Computer security

56 Pages·2001·2.8 MB·English

by  Bace, Rebecca

i
NAT'L INST. OF STAND & TECH ill
Mist'
NIST Special Publication 800-31 Intrusion Detection Systems
NO" Rebecca Bace and Peter Mell
National Institute of Standards
and Technology
Technology Administration
U.S. Department of Commerce
COMPUTER SECURITY
NIST CINTINNI«ll
rhe
National Institute of Standards and Technology was established in 1988 by Congress to "assist industry in
thedevelopmentoftechnology neededtoimproveproductquality,tomodernizemanufacturingprocesses,
. . .
to ensure product reliability . . . and to facilitate rapid commercialization ... ofproducts based on new scientific
discoveries."
NIST, originally founded as the National Bureau of Standards in 1901, works to strengthen U.S. industry's
competitiveness; advance science and engineering; and improve public health, safety, and the environment. One
of the agency's basic functions is to develop, maintain, and retain custody of the national standards of
measurement, and provide the means and methods for comparing standards used in science, engineering,
manufacturing, commerce, industry, and education with the standards adopted or recognized by the Federal
Government.
As an agency of the U.S. Commerce Department's Technology Administration, NIST conducts basic and
applied research in the physical sciences and engineering, and develops measurement techniques, test
methods, standards, and related services. The Institute does generic and precompetitive work on new and
advanced technologies. NIST's research facilities are located at Gaithersburg, MD 20899, and at Boulder, CO 80303.
Major technical operating units and their principal activities are listed below. For more information contact the
Publications and Program Inquiries Desk, 301-975-3058.
Office of the Director Chemical Science and Technology
• National Quality Program Laboratory
• International and Academic Affairs • Biotechnology
• Physical and Chemical Properties^
Technology Services • Analytical Chemistry
• Standards Services • Process Measurements
• Technology Partnerships • Surface and Microanalysis Science
• Measurement Services
Physics Laboratory
• Information Services
• Electron and Optical Physics
Advanced Technology Program • Atomic Physics
• Economic Assessment • Optical Technology
• Information Technology and Applications • Ionizing Radiation
• Chemistry and Life Sciences • Time and Frequency'
• Materials and Manufacturing Technology • Quantum Physics'
• Electronics and Photonics Technology Manufacturing Engineering
Laboratory
Manufacturing Extension Partnership
Program • Precision Engineering
• Manufacturing Metrology
• Regional Programs
• Intelligent Systems
• National Programs
• Fabrication Technology
• Program Development
• Manufacturing Systems Integration
Electronics and Electrical Engineering Building and Fire Research
Laboratory Laboratory
• Microelectronics • Applied Economics
• Law Enforcement Standards • Structures
• Electricity • Building Materials
• Semiconductor Electronics • Building Environment
• Radio-Frequency Technology' • Fire Safety Engineering
• Electromagnetic Technology' • Fire Science
• Optoelectronics'
Information Technology Laboratory
Materials Science and Engineering • Mathematical and Computational Sciences^
Laboratory • Advanced Network Technologies
• Intelligent Processing of Materials • Computer Security
• Ceramics • Information Access
• Materials Reliability' • Convergent Information Systems
• Polymers • Information Services and Computing
• Metallurgy • Software Diagnostics and Conformance Testing
• NIST Center for Neutron Research • Statistical Engineering
CO
'At Boulder, 80303.
^Some elements at Boulder, CO.
Intrusion Detection Systems
NIST Special Publication 800-31
Rebecca Bace^ and Peter Mell^
CA
'infidel, Inc., Scotts Valley,
National Institute ofStandards and Technology
COMPUTER SECURITY
Computer Security Division
Information Technology Laboratory
National Institute of Standards and Technology
MD
Gaithersburg, 20899-8930
November 2001
U.S. Department ofCommerce
DonaldL. Evans, Secretary
Technology Administration
Phillip J. Bond, UnderSecretary ofCommercefor Technology
National Institute ofStandards and Technology
Karen H. Brown, Acting Director
Reports on Computer Systems Technology
The Information Technology Laboratory (ITL) at the National Institute ofStandards and Technology (NIST)
promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement
and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept
implementations, and technical analyses to advance the development and productive use of information
technology. ITL's responsibilities include the development of technical, physical, administrative, and
management standards and guidelines for the cost-effective security and privacy of sensitive unclassified
information in Federal computer systems. This Special Publication 800-series reports on ITL's research,
guidance, and outreach efforts in computer security, and its collaborative activities with industry, govemment,
and academic organizations.
National Institute of Standards and Technology Special Publication 800-31
Natl. Inst. Stand. Technol. Spec. Publ. 800-31, 48 pages (October 2001)
CODEN: NSPUE2
GOVERNMENT PRINTING OFFICE
U.S.
WASHINGTON:
2001
For sale by the Superintenden—t ofDocuments, U.S. Gov—emment Printing Office
Internet: bookstore.gpo.gov Phone: [phone] Fax: [phone]
Mail: Stop SSOP, Washington, DC 20402-0001
NIST Special Publication 800-31, Intrusion Detection Systems
Intrusion Detection Systems
L Introduction 1
2. Overview of Intrusion Detection Systems 1
2.1. What Is Intrusion Detection? 1
Why
2.2. Should I use Intrusion Detection Systems? 1
2.2.1. Preventing Problems by Increasing the Perceived Risk ofDiscovery and
Punishment of Attackers 2
2.2.2. Detecting Problems that Are Not Prevented by Other Security Measures .2
2.2.3. Detecting the Preambles to Attacks (Often Experienced as Network
Probes and Other Tests for Existing Vulnerabilities) 3
2.2.4. Documenting the Existing Threat 3
2.2.5. Quality Control for Security Design and Administration 3
2.2.6. Providing Useful Information about Actual Intrusions 4
2.3. Major Types of IDSs 4
2.3.1. Process Model for Intrusion Detection 4
2.3.2. How Do I Distinguish Between Different Intrusion Detection
Approaches? 4
2.3.3. Architecture 4
2.3.4. Goals 5
2.3.5. Control Strategy 5
2.3.6. Timing 8
2.3.7. Information Sources 9
2.3.8. IDS Analysis 12
2.3.9. Response Options for IDSs 14
2.4. Tools that Complement IDSs 17
2.4.1. Vulnerability Analysis or Assessment Systems 17
2.4.2. File Integrity Checkers 20
2.4.3. Honey Pot and Padded Cell Systems 21
3. Advice on Selecting IDS Products 22
3.1. Technical and Policy Considerations 22
3.1.1. What Is Your System Environment? 22
3.1.2. What Are Your Security Goals and Objectives? 23
3.1.3. What Is Your Existing Security Policy? 24
3.2. Organizational Requirements and Constraints 24
3.2.1. What Are Requirements that are Levied from Outside the Organization?25
3.2.2. What Are Your Organization's Resource Constraints? 25
iii
NIST Special Publication 800-31, Intrusion Detection Systems
3.3. IDS Product Features and Quality 26
3.3.1. Is the Product Sufficiently Scalable for Your Environment? 26
3.3.2. How Has the Product Been Tested? 26
3.3.3. What Is the User Level ofExpertise Targeted by the Product? 26
3.3.4. Is the Product Designed to Evolve as the Organization Grows? 26
3.3.5. What Are the Support Provisions for the Product? 27
4, Deploying IDSs 28
4.1. Deployment Strategy for IDSs 28
4.2. Deploying Network-Based IDSs 29
DMZ
4.2.1. Location: Behind Each External Firewall, in the Network 29
4.2.2. Location: Outside an External Firewall 30
4.2.3. Location: On Major Network Backbones 30
4.2.4. Location: On Critical Subnets 30
4.3. Deploying Host-Based IDSs 30
4.4. Alarm Strategies 31
5, Strengths and Limitations of IDSs 31
5.1. Strengths of Intrusion Detection Systems 31
5.2. Limitations of Intrusion Detection Systems 32
6, Advice on Dealing with IDS Output 32
6.1. Typical IDS Output 32
6.2. Handling Attacks 33
7, Computer Attacks and Vulnerabilities 33
7.1. Attack Types 33
7.2. Types of Computer Attacks Commonly Detected by IDSs 34
7.2.1. Scanning Attacks 34
7.2.2. Denial of Service Attacks 35
7.2.3. Penetration Attacks 36
7.2.4. Remote vs. Local Attacks 36
7.2.5. Determining Attacker Location from IDS Output 37
7.2.6. IDSs and Excessive Attack Reporting 37
7.3. Types of Computer Vulnerabilities 38
7.3.1. Input Validation Error: 38
7.3.2. Access Validation Error: 39
7.3.3. Exceptional Condition Handling Error: 39
7.3.4. Environmental Error: 39
7.3.5. Configuration Error: 39
7.3.6. Race Condition: 39
8, The Future of IDSs 40
iv
NIST Special Publication 800-31, Intrusion Detection Systems
9. Conclusion 40
Appendix A - Frequently Asked Questions about IDSs 41
Appendix B - IDS Resources 43
V

NIST Special Publication 800-31, Intrusion Detection Systems
Intrusion Detection Systems
Rebecca Bace\ Peter Mell''
Introduction
1.
Intrusion detection systems (IDSs) are software or hardware systems that automate the
process ofmonitoring the events occurring in a computer system or network, analyzing
them for signs ofsecurity problems. As network attacks have increased in number and
severity over the past few years, intrusion detection systems have become a necessary
addition to the security infrastructure ofmost organizations. This guidance document is
intended as a primer in intrusion detection, developed for those who need to understand
what security goals intrusion detection mechanisms serve, how to select and configure
intrusion detection systems for their specific system and network environments, how to
manage the output ofintrusion detection systems, and how to integrate intrusion detection
functions with the rest ofthe organizational security infrastructure. References to other
information sources are also provided for the reader who requires specialized or more
detailed advice on specific intrusion detection issues.
2. Overview of Intrusion Detection Systems
What
2.1. Is Intrusion Detection?
Intrusion detection is the process ofmonitoring the events occurring in a computer
system or network and analyzing them for signs of intrusions, defined as attempts to
compromise the confidentiality, integrity, availability, or to bypass the security
mechanisms of a computer or network. Intrusions are caused by attackers accessing
the systems from the Internet, authorized users ofthe systems who attempt to gain
additional privileges for which they are not authorized, and authorized users who
misuse the privileges given them. Intrusion Detection Systems (IDSs) are software or
hardware products that automate this monitoring and analysis process.
Why
2.2. Should I Use Intrusion Detection Systems?
Intrusion detection allows organizations to protect their systems from the threats that
come with increasing network connectivity and reliance on information systems.
Given the level and nature ofmodem network security threats, the question for
security professionals should not be whether to use intrusion detection, but which
intrusion detection features and capabilities to use.
IDSs have gained acceptance as a necessary addition to every organization's security
infrastructure. Despite the documented contributions intrusion detection technologies
make to system security, in many organizations one must stilljustify the acquisition
ofIDSs. There are several compelling reasons to acquire and use IDSs:
1. To prevent problem behaviors by increasing the perceived risk ofdiscovery
and punishment for those who would attack or otherwise abuse the system,
2. To detect attacks and other security violations that are not prevented by other
security measures.
CA
^ Infidel, Inc., Scotts Valley,
National Institute ofStandards and Technology
I
NIST Special Publication 800-31, Intrusion Detection Systems
3. To detect and deal with the preambles to attacks (commonly experienced as
network probes and other "doorknob rattling" activities),
4. To document the existing threat to an organization
5. To act as quality control for security design and administration, especially of
large and complex enterprises
6. To provide useful information about intrusions that do take place, allowing
improved diagnosis, recovery, and correction ofcausative factors.
2.2.1. Preventing Problems by Increasing the Perceived Risk of
Discovery and Punishment ofAttackers
A
fundamental goal ofcomputer security management is to affect the
behavior ofindividual users in a way that protects information systems from
security problems. Intrusion detection systems help organizations accomplish
this goal by increasing the perceived risk ofdiscovery and punishment of
attackers. This serves as a significant deterrent to those who would violate
security policy.
2.2.2. Detecting Problems that Are Not Prevented by Other Security
Measures
Attackers, using widely publicized techniques, can gain unauthorized access
to many, ifnot most systems, especially those connected to public networks.
This often happens when known vulnerabilities in the systems are not
corrected.
Although vendors and administrators are encouraged to address
vulnerabilities (e.g. through public services such as ICAT,
http://icat.nist.gov) lest they enable attacks, there are many situations in
which this is not possible:
• Li many legacy systems, the operating systems cannot be patched or
updated.
• Even in systems in which patches can be applied, administrators
sometimes have neither sufficient time nor resource to track and
install all the necessary patches. This is a common problem,
especially in environments that include a large number ofhosts or a
wide range ofdifferent hardware or software environments.
• Users can have compelling operational requirements for network
services and protocols that are known to be vulnerable to attack.
• Both users and administrators make errors in configuring and using
systems.
• In configuring system access control mechanisms to reflect an
organization's procedural computer use policy, discrepancies almost
always occur. These disparities allow legitimate users to perform
actions that are ill advised or that overstep their authorization.
In an ideal world, commercial software vendors would minimize
vulnerabilities in their products, and user organizations would correct all
reported vulnerabilities quickly and reliably. However, in the real world, this
seldom happens thanks to our reliance on commercial software where new
flaws and vulnerabilities are discovered on a daily basis.
2