Implement
Policies for Monitoring
My first
college apartment had a terrible cockroach problem. Upon returning from a date
one evening, I was shocked to see dozens of them scatter away from an empty
pizza box when I turned on the lights. After that, it was tough to push away
the idea that cockroaches were everywhere—I expected to see them
in every corner of the apartment. The first time I fired up Snort I was
reminded of that experience; suddenly I could see what was crawling through the
network, and I wanted to fix it all at once.
It’s easy to
get sucked into bug stomping: once you see what’s on the network, you have the
urge to fix and explain every security event you discover. Here’s where the
analogy ends, though, for not everything on the wire is a cockroach. Much of the
traffic is perfectly fine, if ugly. Once you understand that its ugliness is
not a security threat, you can safely let it through. By narrowing your focus
to the truly threatening traffic, you can turn your full attention to stomping
it out.
Blacklist Monitoring
Creating a
list of prohibited events or items (commonly called a blacklist) is the most straightforward
method of security monitoring. With the blacklist in hand, you can deploy tools
to detect prohibited items, and build procedures for remediating them. This
technique is most effective under the following conditions:
You can reliably and accurately
identify signs of dangerous or malicious behavior
Some signs are accurate
indications that something is wrong: an airport security checkpoint screens for
the presence of banned items such as weapons and bomb chemicals. If the items you’re
screening for, however, are not accurate signs of trouble, it will bog down the
monitoring process as your staff must take the time to weed out the false
positives. For example, because the Transportation Safety Administration (TSA)
was unable to identify only dangerous liquids at security checkpoints, it chose
to ban all liquids. This presented a problem because many liquids were
perfectly safe and necessary, such as baby formula.
The blacklist must also be
limited to items that can be reliably identified. Software firewalls running on
desktops have historically been very poor at this; they block traffic or prompt
the user for harmless connections in an effort to demonstrate that they’re
still on the job unfortunately, this conditions Aunt Mary into answering OK or Allow to every prompt without considering the danger of doing so,
negating the firewall’s purpose. If a blacklisted item can be obscured in some
fashion, it cannot be reliably identified and will sail past detection and
prevention tools.
You
have a relatively small list
If you have
only a few items to watch for, it’s reasonable to keep the list up-to-date with
filters that are properly tuned to find the right triggers. If the list is too
long, however, it becomes impossible to keep it up-to-date and reliable. For
example, the “do not fly” list is reasonably effective only because it
represents a tiny percentage of the flying population. If the list doubles or
triples in size, it may create chaos at security checkpoints. Antivirus tools
have been successful because they can identify a small list of bad files from
an infinite list of harmless files.
Most of
today’s web content filters, often used by libraries and families to keep out
unsavory content, police browsing by checking against a list of “known bad”
domain names. This works only because there are only a few thousand sites to
filter out, compared to the millions of available websites on the Internet.
Anomaly Monitoring
Monitoring
for meaningful deviations from normal traffic and events is a promising
technique. It’s an emerging area of intrusion detection, and monitoring that
uses artificial intelligence and statistical deviations to detect traffic
abnormalities. When anomaly detection is initially deployed, the
tools must first create a watermark against the traffic that will be measured.
Sustained statistical deviations above or below that watermark are triggers for
the tool to analyze the traffic further and produce an alert for a network
security analyst. Products such as Arbor Peakflow, which provides an early warning
of denial-of-service (DoS) traffic and other anomalous patterns, have employed
this technique effectively. Intrusion detection systems have a growing set of
capabilities to detect anomalies in protocol usage, such as tunneling and no
encrypted traffic over encrypted protocols. They’re also good at detecting
volume-based incidents, such as port scans. Still, this technique can elicit a
high rate of false positives, and it doesn’t often capture enough detail to
conduct meaningful incident response.
Policy Monitoring
The goal of
policy monitoring is to compare events discovered on the network to ensure that
they are approved and acceptable. For example, in a sensitive environment, a
security guard would have a list of those who are permitted to enter the building
after business hours (the policy). The guard would have cause to question and
detain any no listed person entering the building after hours.
A better
example of policy monitoring is applied to counterfeit protection. It’s common
for retailers to require their cashiers to inspect large bills (say, bills
larger than $20 in the United States) before accepting them. Policy-based
monitoring is being applied, as the cashier inspects the currency for reliable
indications that it is bona fide before accepting it. The only bills legal to
create or pass for sale are those minted by the U.S. Treasury. The Treasury
designs security features into the currency to help cashiers and others
evaluate the bill’s integrity. To prove authenticity, the cashier can evaluate
certain hard-to-falsify traits of the bill, such as watermarks, holographic
images, color-shifting ink, and security threads. This requires the cashier to
know and be able to accurately identify such traits. Success depends on both
the currency’s reliable, unique, and falsification-proof security features, and
the cashier’s ability to acknowledge these signs.
Monitoring Against Defined Policies
To
effectively monitor the enterprise, you must codify acceptable behavior as
policies, providing a reference point against which to survey. These policies
must be precise and concrete to be successful. When my daughter received her
stage one driver’s license, she was allowed to drive only between the hours of
6 a.m. and 9 p.m. To monitor for compliance of such a policy, an officer need
only check the license status of a young adult against the time of day when
evaluating compliance. The policy was clear and concise, and she knew exactly
what was expected of her. Of course, in monitoring for determined threats, you
should keep your policy details a closely guarded secret, as a true criminal
will disguise traffic to evade detection.
