view reports.
In terms of its functionality, the Nessus security scanner is on par with,
and in some respects even surpasses, such well-known commercial scanners
as NetRecon from Symantec and Internet Scanner from ISS.
Version 0.99 of the server part of the Nessus scanner was certified by
the State Technical Commission of Russia (Certificate No. 361 dated
September 18, 2000).
305
Nessus provides very broad capabilities for searching for
vulnerabilities in corporate networks and examining the structure of
network services. In addition to using standard TCP and UDP port scanning
methods, Nessus allows you to search for vulnerabilities in implementations
of the ICMP and SNMP network management protocols.
High scanning speed is achieved through the use of a multi-threaded
programming architecture when implementing the Nessus scanner, which
allows simultaneous parallel scanning of network hosts. To scan each host,
the nessusd server creates a separate thread of execution.
When implementing Nessus, a client/server architecture atypical for
network scanners was used. Interaction between the client and the server is
carried out using a secure client-server protocol, which provides for the use
of a reliable authentication scheme and encryption of transmitted data.
All scanning scenarios are divided into groups according to the types
of network attacks they implement, the vulnerabilities they detect, as well
as the types of network services being tested. So, there are special groups of
scenarios:
• Backdoors to detect Trojan programs;
• Gain Shell Remotely — to implement attacks on obtaining user
privileges on a remote UNIX system;
• Firewalls — for firewall testing;
• FTP — for testing FTP servers;
• Windows — to search for vulnerabilities in Windows systems, etc.
A special group of Denail of Service scanning scenarios are denial of
service (DoS) attacks. The only way to be sure that the system being scanned
is susceptible to one or another DoS is to perform this attack and see how
the system reacts. This group of scripts, however, is potentially dangerous,
since their launch can lead to unpredictable consequences for the scanned
network, including failures in the operation of servers and workstations, data
loss and “complete paralysis” of the corporate network. Therefore, most
DoS in this group is disabled by default.
306
7.2.5. Architecture of audit systems [14]
For active audit systems, it is advisable to distinguish between local
and global architecture.
Within the local architecture, elementary components are
implemented, which can then be combined to serve corporate systems.
The main elements of the local architecture and the connections
between them are shown in Fig. 7.3. The primary data collection is carried
out by agents, also called sensors. Registration information can be extracted
from system or application logs (technically it is not difficult to obtain it
directly from the OS kernel) or obtained from the network using the
appropriate mechanisms of active network equipment or by intercepting
packets using a network card set to monitoring mode.
Сетевой сенсор
Системный
сенсор
Прикладной
сенсор
Сенсор сервиса
безопасности
Другие сенсоры
Унификация данных,
фильтрация, сохранение
Хранилище регистрационной
информации
Выявление
злоумышленной
активности
Выявление
аномальной
активности
Возбуждение
тревог,
автоматическое
реагирование,
сохранение данных
о подозрительной
активности
Хранилище данных
о подозрительной
активности
Анализ ситуации,
принятие решений,
контроль за
работой подсистем
безопасности
Сенсоры
Центр распределения
регистрационной
информации
Анализ
регистрационной
информации,
выявление
подозрительной
активности
Реагирование
Администратор
безопасности
Fig. 7.3. Basic elements of local architecture
of active audit systems
307
At the agent (sensor) level, data can be filtered to reduce its volume.
This requires some intelligence from the agents, but it relieves the rest of
the system components.
Agents transmit information to the distribution center, which reduces
it to a unified (standard for a specific active audit system) format, possibly
carries out further filtering (reduction), stores it in a database and sends it
for analysis to statistical and expert components. One distribution center can
serve several sensors.
A meaningful active audit begins with statistical and expert
components (for example, because for single-host systems, registration
information does not need to be retrieved and transmitted in any special
way). We’ll look at them in detail in the next two sections.
If suspicious activity is detected through statistical or forensic
analysis, a report is sent to a decision maker who determines whether the
alarm is warranted and decides how to respond.
Usually, when they write about response methods, they list sending a
message to the administrator’s pager, sending an email to him, etc., that is,
they mean “manually” taking action after receiving a signal about suspicious
activity. Unfortunately, many modern attacks last seconds or even fractions
of a second, so including a human in the response process introduces an
unacceptably long delay. Responses must be automated to the greatest
extent possible, otherwise audit activity becomes largely meaningless.
Automation is also needed for the simple reason that not all
organizations have system administrators with sufficient qualifications to
adequately respond to incidents. A good active audit system should be able
to clearly explain why it raised an alarm, how serious the situation is, and
what the recommended course of action is. If the choice must be left to the
individual, then let it come down to a few menu items rather than solving
conceptual problems.
Global architecture implies the organization of single- and multirank connections between local active audit systems (see Fig. 7.4). At one
level of the hierarchy there are components that analyze suspicious activity
from different points of view. For example, the host may host user and
308
application behavior analysis subsystems. They can be supplemented by a
network activity analysis subsystem. When one component detects
something suspicious, it is often advisable to report it to neighbors, either to
take action or to increase attention to certain aspects of the system’s
behavior.
Комплексный
анализ в
рамках сегмента
сети №1
Анализ сетевой активности
Анализ системной активности
Анализ активности приложений
Анализ активности пользователей
Анализ активности
сервисов безопасности
Анализ других
аспектов активности
Комплексный
анализ в
рамках сегмента
сети №2
….…
Системы анализа более высоких уровней
Fig. 7.4. Global Active Audit System Architecture
Multi-rank connections are used to summarize the results of the
analysis and obtain a holistic picture of what is happening. Sometimes the
local component does not have enough grounds to raise an alarm, but
“collectively” suspicious situations can be combined and jointly analyzed,
after which the suspicion threshold will be exceeded. A holistic picture may
make it possible to identify coordinated attacks on different parts of the
information system and assess the damage throughout the organization.
Obviously, the formation of a hierarchy of active audit components is
also necessary to solve scalability problems, but this aspect is standard for
management systems and we will not dwell on it.
Critical architectural decisions include what information to collect and
analyze at what scale. The first active audit systems were single-host. Then
multi-host configurations appeared. We owe the breakthrough in the field
of commercial products to network systems that analyzed exclusively
network packets.
309
Today, we can see a convergence of architectures, resulting in
complex systems that monitor and analyze both computer and network
registration information.
The traditional question is: where to place the sensors of active audit
systems?
The equally traditional answer is: “wherever possible.” Only an
analysis of all available sources of information will make it possible to
reliably detect attacks and abuses of authority and get to the bottom of their
root causes. If we return to the interpretation of the information system as a
set of services, then the means of detecting attacks should be located in front
of the protected resources (bearing in mind the direction of movement of
requests to the services), and the means of detecting abuse of authority
should be located on the services themselves. Detection of anomalous
activity is useful at all points mentioned. Only with such placement of
sensors will the most important principle of the impossibility of bypassing
protective equipment be met. In addition, the number of sensors will be
minimized, which also turns out to be a problem in conditions of network
segmentation and the use of switching technologies.
In order for an active audit system, especially a distributed one, to be
practically useful, it is necessary to ensure the integrity of the analyzed and
transmitted information, as well as the integrity of the software system itself
and its survivability in conditions of failure or compromise of individual
components (often an attack is directed first at security means, and only
then — for application components). It is clear that this is a problem for all
distributed systems, and mutual authentication and integrity control services
(including data source authentication) are used to solve it.
7.2.6. Requirements for active audit systems
In this paragraph, we will consider the requirements for active audit
systems that are significant from the customers’ point of view. The
requirement of completeness should come first. This is a very
comprehensive concept that includes the following aspects:
310
1. Completeness of tracking information flows to services. Active
auditing should cover all flows of all services. This means that an active
audit system must contain network and system sensors and analyze
information at all levels — from network to application. Obviously, from
the considered aspect of completeness, the requirement of extensibility
follows, since no software product can be initially configured for all
services.
2. Complete range of detected attacks and abuses of authority. This
requirement not only means that the system must have a sufficiently
powerful language for describing suspicious activity (both attacks and abuse
of authority). This language must be simple so that customers can configure
the system in accordance with their security policies. The supplier of an
active audit system must transmit signatures of new attacks to the customer
as soon as possible (about 24 hours). The system must be able to detect
anomalous activity in order to cope with previously unknown modes of
disruption.
3. Sufficient performance. An active audit system must cope with peak
loads of protected services.
Missing even one network packet can give an attacker a chance for a
successful attack. If an active auditing system is known to be
underperforming, it may become the target of an availability attack that will
lead to other attacks. For local networks, speeds of 100 Mbit/s have become
standard. This requires the active audit system to have a very high quality
implementation and powerful hardware support. If we consider that the
protected services are in constant development, it becomes clear that the
performance requirement is also a scalability requirement.
In addition to completeness, active audit systems must satisfy the
following requirements:
1. Minimum of false alarms. In absolute terms, no more than one false
alarm per hour is permissible (it is better if there are an order of magnitude
fewer of them). With intensive data flows between services and their clients,
such a requirement turns out to be very stringent. For example, suppose that
1 000 packets pass through the controlled channel per second. In an hour
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]