Intrusion detection
Intrusion detection is a means of supervising the events that occur in a computer system or network. This includes examining them for traces of possible incidents that are in violations or threats of violation of computer security policies, acceptable use policies, or standard security practices (Ogunleye & Ogunde, 2011). Intrusion detection is become more than ever an important focus of many organization. This focus is driven by the availability of more information systems and globalization through the use of the internet. The market place is no longer the residents of a small town going to the local mall, but services online available to anyone with a web browser. With all this access vastly multiplies the possibilities of one masked robber in a year to thousands of wrong dowers at a desktop or laptop that has discovered vulnerability in the system and decides to take the chance to exploit it.
There are various approaches an organization can use to deal with many of the problems that exist with securing an information system. Jain’s (2008) article from the ICFAI Journal of Information Technology depicts a scenario of a network intrusion detection team and how situation can be averted:
…The hackers started with slating down the objectives of their ‘Limited Knowledge Penetration Testing’, also referred to as ‘White Box Approach’, and gathered sufficient information to ensure that the testing did not affect the normal business operations. They emulated a typical hacker by first collecting publicly available information relating to the company from sources like news releases, newspaper articles, annual reports, SEC filings, and the corporate website. During further probe to obtain password clues, the team found an FTP server curiously installed outside the firewall, and an internal user system being used to post huge content on illegal websites.
The consulting team ran a port scan on the suspicious FTP server only to discover that in addition to the expected open port (port 21); there were half a dozen other open ports, including 139, 2187, 3437 and 14120. These ports were used to run utilities to establish a Telnet session for data trafficking, and also to run an alternate (rogue) FTP services by the original hacker. The team subsequently found some critical information by Ftp’ing the site that revealed huge data downloads conducted by anonymous users via this rogue FTP site. The team consolidated their findings for assessing the degree of the attack by using several tools and utilities that any law enforcement professional would use for the purpose. To avoid the risk of being liable for distribution of copyrighted material and the attack on government agencies, the client authorized the team to identify the source of hack. The team conducted planned hacks on the actual hacker’s system.
They discovered that the hack was beyond their client’s system environment. The hacker had compromised nine other servers, including two universities and a large bank, in the same manner, and was using their client’s system as a launch pad for further attacks and other malicious activities. The team probed further, without disturbing the law, to get the details of the hack and the hacker. After fixing the system, the team advised the client to consult the concerned legal authorities to assess the legal responsibility associated with the hack, and also to report the hack to the appropriate authorities and affected parties as the client’s system was used to launch further scans and attacks. The team also developed a security strategy for the client and advised them to have frequent upgrades in their overall security strategy.
Network Intrusion and detection is an integral part of protecting an information system. According to Sundaram, an intrusion threat is also the potential possibility of a “deliberate unauthorized attempt to access information, manipulate information, or render a system unreliable or unusable” (1996). There are many aspects of an intrusion to include Risk, Vulnerability, penetration, just to name a few which will be discuss further. It is noteworthy to point out that all these areas can be identified in the above scenario. Risk as defined by Sundaram, is an accidental or unpredictable exposure of information, or violation of operations integrity due to the malfunction of hardware or incomplete or incorrect software design (1996). Vulnerability is a known flaw or issue with a piece of hardware or software. An attack is specific in the sense there has been an incident. When an attack is successful it is then classified as a penetration as access was establish and system may be compromise, in essence a violation of Confidentiality, integrity and or availability occurred. Hackers are the main threat to an information system. The roots of the hacker’s culture can be traced back to 1961, the year MIT took delivery of its first PDP-1 microcomputer according to Raymond (2003). The PDP-1 was one of the earliest interactive computers. They borrow their name from a term to describe members of a model train group at the school who hack the electric trains, tracks, and switches to make them perform faster and differently. It attracted a group of curious students from the Tech Model Railroad Club who experimented with it in a spirit of fun (Raymond, 2003). Hackers use different type of attacks to affect the usability of an information system one of these attacks, just to put things in perspective is the DoS or Denial of service attack. A Denial of Service attack or DoS are known for their ability to deny access to web or internet site. In such attacks the hacker overloads a server with so much data that it is too busy to service its valid request. This attack eventually slows system into crashing. A DDoS attack which is a distributed DoS is more devastating as data is sent from multiple host at the same time. This form of attack is more coordinated, harder to pin point and its effects are more rapid (Samuelle, 2008). Intrusion detection devices are used to monitor systems as an effort to counter intrusion. The intrusion detection system or IDS are used to detect unauthorized activities or activities that seem suspicious on the network. There basic function is to sound the alarm to the network manager that something is out of the ordinary (Harris, 2010). Intrusion detection device come in two main types according to Harris. There is network based and hosted based systems. Network based monitor communication on the network while hosted systems monitor activity on the computer that hosts it (2010). IDSs can be configured for many purposes. They can be used to watch for attacks, parse audit logs, terminate a connection and protect system files all at the same time exposing a hacker’s techniques and aid in their prosecution (Harris, 2010). Network based intrusion detection systems or NIDS uses sensors, which are just host computers with the necessary software or standalone dedicated systems. They are directly connected to the network and monitor all traffic which has the address of its host system, broadcast and even multicast system (Harris, 2010). The system works by making a copy of all packets passing on the original and sending a copy to be analyzed for inconsistencies. To see activities on a local computer the system manager would have to install the system on each system that will be monitored. Typical this is only setup on critical servers due to the high overhead and it could become an administrative nightmare (Harris, 2010). Today’s Intrusion detection systems complete their task in many ways. A knowledge or signature based system used information known by the vendor. This information is usually sourced from previous attacks. According to Harris, models of how an attack is carried out are developed an called a signature (2010). These systems are flawed in the sense that if an attack occurs that is not in the database or has a known signature, the attack is not recognized. These system are some of the more popular as most computers run MacAfee or Norton Antivirus software suite, two of the bigger manufactures. The effectiveness of an signature based intrusion detection based is only as effective as its updates and need to be updated regularly. Another form of intrusions detection system is a statistical anomaly based system. This system is behavioral based and unlike knowledge based system, they do not require signature updates. This form of intrusion detection systems function by first been placed in learning mode on a normal functioning network to build its profile of the system. The longer it is left in learning mode; generally the more accurate the system will be (Harris, 2010). The system, after building its profiles, functions by comparing traffic to its profile checking for inconsistencies. According to Harris the benefits of using a statistical anomaly based intrusion detection system is that it is able to react to “0 day” attack (2010). What this means is that this is the first time an attacker has used this method and there is no know solution. The down side to using a statistical anomaly based intrusion detection system is the high rate of which network traffic varies. There are typically different shifts and schedules and workers typically will be completing different task on any given hour, week, day or month. With this variance come many false alerts. Also if a hacker is able to detect that there is a statistical anomaly based system in use they may be able to integrate their pattern into the behaviors of the network (Harris, 2010). This action would serve to circumvent the system by making it think it was normal traffic. Rule-based intrusion detection systems work different from statistical and signature based systems. According to Harris, a “rule-based intrusion detection is commonly associated with the use of an expert system; an expert system is made up of a knowledge based inference engine, and rule based programming” (2010). These rules are applied to the data traffic and used to detect suspicious activity. While using these intrusion detection system it is good to make note that they all have limits. There is only so much data that each can handle. If a particular system is overwhelmed intrusions can potentially go unnoticed. Intrusion Prevention systems are now on the rise, the difference is that intrusion prevention systems acts to stop all suspicious traffic not just sound the alarm (Harris, 2010). In conclusion information systems play a vital role in society and the way organizations function. Information systems provide essential services that keep the country’s infrastructure running. The development and deployment of intrusion detection system play a big part in ensuring these service continue and thwart possible offenders. As long as there are hackers there will be a need to protect information systems. Care should be taken to ensure proper measure is taken to secure computer systems.