1. It has to provide general protection at the perimeter from common intrusions.
2. It has to provide visibility into our entire network.  The solution has to collect log data from all firewalls, switches, routers, IDS, and IPS devices and place it in a central repository.  It has to aggregate and correlate the data into meaningful information about the state of the network.  This information must be presented to approved IT personnel via a portal delivered through a browser interface.
3. We have to be able to implement tough access rules at the entry points to the network segments in our data center on which our critical information assets reside.
4. The solution must be able to identify and report on vulnerabilities in our data center.

This list is a high-level version of our requirements, but you get the idea.  As we assessed various solutions, we also asked ourselves whether it was better to meet our monitoring requirements with a managed service or whether we should do it ourselves.  These are our conclusions:

1. The effort in configuring and managing IPS devices is usually at the front end – especially if you just use the default blocking rules and leave IDS turned off.  Based on our research, we believe we can implement an IPS behind our Internet firewall that we can manage with very little recurring cost.
2. Contrary to reports, IDS is not dead.  IDS devices provide an inexpensive, non-intrusive way to gain visibility into our network.  In the graphic below, we show how we plan to leverage it.  IDS solutions are different from IPS.  IDS devices can collect thousands of lines of data each day.  The trick is to sort out the false positives, and try to make some sense out of what’s left.  This function was definitely a candidate for outsourced management.
3. IPS and IDS products are typically not very good at scanning the network to locate vulnerabilities.  So we decided to implement a network scanning tool, the output of which is fed to the SIM database.  But this tool requires regular updating to remain current on known vulnerabilities.  This became one more candidate for outsourced management.
4. Collecting log data from over 30 devices and churning it into SIM dashboard information was found to be another time-consuming task.  This also was a candidate for outsourced management.

Overall, we found that outsourcing the management of the monitoring tools released the Security Team to concentrate on dealing with the findings of the various solutions rather than on managing the tools.  But we also realized that whether we outsourced management of the solution or not, we were ultimately responsible for protecting our network. 

We decided to outsource all aspects of monitoring and the management and presentation of the collected data.  Using a web portal, we’ll have access to information about the health of our network at any time.  We’ll use this information in risk management activities designed to mitigate overall risk to the company’s information assets.  The graphic below is a conceptual depiction of our solution.

Let’s walk through this diagram, starting at the perimeter router.  Packets from the Internet enter our network through this device.  A Network-based IPS (NIPS) is placed behind it.  In this example, the NIPS is positioned in a DMZ. 

All data passing through the DMZ must pass through the NIPS.  In other words, this is an inline device that is configured to fail open. The NIPS will block known packet or network anomalies as well as known network attack signatures.  When an attack is detected, an alert is sent to the responsible security analyst.  All non-attack traffic is allowed to pass through to the internal network.

Upon entering the internal network the packets pass through a core switch.  Attached to the core switch is an IDS Sensor.  This is known as a Network Intrusion Detection System (NIDS).  Unlike a NIPS, a NIDS is not typically placed inline with the data.  This is due to performance issues common with intrusion detection devices.  But we still want to gather all the data passing through the switch.  We do this by configuring one of the switch ports as a Switched Port Analyzer (SPAN).  All traffic passing through the switch is copied to the SPAN port.  The NIDS scans the data and logs the results; it doesn’t block any information.

Also connected to the core switch is another NIPS.  Like the DMZ device, this NIPS is inline with the data and configured to fail open.  It acts as a security gateway between the servers housing the critical business systems and the rest of the network, blocking traffic that it suspects of containing suspect packets.

Note the layered approach to implementing IPS and IDS.  Each of these technologies has strengths and weaknesses.  IPS is great at blocking traffic, but if you tighten the rules too much you might cause your own DoS incident.  On the other hand, IDS is great at collecting large amounts of information about your network traffic, but it isn’t suitable for inline operation.  Nor is it reliable enough to end sessions over which attacks are traveling.  But putting the two technologies together creates a synergistic environment in which each technology helps shore up the weaknesses in the other.

Next, we come to vulnerability scanning.  The vulnerability scanning solution is not pictured in our conceptual drawing.  But it’s a critical piece of our intrusion defense implementation.  NIPS and NIDS are great at providing visibility into the network, but they’re not perfect.  Malicious packets will get through.  So another layer of defense is the process of identifying and remediating hardware and software vulnerabilities.  Regular scans of the network, or of specific network segments, provides a list of vulnerabilities known to exist in operating systems, applications, or network devices.  This information is passed to the portal where we’ll assess the risk posed by the vulnerability and manage remediation activities.

Now we’ll discuss the portal.  Click here to view an example of a security dashboard.  All the information collected by the IPS, IDS, and vulnerability scanner will be aggregated, correlated, and posted to a dashboard like this one.  Further, logs from the network firewalls and switched will be included in the dashboard statistics.  This provides a single window into the health of our network instead of trying to piece it together by looking at 30 or 40 individual logs or reports.

Is this a perfect solution?  Absolutely not.  But it’s good enough.  We implement security solutions based on risk management principles.  The use of sound risk management practices allows us to see just how critical a vulnerability or a potential threat is to our environment.  It also helps us decide what resources to apply to risk mitigation and how much to reduce the risk.  Yes, we will make improvements over time.  No, we probably didn’t do everything we should or could have.  Resource constraints are as real in our organization as they are in yours.  But I believe this is a good start.

Resources:

Juniper IDP Solutions

Verisign Managed Security Services

LURHQ Managed Security Services

Foundstone

ISS

According to Dunn, over 70 PCs were targeted on January 2, 2006 with messages intended to install keyloggers.  This was confirmed by MessageLabs Ltd – the government’s message filtering company.  Luckily, the messages were identified and stopped before they could reach their targets.  The most disturbing piece of information coming out of this incident is the source of the attack – Guangdong Province in China.

An isolated, one-time attack might be passed off as just another malicious individual flexing his muscles.  But this is at least the second incident in which Chinese attackers have targeted foreign governments.  

On November 1, 2004, attackers located in Guangdong Province launched an attack against the U.S. Army facility at Redstone Arsenal.  But this attack is thought to have been successful.  It is believed that U.S. military secrets, including aviation specifications and flight planning software, were stolen.  It is also believed that the intended recipient for this information was the Chinese government.  This successful breach of U.S. Government security is part of an on-going attempt by the Chinese to hack into government computers.  U.S. Officials have named the hackers Titan Rain.

So just how vulnerable is the U.S. infrastructure to cyber attacks by other nations or terrorist groups? 

1. During a 2004 FISMA required audit of security implemented by entities within the Federal government, seven departments failed to achieve a passing grade. Included in the list of failed departments was the Department of Homeland Security (DHS).
2. Congress and the Bush administration cut by 7% the 2005 DHS budget for cyber security programs.
3. In February 2005, The Presidential IT Advisory Committee (PITAC) completed a report entitled “Cyber Security: A Crisis of Prioritzation.”  The following findings and recommendations were presented to the Bush Administration:
1. Finding: ”The Federal R&D budget provides inadequate funding for fundamental research in civilian cyber security.”  Recommendation: The NSF, DHS, and DARPA budgets should be increased significantly.
2. Finding: “The Nation’s cyber security research community is too small to adequately support the cyber security research and education programs necessary to protect the United States.”  Recommendation: Double the size of the civilian cyber security fundamental research community by the end of the decade. 
3. Finding: “Current cyber security technology transfer efforts are not adequate to successfully transition Federal research investiments into civilian sector best practices and products.”  Recommendation: The relationship between the Federal government and the private sector must be strengthened.  Lines of communication and cooperation must be developed and maintained.
4. Finding: “The overall Federal cyber security R&D effort is currently unfocused and inefficient because of inadequate coordination and oversite.”  Recommendation: The Interagency Working Group on Critical Information Infrastructure Protection should become the focal point of R&D efforts, coordinating and priortizing all activities.
4. In December 2005, the members of the Cyber Security Alliance expressed to the Bush Administration its frustration with the lack of progress made in addressing online crime.  The Group - including organizations like Computer Associates, McAfee, Symantec, and RSA – believes that the lack of support and leadership shown by the Federal Goverment threatens the economy and national security.

We should not expect the Federal goverment to solve all our problems.  But we should expect leadership when national security and the overall public welfare are threatened.  Congress and the President must change their priorities when addressing cyber security within the context of overall defense and social spending.  If this does not happen, hackers will continue to outstrip our ability to protect our national infrastructure; terrorists and foreign governments will find us a soft target.

Author:  Tom Olzak 

Sources:

Security experts lift lid on Chinese hack attacks

Tech Group Blasts Federal Leadership on Cyber-Security

PITAC Report on Cyber Security, February 2005

There’s nothing wrong with it if the security manager and her boss understand that this period of calm is temporary.  As attackers come up with new ways to penetrate and compromise business networks, security teams must remain flexible, continuously working to adjust safeguards to keep the network safe. 

Too often these periods of safe computing are perceived by management as an end state.  In other words, security efforts have achieved their objectives; it’s time to move on to something else.  This is dangerous thinking.  

Security management is an ongoing process.  It requires continous monitoring, analysis, and adjustment to maintain information asset protection at an acceptable level.  It’s the responsibility of the security professional to educate her peers, subordinates, and executive management of this fact.  Failing to do so will inevitably result in a weakened network defense, and an eventual attack causing significant business loss.