Now that we have covered various threats and vulnerabilities in depth, we will take a closer looks at the types of protections and best practices available to deter attacks and mitigate the damage they can inflict. This section will cover the following topics:
- Manual bypassing of electronic controls
- Monitoring system logs
- Physical security
- Hardening
- Port security
- Security posture
- Reporting
- Detection controls versus prevention controls
Manual Bypassing of Electronic Controls
Electronic controls for adding physical security can include such devices as card or keyfob readers to open and operate doors. The linking of physical security with electronic control means an attacker who gains control of either portion of the system will be able to bypass the protections.
In the event of a failure of the electronic portion of an integrated security device, the physical portion can fail to a closed/secure/safe state or to an insecure/open state. For instance, an external door leading in to a secured area might be configured to fail to a closed state, while a mantrap should allow someone inside to back out in case of a power outage. Fail safe should be used in situations where security is paramount, while fail open should be used where ease of use/continuity of availability is more important.
Monitoring System Logs
Attackers often leave traces of their access and of failed attempts to gain access to secured systems. These traces, however, will not be of use in protecting your systems unless this information is seen and acted upon. Therefore, someone must be monitoring system logs.
An administrator who regularly reviews his logs will not have to rely on catching an attacker in the act if he knows where to check for evidence of infiltration. There are many types of logs, and it is important to know where to look to protect against threats.
Event logs are generated by network devices to create a record of actions a device takes or changes a device observes. If an attacker is starting service outside of a planned maintenance window, event logs may be the first sign of unauthorized access or use of the systems. Event logs can also track such important events as connections being interrupted, systems going offline, or unexpected errors in running processes.
Audit logs track changes made to a certain portion of a system. A complete audit log for a file, for instance, would track the creation of a file and every time the file was edited, and who made the changes to the file. One common use of audit logging is to track changes to values in a database. The balance of a bank account, for instance, would exist not just for the current time but also for a list of transactions going back for the length of the audit trail. Audit logs are useful for tracking changes to the state of systems, and verifying who made the changes.
Security and access logs track security-related events, such as login and authentication attempts. They will likely include the type of authentication attempted and the result of the authentication attempt. Security logs may include events where a security policy prevented an end-user from completing a certain action, such as accessing restricted data. Access logs will track every access or attempted access of sensitive data to deter unauthorized access the same way an audit log tracks every change to data to ensure data integrity.
Physical Security
Hardware locks can be used to prevent unauthorized access to an area as large as a building complex or an area even smaller than a jewelry box. Though locks come in all shapes and sizes, their intent is the same: to require the operator of the lock to authenticate before allowing access.
Mantraps are a type of security checkpoint that is often employed to protect access to highly sensitive areas. A mantrap functions by allowing a single person to enter into a small room between two sets of doors. Once the outside door has sealed shut, the authenticating person will be locked in the small room until he successfully authenticates, opening the second set of doors. This method of physical security must be monitored, but it is extremely effective at preventing unauthenticated access.
Video surveillance serves two primary purposes. Real-time CCTV monitoring as a detection control may allow a smaller number of security personnel to monitor a much larger area than could be effectively monitored directly. This allows a security force of the same size to secure a much larger area or to secure a smaller area in more detail, or with fewer people. Video surveillance that is archived can also be an excellent source of investigative information, as it provides an unbiased account of what happened in an area under surveillance at any given time.
Access to prohibited areas can be deterred by the addition of fencing. While no fence, by itself, is a guarantee to security, fences can help prevent your secure areas from being low-hanging fruit. A simple low chain-link fence may be a sufficient deterrent, or a barbed-wire fence, or a 12-foot fence with shake detectors to prevent scaling. Fences help to deter casual violation of secure spaces.
Electronic devices such as keycard, badge, or key-fob readers may be employed to require anyone accessing an area to be in possession of a device that is granted only to certain people. This approach has all the advantages of a key, with the added benefits of an increased layer of difficulty in replicating the electronic authentication mechanism, as well as having the ability to assign each user a unique and revocable keycard.
Physical security does not require additional technology. It can be as simple as a person standing at a door or a gate who allows only people on a pre-approved list to gain access.
Hardening
When it comes to protecting systems from threats, one of the most basic and most effective steps you can take is to reduce the number of avenues an attacker can take to find successful exploits by disabling unneeded services. This is known as reducing the attack surface area, or hardening. Another basic step for initially securing systems is to establish secure settings when it comes to changing default usernames and passwords, and disabling those accounts that are not necessary or are not in use. Systems can be further secured by being configured to failsafe, or fail closed, so that an unexpected state causes a service interruption rather than a possible security breach.
Another basic step to establishing a secure system is to patch it to the current level. Patch not just the operating system but also the applications in use on the system. All the initial steps to establish basic security of a system are collectively known as hardening. A hardened server, just like a lot surrounded by a fence, is no longer as easy a target as it once was.
Port Security
Physical port security is a concept that encompasses the security measures that can be put in place to prevent any given device with physical access to the areas the network exists from gaining access to the network. Often, hackers look for misconfigured proxy servers to hide their origins by bouncing their traffic off these “open relays”.
MAC addresses are unique identifiers that every Ethernet device is assigned. Filters can be set on switches or routers that allow only certain known-good MAC addresses on the network. This is a good basic protection that can completely protect against accidental unauthorized access to a local network. Unfortunately, MAC addresses may be easily spoofed, allowing an impersonator to bypass MAC address protection.
Network Access Control (NAC) can also be implemented on a network, requiring devices to authenticate to a central server upon connection to a network before the newly connected devices are able to send and receive most network traffic. 802.1X is a simple implementation of NAC, which allows a central server to authenticate clients as they connect to a network, and then assign them to certain VLANs depending on their authentication information. This can effectively segment a network, preventing unauthorized hosts from sending or receiving traffic.
As with hardening, the most effective means of preventing network access is disabling access to unnecessary ports altogether. For port security, this means requiring administrator intervention before the connection of any new network device.
Security Posture
Hardening is a vital first step to building a secure network services infrastructure. In addition to basic security steps such as hardening and configuring logging/surveillance of the systems, administrators should establish what “normal” use of their systems looks like on a day-to-day basis. Only by knowing what normal loads and activities are, can an administrator set triggers or be on the lookout for activity that is anomalous.
Even as the environment changes, new applications are installed, new threats emerge, and new systems are installed, your environment should maintain this baseline security level. This means that maintaining security is a constant process.
One of the ways an administrator can ensure the maintenance of a secure baseline is the constant monitoring of network servers and hosts. If a host is detected that does not meet the baseline security configuration, it can be quickly quarantined, and the configuration rectified. For example, a remote user may take a laptop offsite for a period of time and, upon returning to the office, be in need of updating the operating system patch level. Without continuous monitoring and remediation, this shortcoming may not be detected. Using monitoring and NAC, however, an administrator can place this device on a separate network for remediation immediately, without risking unprotected access to the existing network.
Reporting
Data can be gathered and logged from a number of sources, as well as actively presented. This is known as reporting. In any monitoring system, it may be beneficial to configure alarms or alerts, or interpret logs to show trends over time.
Alarms might contact an administrator or group of administrators by e-mail, phone, or text message. Generally, alarms are reserved for important and urgent issues, such as a loss of power, an unexpected service outage, or a severe environmental issue.
Alerts may function identically to alarms, but usually react to less urgent events. Alerts are commonly configured for non-urgent but important information. Examples of events that might warrant alerts are a shortage of disk space, higher than normal network traffic, an unusual number of login attempts, or a shortage of spare supplies for a printer. These less urgent events normally do not require an immediate response from multiple people but do warrant attention and possibly a response.
Information gathered over time can be useful for spotting events at variance with expected standards. Alerts for high CPU usage might be very different from one server to another. In order to know where to set the alert and alarm thresholds, it is important to have a good baseline of the expected activity levels. One way to detect and address changes in the environment is to run reports to view trends in monitored metrics, such as available disk space. Keeping an eye on changes over time leads to more informed administrators who are more capable of address the changing needs of their environment.
Detection Controls versus Prevention Controls
In order to protect assets effectively, you can take steps to detect or deter unauthorized behavior. For example, a room can be secured by a lock to deter access. A lot may be secured by a simple fence to deter trespassers. A guard may be posted at a door to prevent just anyone from going through it. These are examples of physical prevention controls that can be put in place to prevent security violations.
Another method of security control that can be put in place is the detection control. These types of controls are more concerned with creating an accurate record of what happens than with preventing it in the first place. An example of a detection control might be a camera that is not actively monitored, but stores any video for later review, if necessary. Though knowledge of the detection system may act as a deterrent, the detection system itself does not prevent unauthorized access.
When protecting a computer network against unauthorized access, there are two types of technologies, intrusion detection systems (IDS) and intrusion prevention systems (IPS), that are roughly analogous to video recording cameras and guards, respectively.
IDS technology is well suited for detecting unauthorized activity and alerting an administrator. The role of an IDS is limited, so it does not require extensive network integration. If an IDS is able to view the network traffic, it can analyze the traffic and alert the administrator to anomalous behavior. Like a camera, an IDS watches and reports.
Rather than the simple observe and report of an IDS, an IPS has the ability to respond on its own to network threats before they reach the protected hosts on a network. This would not be possible unless network traffic were routed through the IPS. A strong IPS can detect a number of types of attacks, such as SQL or other injection attacks targeted at a web host, and stop them before they are able to deliver their payload.
Some advanced IPS and IDS deployments can perform network behavior analysis to respond intelligently to unusual network traffic patterns. This is similar to the way an administrator might create a baseline of expected behavior and configure alerts for anomalous behavior, but it is completely automated.
Though most IPS deployments monitor network traffic, there are also host-based intrusion prevention systems (HIPS). These are installed on a host to monitor the working of the host in a manner similar to anti-virus software. Instead of protecting the host from viruses, however, the role of the HIPS is to protect the host against attacks, such as buffer overflow exploits, and enforce security policies on the host.