Sourcefire Introduces Appliance

Sourcefire will announce a new appliance to compliment their standard IDS sensor, according to eweek:

Security vendor Sourcefire Inc. on Monday will announce a new security appliance that company executives say will make intrusion detection systems more efficient and valuable in enterprise networks. The Real-Time Network Awareness appliance combines vulnerability assessment and correlation with change management in an effort to reduce or even eliminate the false positives and negatives that plague IDS systems.
The RNA box is meant to work in conjunction with Sourcefire's Intrusion Management System, which is based on the open-source Snort IDS. The appliance starts by identifying all of the assets on a network and assessing their current state. Then, it performs continuous monitoring of the network and alerts the administrator to any changes, such as new devices coming online or unusual services being used on a server.

Read More

Cisco Router Evidence Extraction Disk

Router forensics has come to my attention recently. Thomas Akin, author of Hardening Cisco Routers, gave this Black hat 02 presentation and offers CREED, the Cisco Router Evidence Extraction Disk.

Read More

Patching in the Air Force

The 28 May SANS NewsBites reported:

Air Force Service Evaluates Patches (19 May 2003)

The Air Force has established the Enterprise Network Operations Support Cell (ENOSC), a software patch service. Patches are tested by the Air Force Computer Emergency Response Team which assesses its effectiveness and assigns it a number indicating its likelihood of interfering with other software. The patch along with that information is placed on the site and administrators can decide if it's an appropriate patch for their systems. ENOSC supports Windows 9x, NT 4.0, 2000 and XP, as well as Exchange Server and Internet Explorer. It also supports Sun Solaris and plans to add Linux and HP-UX.
http://www.gcn.com/22_11/security/22059-1.html

This sounded suspicious to me, as the original article says:

"When a patch comes out for those OSes or applications, the Air Force Computer Emergency Response Team judges its effectiveness—that is, does it in fact fix the problem? A nine-member ENOSC team evaluates the patch’s impact on the OS and on the applications likely to be running under it."

One of my friends at the AFCERT confirmed that the AFCERT is NOT testing patches. The ENOSC performs the testing, while the AFCERT issues compliance orders. The AFCERT is not equipped to test patches, and that is not its primary mission anyway.

Read More

Reducing IDS Alerts

The same issue of SC Magazine offered an article on reducing IDS false positives by altering the behavior of Windows Media Player -- not ignoring alerts. What ingenuity! I'd like to see more of this sort of thinking.

Read More

Gunter Ollmann Doesn't Like Hacking Exposed

This article by Gunter Ollmann of ISS takes a swipe at readers of the best-selling Hacking Exposed book series. Gunter manages to offend both prospective clients and those who perform his so-called "blind penetration tests," which apparently are inferior to his "crystal box penetration tests." From the article:

I call such prospective clients HE-men (after the Hacking Exposed line of books). They are proof that a little knowledge in the wrong hands really can do a lot of damage...a ‘blind’ penetration test will take considerably longer to discover the same number of security flaws. When conducting a full-knowledge (i.e. ‘crystal-box’) penetration test, it is a simple process to indicate within a report what information was necessary to make the security findings and what level of skill or knowledge an attacker would need to exploit any vulnerabilities. Thus, a full-knowledge penetration test provides the same, or greater, level of security information for less time and cost. I would question anyone trying to sell a ‘blind’ penetration test for less than the cost of a full-knowledge penetration test.

-- end quote --

It sounds like Gunter doesn't understand the difference between a vulnerability assessment and a penetration test. He uses the latter term but describes the former. A vulnerability assessment involves discovering and documenting vulnerabilities, whether with "blind" or "crystal box" knowledge of the target. A penetration test moves beyond discovery to actual compromise, where the analyst exploits targets to gain greater access to the victim network and implement a real-world intrusion scenario. This usually tests the client's response and remediation processes. This opinion isn't just mine -- Google produced this Red Hat Security Guide and I read a recent Rik Farrow article as well.

Read More

CAIDA Tool Taxonomy

I continue to research ways to capture information useful for network security monitoring. I found CAIDA's tools taxonomy helpful. RMON (Remote Monitoring) is one solution, especially since it can support full packet capture. (See the IETF charter, mailing list, and Cisco overview.) NetScout probes are a commercial option, although it seems ntop (mailing list) can be modified to collect RMON data. Cisco's NetFlow data appears useful. Competitors include sFlow and nFlow.

Read More

Prevention Always Fails

Network Magazine's May issue featured the article Emerging Technology: Detection vs. Prevention - Evolution or Revolution?. This is another case where a policy enforcement mechanism is confused with a policy audit and verification system. Policy enforcement mechanisms include firewalls, routers with access control lists, and so-called "intrusion prevention systems," which are simply layer 7 firewalls. Policy audit and verification systems include some traditional intrusion detection products, along with traffic collection systems like Argus and Sandstorm's NetIntercept. Is Marty Roesch the only high-profile person who understands this? From the article:

"Gartner sees IPS as the next generation of IDS, when they're likely the next generation of firewall," says Marty Roesch, founder of Sourcefire, an IDS vendor. Roesch is also the creator of Snort, an open-source, rules-based language for writing detection signatures.

Roesch insists that IDSs and IPSs are separate technologies with mutually exclusive functions. "IPS is access control, and IDS is network monitoring. IPS is policy enforcement, and IDS is audit. It's not the IDS's job to secure your network. Its job is to tell you how insecure it is."

But Roesch's distinction may not resonate in the wider security market. "Joe Average doesn't want to monitor traffic and comb through data and make changes in rules and policies based on detected attacks," says Jeff Wilson, executive director of Infonetics Research (www.infonetics.com). "They want to stop attacks."

-- end article --

Fine -- prevention is always preferable to detection. But prevention always fails, at some point. How do you determine the scope of a compromise when your IPS fails to detect and prevent an attack? You better be able to fail back on your audit capabilities, which log what they see and make no value judgements.

Read More