In striving for secure networks, it is important to be able to detect security weaknesses or breaches. This can often be accomplished through the use of assessment tools and techniques, also referred to as management controls. We will examine a number of these tools and techniques so that you have an understanding of some common ways to monitor a network to ensure it is not unnecessarily susceptible to known threats. This section will cover the following topics:
- Vulnerability scanning
- Tools
- Risk calculations
- Assessment types
- Assessment techniques
- Design reviews
Vulnerability Scanning
When a network administrator uses tools to seek out possible security weaknesses, he is performing vulnerability scanning. The goal of these scans is to detect and inform the administrator of possible security holes. As these methods help to make an administrator aware of possible threats, they are a vital component of any network security plan.
These tools and techniques simply seek to make the administrator aware. They are relatively passive attempts to identify weaknesses. The do not rectify any problems found, nor do they necessarily exploit any possible weaknesses to determine whether they are true threats, as a penetration tester would. They may create false positives, as they lack context to determine whether a certain configuration is intentional. Even considering their drawbacks, vulnerability scans are a great way to increase an administrator’s knowledge of the network.
Tools
There are a number of classes of tools, each with a specific function, when it comes to monitoring and assessing network security.
Raw data may not be intelligible to even a trained security analyst. In order to view data in a more human readable manner, an administrator may use a protocol analyzer. Any tool that monitors network traffic and reports on the content of that traffic is a protocol analyzer.
A sniffer captures available network traffic and allows an administrator to access the raw data. If, for instance, an administrator knows in advance what specific information to look for, a sniffer may be the best option. A sniffer may provide complete access to view all network traffic.
One basic method of viewing possible vulnerabilities is the use of what is known as a vulnerability scanner. These scanners normally operate over a local network and attempt to discover possible weaknesses, without exploiting those weaknesses, if found.
Vulnerability scanners will typically reveal the number and type of hosts on a network, as well as search for known vulnerabilities on those hosts and enumerate them on a per-host basis.
Vulnerability scanners come in many shapes and sizes, with different focuses. Some scanners may focus on OS or application vulnerabilities, while others scanners, such as nmap or Nessus, may be concerned with only network capabilities or vulnerabilities. Vulnerability scanners can detect and inform administrators of possible weaknesses; however, as with all assessment tools, rectifying any misconfiguration is left to the administrator.
A honeypot is a system placed on a network with the explicit purpose of drawing an attacker’s attentions. These systems are generally closely monitored and often intentionally left slightly less secure. The idea is to trick an attacker into thinking he has gained unauthorized access to a production system, and then monitor the system to gain insight into attack methods and aims. Because honeypots allow an administrator to view an attack as it would occur in the wild, they can be an extremely valuable tool in detecting and identifying the newest forms of attacks.
Rather than deploying a single fake system to draw an attacker’s attentions, a network administrator may deploy a collection of closely monitored systems that communicate with one another. When a number of physical systems or virtual machines are deployed, the resulting group of systems is known collectively as a honeynet. Both honeypots and honeynets should be segregated from any real production information.
A port scanner is a simple tool that attempts to determine which ports respond to network communications requests. An open port usually indicates a specific network service running on that port. As different types of systems respond differently to initial session requests, port scanners will also commonly be able to identify operating system and application versions.
Risk Calculations
When choosing to combat and mitigate threats, we may face situations of limited resources and declining marginal utility. It may not be possible or feasible to fully protect against every imaginable threat. In order to decide where to best invest our security time and money, it can be helpful to perform risk calculations.
Some threats are extremely common but generally low impact, such as a simple spam message. Others may be more impactful but far less frequent. When assessing the impact of a threat, it may be useful to concentrate on the threats that would likely come to fruition, even if there are larger threats that are extremely unlikely.
If you can only protect against a limited number of threats, you should assign protection not necessarily to those threats that are largest or those that are most frequent, but, rather, to those where you can get the best return on your investment.
Assessment Types
There are a number of types of assessments that can be made before deciding where to allocate security resources.
When defending against security threats, it is important to take financial and business impacts into consideration. Your efforts at increasing security should be a net gain for the network once all is said and done.
To perform a quick sanity check on threat mitigation practices, you can multiply the loss expected from a single event (SLE, single loss expectancy) by how often the event would occur over the course of a year (ARO, annualized rate of occurrence) to establish an annual cost from the risk (ALE, annualized loss expectancy). If the cost of the mitigation plus the new ALE is lower than the older ALE, you have likely made a good investment.
A threat assessment attempts to determine which threats may be able to affect your network. Is there an uptick in phishing attempts against your users? Are spammers sending much more traffic to your networks than normal? Are port scans being run against your systems? It is important to be aware of threats that face your network before you can decide on a mitigation strategy.
As was discussed earlier, vulnerability scanners can be a great tool in determining which threats your systems may be insufficiently protected against. Knowing where your vulnerabilities are is a vital first step to eliminating those vulnerabilities.
Assessment Techniques
There are important steps to take that can improve the security and reliability of a network. As security is an ongoing process, it can be useful to take everyday security measures to ensure sufficient knowledge of your computing environment.
One big red flag from a security standpoint can be significant variation from former or expected behavior. Unfortunately, the only way to detect these variations is to know what “normal” looks like for a certain system. Baseline reporting is the process of learning what a system looks like when it is functioning normally. Once a baseline is established, an administrator can much more easily detect significant variations.
For example, imagine an application log is showing 25 SSH login sessions per hour. In a large company, the administrator may not immediately be able to determine whether this is normal behavior or evidence of an attack in progress. With the aid of a baseline, the administrator should easily be able to determine whether this behavior is normal or anomalous.
Changes to applications and other internal development should not necessarily be trusted. Code review practices can ensure that before code is put into use, a second set of eyes views the code. This can protect against both intentional and unintentional lapses in security.
Attack surface is the amount of ways an attacker can interact with your network. Limiting the attack surface is a basic security principle. For instance, an administrator will want to know which ports are open, from where logins are permitted, and how much access each role is granted. The more methods of network interaction are available, the greater the possible attack surface.
You may have an application that relies on a framework that sits on a server that communicates over a network. A security breach in the application, framework, server, or network could put your private data at risk. Each of the components of your network needs to be individually secured, as the security of your data is dependent on end-to-end security, not just the security of any single component.
Design Reviews
When making changes to any program or application, the purpose of the application and its methods of interaction should be considered from a high level. Will encryption be required? Does security need to be built into the application, and supported by the application, or will it be provided by another source? Will the changes to the function of an application increase the attack surface of the network? Can these increased risks be mitigated?
The best method to secure a program is not to attempt to add security after the functionality, but to consider security as a component of the development process.