Extrusion Detection: Security Monitoring for Internal Intrusions

Foreword. Preface. I. DETECTING AND CONTROLLING INTRUSIONS. 1. Network Security Monitoring Revisited. Why Extrusion Detection? Defining The Security Process Security Principles Network Security Monitoring Theory Network Security Monitoring Techniques Network Security Monitoring Tools Conclusion 2. Defensible Network Architecture. Monitoring the Defensible Network Controlling the Defensible Network Minimizing the Defensible Network Keeping the Defensible Network Current Conclusion 3. Extrusion Detection Illustrated. Intrusion Detection Defined Extrusion Detection Defined History of Extrusion Detection Extrusion Detection Through NSM Conclusion 4. Enterprise Network Instrumentation. Common Packet Capture Methods PCI Tap Dual Port Aggregator Tap 2X1 10/100 Regeneration Tap 2X1 10/100 SPAN Regeneration Tap Matrix Switch Link Aggregator Tap Distributed Traffic Collection with Pf Dup-To Squid SSL Termination Reverse Proxy Conclusion 5. Layer 3 Network Access Control. Internal Network Design Internet Service Provider Sink Holes Enterprise Sink Holes Using Sink Holes to Identify Internal Intrusions Internal Intrusion Containment Notes on Enterprise Sink Holes in the Field Conclusion II. NETWORK SECURITY OPERATIONS. 6. Traffic Threat Assessment. Why Traffic Threat Assessment? Assumptions First Cuts Looking for Odd Traffic Inspecting Individual Services: NTP Inspecting Individual Services: ISAKMP Inspecting Individual Services: ICMP Inspecting Individual Services: Secure Shell Inspecting Individual Services: Whois Inspecting Individual Services: LDAP Inspecting Individual Services: Ports 3003 to 9126 TCP Inspecting Individual Services: Ports 44444 and 49993 TCP Inspecting Individual Services: DNS Inspecting Individual Services: SMTP Inspecting Individual Services: Wrap-Up Conclusion 7. Network Incident Response. Preparation for Network Incident Response Secure CSIRT Communications Intruder Profiles Incident Detection Methods Network First Response Network-Centric General Response and Remediation Conclusion 8. Network Forensics. What Is Network Forensics? Collecting Network Traffic as Evidence Protecting and Preserving Network-Based Evidence Analyzing Network-Based Evidence Presenting and Defending Conclusions Conclusion III. INTERNAL INTRUSIONS. 9. Traffic Threat Assessment Case Study. Initial Discovery Making Sense of Argus Output Argus Meets Awk Examining Port 445 TCP Traffic Were the Targets Compromised? Tracking Down the Internal Victims Moving to Full Content Data Correlating Live Response Data with Network Evidence Conclusion 10. Malicious Bots. Introduction to IRC Bots Communication and Identification Server and Control Channels Exploitation and Propagation Final Thoughts on Bots Dialogue with a Bot Net Admin Conclusion Epilogue Appendix A: Collecting Session Data in an Emergency. Appendix B: Minimal Snort Installation Guide. Appendix C: Survey of Enumeraiton Methods. Appendix D: Open Source Host Enumeration. Index.