RE: Views and Correlation in Intrusion Detection

From: Ron Gula (rgula_at_tenablesecurity.com)
Date: 06/25/03

  • Next message: ravenlord: "Re: Honeyd 0.6: Happy Summer/Pre-Birthday Release -- Plugins" 
    Date: Wed, 25 Jun 2003 11:40:49 -0400
To: Chmielarski TOM-ATC090 <Tom.Chmielarski@motorola.com>, "Focus-Ids (E-mail)" <focus-ids@securityfocus.com>

    >
    >How about a "user's" POV?
    >
    >To be really effective, I'd like to see a system that looks at packets
    >coming in to the network, compares those to packets hitting specific
    >servers, "knows" if the server is vulnerable to the specific attack and
    >*then* sends an alert.
    >
    >To do this kind of work you would need:
    >1) a db (A) with the info on each server - OS, applications,
    >vulnerabilities, etc.
    >2) a detection engine that matches the IP and attack sig to the entry in
    >the db (A) with its own db (B) of sigs
    >3) an escalation procedure that recognizes that attack A was successful and
    >attack B has begun and therefore alerts "more aggressively".
    >
    >I don't want to know if an attacker is trying an overflow attack on my IMAP
    >server if my IMAP server isn't vulnerable to that attack. I could care
    >less. I also don't want to know if some box somewhere with Code Red is
    >hitting my network *unless* I have a box that's susceptible to Code Red.

    This is exactly what the Lightning Console does. In addition, the console
    also 'knows' who owns the targeted systems and can send an alert to the
    effected end users when an IDS event targets a vulnerable server.

    The big issue I have with VA/IDS correlation is the accuracy of the
    underlying VA database. If you are just scanning once a quarter or even
    once a month, this VA database can get out of date fast. Our approach
    is to use distributed scanning (multiple, tiered Nessus scanners) so you
    can scan a class B in hours. We also are BETA testing a passive vulnerability
    scanner which determines vulnerabilities and topology changes from watching
    network sessions.

    Ron Gula, CTO
    Tenable Network Security
    http://www.tenablesecurity.com

    -------------------------------------------------------------------------------
    Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the
    world's premier technical IT security event! 10 tracks, 15 training sessions,
    1,800 delegates from 30 nations including all of the top experts, from CSO's to
    "underground" security specialists. See for yourself what the buzz is about!
    Early-bird registration ends July 3. This event will sell out. www.blackhat.com
    -------------------------------------------------------------------------------

  • Next message: ravenlord: "Re: Honeyd 0.6: Happy Summer/Pre-Birthday Release -- Plugins"

    Relevant Pages

    • RE: Views and Correlation in Intrusion Detection
      ... compares those to packets hitting specific ... >server if my IMAP server isn't vulnerable to that attack. ... if anybody is on my network trying to use /any/ ...
      (Focus-IDS)
    • @stake advisory: Multiple Red-M 1050 Blue Tooth Access Point Vulnerabilities
      ... Multiple Red-M 1050 Blue Tooth Access Point Vulnerabilities ... Bluetooth 1.0/1.1 compatible devices looking to obtain IP network ... Red-M 1050 Access Point TFTP Sever Based Password Attack ...
      (Bugtraq)
    • Re: Views and Correlation in Intrusion Detection
      ... a db with the info on each server - OS, applications, ... vulnerabilities, etc. ... a detection engine that matches the IP and attack sig to the entry in ... hitting my network *unless* I have a box that's susceptible to Code Red. ...
      (Focus-IDS)
    • Tech paper on proposed future generation NIDS
      ... Data is aggregated from the network ... UDP packets, or other incongruity in data and packet types. ... to reduce IDS rule sets and attack proccessing. ... When people in security speak of correlation, ...
      (Focus-IDS)
    • CERT Advisory CA-2003-04 MS-SQL Server Worm
      ... code that most likely exploits two vulnerabilities in the Resolution ... traffic generated between hosts infected with the worm targeting SQL ... Activity of this worm is readily identifiable on a network by the ... protection whatsoever against the initial infection of systems. ...
      (Cert)