Lab #9 - Assessment Worksheet
Investigating and Responding to Security Incidents

Course Name and Number: CSS280-1501A-01 Ethical Hacking
Student Name: ***** ******
Instructor Name: ***** ******
Lab Due Date: 2/9/2015
Overview

In this lab, you acted as a member of the incident response team who had been assigned an incident response in the form of a help desk trouble ticket. You followed the phases of a security incident response to investigate the event, contain the malware, eradicate the suspicious files, re-test the system in readiness for returning it to service, and complete a detailed security incident response report in the provided template. You used AVG Anti-Virus Business Edition to scan the infected workstation and documented your findings as you proceeded.
Lab Assessment Questions & Answers

1. When you are notified that a user's workstation or system is acting strangely and log files indicate system compromise, what is the first thing you should do to the workstation or system and why?
Have the user of the machine cease all activity and contain the infected machine by disconnecting from the network (unplug Ethernet cable or disable wireless), leaving it isolated but not powered off. It should be left in its steady state. This isolates the contaminated workstation from the organization’s network and Internet, as well as preventing the contamination from spreading. Logs, memory forensics, footprints, and other malicious activity must be kept in its steady state untouched until you arrive on scene. 2. When an antivirus program identifies a virus and quarantines this file, has the malware been eradicated?
No. The file is identified containing malware or a virus and moved to a non-standard location and folder, the file is renamed, may be marked hidden, and possibly encrypted.

3. What is the SANS Institute's six-step incident handling process?
PICERL short for Preparation, Identification, Containment, Eradication, Recovery and Lessons learned (SANS, 2006).

4. What is the risk of starting to contain an incident prior to completing the identification process?
You will need to have your entire help desk staff trained to recognize and quickly escalate issues to an incident team member so that a severity level can be determined. That will determine the resources necessary to respond to the incident. A simple spyware incident may only require one person to clean up and document while at the other end of the spectrum another incident may require every resource available to prevent the company from going out of business. 5. Why is it a good idea to have a security policy that defines the incident response process in your organization?
Organizations should have a policy that defines in specific terms what constitutes an information security incident, and provides a step-by-step process for all employees to follow when an incident occurs. The goal is to completely eradicate the threat from the environment. 6. The post-mortem, lessons learned step is the last in the incident response process. Why is this the most important step in the process?
The lessons learned during the debriefing can then be used to determine the changes that should be made to improve the incident response process for the next it’s put into effect.

Lab #10 - Assessment Worksheet

Securing the Network with an Intrusion Detection System (IDS)
Course Name and Number: CSS280-1501A-01 Ethical Hacking
Student Name: Allen Suber
Instructor Name: Todd Wolfe
Lab Due Date: 2/9/2015
Overview

In this lab, you configured Snort, an open source intrusion prevention and detection system, on the TargetSnort virtual machine and the Web-based IDS monitoring tool called Snorby. You also used the OpenVAS scanning tool to scan the TargetSnort virtual machine to test the Snort configuration and see exactly what circumstances trigger an IDS alert.
Lab Assessment Questions & Answers 1. What is the difference between an IDS and an IPS?
The main difference between one system and the other is the action they take when an attack is detected in its initial phases (network scanning and port scanning). * The Intrusion Detection System (IDS) provides the network with a level of preventive security against any suspicious activity. The IDS achieves this objective through early warnings aimed at systems administrators. However, unlike IPS, it is not designed to block attacks. * An Intrusion Prevention System (IPS) is a device that controls access to IT networks in order to protect systems from attack and abuse. It is designed to inspect attack data and take the corresponding action, blocking it as it is developing and before it succeeds, creating a series of rules in the corporate firewall, for example. 2. Why is it important to perform a network traffic baseline definition analysis?
So the administrator can ensure that the presence, absence, amount, direction, and frequency of the traffic are flowing correctly. Furthermore, it helps determine trends for the network which can help spot problem areas when they occur. 3. Why is a port scan detected from the same IP on a subnet an alarming alert to receive from your IDS?
It is alarming because all of the computers on the same subnet are addressed with a common, identical, bit-group in their IP address. A port scan is ‘an attack that sends client requests to a range of server port addresses on a host - with the goal of finding an active port and exploiting a known vulnerability of that service. 4. If the Snort IDS captures the IP packets off the LAN segment for examination, is this an example of promiscuous mode operation? Are these packets saved or logged?
Promiscuous mode means that the network card is configured to receive all frames, not just those which are addressed to it. Packets are logged here. 5. What is the difference between host-based IDS and network-based IDS?
A host-based system analyzes logs and consists of information regarding the status of the system, whereas a network-based system analyzes network traffic directly, consequently checking every network event. Protection and affordability compared to network-based systems, host-based systems can be more affordable – but only if the right product is selected. 6. How can you block attackers, who are performing reconnaissance and probing, with Nmap and OpenVAS port scanning and vulnerability assessment scanning tools?
Penetration Testing 7. Why is it a good idea to have host-based intrusion detection systems enabled on critical servers and workstations?
Best practices in a network environment is to have host-based intrusion detection systems enabled on critical servers and workstations to provide your network and security organization with real-time alerts and alarms pertaining to potential system compromise and/or unauthorized access.

8. Where should you implement intrusion prevention systems in your IT infrastructure?
Intrusion prevention systems are always connected inline. This requirement enables the IPS to drop select packets, and defend against an attack before it takes hold of the internal network, (Hansteen, 2008). In figure 4, the red lines are showing the network links being used to capture traffic.

References
Bejtlich, R., 2014. Top seven network traffic monitoring challenges. Retrieved from http://searchnetworking.techtarget.com/tip/Top-seven-network-traffic-monitoring-c challenges
Hansteen, P. N. M. (2008). The Book of PF: A No-nonsense Guide to the OpenBSD Firewall. San Francisco, CA: No Starch Press, Inc.