Importance of Intrusion Detection

Trust can be misplaced during any of the following events:

Computer viruses are the single biggest cause of lost productivity in business environments. The real cost of viruses is not the damage they cause, but the total cost of cleanup to ensure that the infection has not spread throughout the company network. Moreover, Java™ and ActiveX permit the downloading of executable code from the Internet without any assurances of its real purpose. There are many examples of websites that contain ActiveX or Java applets that steal files from your hard drive.

Vulnerability of a system when you download executables from the web depends on its weakest link. For example, a router vendor shipped boxes with a default password that was easy to guess. Most administrators forgot to change the password. Despite investing many hours in correctly configuring the routers for secure operation, their security can be defeated in seconds by an attacker who knew the password.

As more business is done over the Internet, more trust is placed in critical infrastructure elements: the routers, hubs, and web servers that move data around the Internet. This infrastructure also include DNS name servers that enable users to access URLs from their browsers. A DNS server maps names such as www.company.com to an Internet Protocol (IP) address, such as 10.2.3.4. By targeting these important infrastructure services, an attacker can bring down a whole organization. Sometimes attackers do not have to steal your information to hurt you. By simply making your systems unavailable for use, such attackers can cause losses in both revenue and credibility in your industry.

If you do not configure a critical piece of software or hardware properly, your network becomes vulnerable to security attacks. This is a particular problem in the area of firewalls, where configuration rules are complex. One missing rule can leave your whole internal network open to attack.

A code that runs with privileges (such as root on UNIX® systems, or as administrator on Windows NT® systems) is particularly vulnerable, because a simple bug can have a major impact. Codes are not designed to handle security attacks. Moreover, most codes run with more privileges than it needs to accomplish a task. Often a site installs its web server to run as root, granting it far greater privileges than it needs to serve up websites and CGI scripts. Web servers that run as root are easy targets for attack. CGI scripts are easily accessible, and any individual can gain complete root privileges to such systems.

Even if you are not attacked, your company systems can be used to launch an attack on other victims on the Internet.

A firewall is a system that is placed between two networks to control what traffic can pass between those networks. A firewall is usually placed between the Internet and your company intranet. It can be viewed as a useful point of policy enforcement through which you can decide what network traffic is and is not permitted to pass in and out of your organization. When deployed correctly, a difficult task in a complex business environment, a firewall is an efficient tool to prevent attacks on critical systems and data. However, a firewall connected to the Internet cannot protect against an attack on systems launched from inside an organization. Often, it cannot stop an attacker inside your organization from attacking systems on the Internet, that is, your systems can be used as a springboard to attack another victim.

A further complication in deploying firewalls is that it is difficult to establish clearly where the boundary exists between inside and outside. At one time, it was obvious that the Internet was outside and the intranet was inside. However, more and more corporations are joining their intranets in multiple-partner arrangements, often termed extranets. If internal and external systems are included under the same extranets, it becomes difficult to place the firewall at the required location. In such an environment, some form of continuous security monitoring tool is needed to ensure that critical systems are not attacked and valuable data is not being pilfered by partners.

Encryption is a mathematical technique that prevents unauthorized reading and modification of data. With encryption, the intended recipients of data can read it, but no intermediate recipient can read or alter the data. Encryption also authenticates the sender of a message. It ensures that the claimed sender really is the intended sender of the message.

In any well-designed cryptographic system, the heart of the security is the key used to encrypt the message. Knowing this key enables hackers to decrypt any message, alter it, and retransmit it to the sender. Even if the inner workings of the encryption software are known, without the key, hackers cannot read or alter messages.

The problem with relying on encryption lies in system vulnerability. In this case, the weakest link is not the encryption technology but the systems on which the key is stored. How can you be sure that the program you are using to encrypt data has not saved your key to a temporary file on your disk, from which an attacker can later retrieve it? If attackers gain access to your key, not only can they decrypt your data, they can impersonate you and send messages claiming to be signed only by you.

Encryption does not protect data while it is in the clear (not encrypted) as you process it, for example, preparing a document for printing. Moreover, encryption cannot protect your systems against denial-of- service attacks. Despite all the advantages of encryption, it is only part of an overall security solution.

A security auditing tool probes systems and networks for potential vulnerabilities that attackers can exploit, generates a report identifying holes and recommends fixes. Whenever the system administrator finds the holes, he or she must quickly patch them before they are exploited. If a security audit tool used is executed or run regularly, it is a valuable tool to handle security threats or attacks.

Attacks can occur at any point in the day; an attacker can penetrate a system, cover up the tracks, and install a variety of ways to re-enter the system easily and quickly. Running auditing tools every hour gives attackers a good opportunity to exploit your system, before you ever detect them. It is obvious that if some form of continuously running security audit tool is available, it is easier to monitor systems and make them more secure. An intrusion detection system provides this type of security.