Network Security Tools

Jerry Grugin

In this blog, we talk about Network Security Tools, to include:

• NIDS/NIPS
• FW/HONEYPOTS
• PROXY SERVERS
• PROTOCOL ANALYZERS
• PENETRATION TESTING

NIDS/NIPS

It would be nice to be able for a human being to look at and analyze every packet
that goes through the system and find all the bad things within it. Unfortunately, that is
an impossible task. A human being cannot possibly look at and analyze all these packets
and find all the bad stuff. That's why things like Network Based Intrusion Detection
Systems (NIDS) and Network Based Intrusion Prevention Systems (NIPS) were created.
These systems can do what human beings, by themselves, cannot do. These systems can
watch all the traffic. These systems can detect vulnerabilities inside the traffic flows.

Intrusion Prevention systems are designed to actually stop the vulnerabilities.
Intrusion Detection Systems are designed to detect these vulnerabilities. It is imperative to
know the difference in these two types of systems. Intrusions are exploits against
operating systems and applications. These intrusions can involve things such as buffer
overflows, cross-site scripting, just to name a few. One of the things we, as security
professionals, have to watch out for is the dropping of legitimate information. It is possible
for an IPS to identify legitimate information as threats. We want to stop the bad stuff and
allow the good stuff. We need to find a happy medium that allows the maximum amount
of safety and satisfies everyone.

A fundamental technology used in IDS's and IPS's is something called a "signaturebased
match." We want to be able to look at the exact code going over the network. If
we see a signature of an identified threat, we want to be able to stop that information
from entering the network. Some of these signatures can be very, very detailed. Once we
have identified these signatures and we have these in place, the prevention system is
looking for exact matches of these identified signatures. If the system sees the exact
match, it will either detect it (IDS) or prevent it on-the-spot (IPS).

Another fundamental technology is called an anomaly-based detection. An
anomaly-based device builds a baseline of "what is normal" on the network. If the network
or certain aspects of the network go well above the normal range, it becomes what is
known as an anomaly. It is something that would not be normally seen on the network. If
the system sees an anomaly, it should provide an alarm. An alarm could be given if, all of
the sudden, more than the normal amount of users try to log into the network at the same
time. The system would identify this as an anomaly.

A behavior-based technology can also be used to identify threats. A behaviorbased
technology is similar to anomaly-based technologies. With behavior-based
technologies, we may be looking at the behavior of users that is considered normal. The
system watches the behavior of users. If the user tries to do something that is outside the
normal behavior, then the system should give an alert.

Heuristics is another technology used to identify threats. It is an emerging
technology, but it's been around for a number of years. It has continued to be made better
and better. Heuristics can be described as a bit of artificial intelligence. This technology
looks at information that comes over the network to see if it changes. If the packet flow
changes, it might be indicative of a threat.

In summary, I have explained NIDS and NIPS and have given the definition of
vulnerabilities. I have identified 4 technologies used with NIDS and NIPS to detect threats:
Signature-based, anomoly-based, behavior-based, and heuristics. I hope this has been an
excellent overview and has been a good blog to read in understanding these things as it
relates to Security+.

FW/HONEYPOTS

Firewalls can be hardware based or software based.  An organization could combine hardware and software techniques to make a firewall that uses both.  They use both to enforce the network access security policy.  This is the first real step towards security.  Modern firewalls will do a lot more than just packet filtering and network access control.  They will do different types of access control, they will terminate VPN tunnels, they will provide QoS (quality of service) with rate limiting, they will provide redundancy.  You can get total confidentiality, integrity, and availability (C.I.A.) out of modern firewalls.  Hardware, zone-based firewalls are superior.  Some models even provide multiple virtual firewalls.

Honeypots have been around for a while and we associate them with firewalls because typically honeypots are placed out in demilitarized zones at the perimeter of a network.  A honeypot is actually a trap to deflect, detect, and to counteract attacks and any unauthorized access of information systems.  Honeypots lure would-be attackers, malicious users, malware spreaders, and spammers into the system.  A honeypot is typically a computer.  It could be a Linux server or it could be an entire subnet.  Two or more honeypots is called a honeynet.  A centralized collection of honeypot tools is called a honeyfarm.

PROXY SERVERS

A proxy server is really a gateway that can provide lots of different services at different layers of the OSI model.  There are proxies that can operate at the network layer, the transport layer, the application layers.  By definition, a proxy is a gateway or intermediary device between two different domains or two different networks to provide quite a few different types of services.  Web server proxies and other application proxies serve as gateways for:  translation, caching, filtering, and inspection.

PROTOCOL ANALYZERS

Protocol Analyzers are valuable tools to monitor wired and wireless networks, not just for capacity planning, growth, optimization, and for adherence to security policies, but for security.  It is also a vulnerability.

PENETRATION TESTING

This last tool is more of a process than it is a tool.  It is a tool in the sense that it is a useful mechanism for evaluating security, doing risk assessment, and doing risk management in the organization.  It is part of the initial process to determine vulnerabilities and weaknesses.  Penetration testing is done by professionals to try to penetrate defense systems, to find out if defense in-depth is deep enough, broad enough, and comprehensive enough.