IT Governance, Risk, and Compliance » Management Information Systems

Network Infrastructure Security: Intrusion Detection Systems – Part VI

Robert Davis — Sat, 08 Dec 2012 01:34:08 +0000

Network-based intrusion detection captures traffic and performs analyses to identify notable events. If placed at the front-end IT perimeter, the properly configured network-based IDS will detect all externally initiated attack attempts, even where the firewall subsequently permits malicious packets to ingress. As an alternative configuration option, an IDS can be placed between a firewall and the internal network, where it will only evaluate firewall passed traffic.

Effective information assets protection (IAP) technologies are valuable defense mechanisms for combating inappropriate and malicious behavior. Therefore, information security personnel should identify and evaluate deployed configuration management tools that ensure an entity’s network infrastructure maintains data integrity and availability.

Source:

Davis, Robert E. IT Auditing: Assuring Information Assets Protection. Raleigh: Lulu.com, 2010.

Network Infrastructure Security: Intrusion Detection Systems – Part V

Robert Davis — Wed, 05 Dec 2012 23:32:19 +0000

Anomaly intrusion detection monitors network segments to compare the current state to the previously determined normal baseline and indicate unusual situations. Anomaly based detection can focus solely on protocols. Under this circumstance, protocol anomalies analysis exposes attacks a signature-based IDS is likely to overlook; however the false-assessment rate is often higher than other intrusion detection approaches. Statistical patterns or profiles are frequently the better means to detect insider IT attacks. However, cunning users can intentionally modify their statistical patterns or profiles to masquerade malicious activities. Additionally, a large amount of processing capacity is usually required for anomaly intrusion detection.

Host-based intrusion detection generally provides passive individual IT activity examinations. The Host-based IDS can employ system log data, resource utilization, modification or deletion of files, abnormal privilege escalation, as well as other indicators to note potential attacks for a particular IT.

Source:

Davis, Robert E. IT Auditing: Assuring Information Assets Protection. Raleigh: Lulu.com, 2010.

Network Infrastructure Security: Intrusion Detection Systems – Part IV

Robert Davis — Sat, 01 Dec 2012 00:09:39 +0000

As suggested in the aforementioned paragraph, depending on the developer, an entity deployed IDS can have a variety of components and features. However, IDS functionality commonly includes sensors for detecting data, analyzers for evaluating data, panels for monitoring activities as well as user-interfaces for manipulating configuration settings. Collected IDS items can be in the form of packets, system audit records, computed hash values as well as other data formats. Procedurally, analyzers receive input from sensors and determine intrusive activity.

The misuse detection model is based on the hypothesis that known exploits of vulnerabilities can be described by attack signatures or patterns, therefore IT attacks can be revealed through identifiable patterns. Malicious misuse encompasses reading, modification, and destruction of data. Misuse detection systems normally compare gathered information to large databases of attack signatures for internal perpetrator identification. There is typically a high-degree of certainty that signature-based intrusion detection models will recognize exact attack pattern replications; however slight variations in a data-based attack pattern may escape discovery.

Source:

Davis, Robert E. IT Auditing: Assuring Information Assets Protection. Raleigh: Lulu.com, 2010.

Network Infrastructure Security: Intrusion Detection Systems – Part III

Robert Davis — Thu, 29 Nov 2012 01:41:43 +0000

Deployed intrusion detection solutions are not a substitute for firewalls; although they usually complement the function of firewalls. Commonly, a deployed IDS inspects computer activity to identify suspicious patterns that may indicate an attack from hackers or crackers utilizing vulnerability assessment software. There are several categories for IDS inspection including misuse, anomaly, host-based, and network-based detection. Each IDS classification relies on analytical information to determine reportable conditions, such as signatures, protocols, profiles, and/or statistical patterns.

Generally, intrusion detection systems have passive and active components. Passive procedures normally encompass: inspection of system configuration files to expose inadvisable settings; inspection of password files to indicate imprudent pass-codes; and inspection of other system areas to detect policy violations. Whereas, active procedures usually accommodate: mechanisms to ascertain known methods of attack; mechanisms to log-off users; mechanisms to reprogram the firewall; and mechanisms to log system responses.

Source:

Davis, Robert E. IT Auditing: Assuring Information Assets Protection. Raleigh: Lulu.com, 2010.

Network Infrastructure Security: Intrusion Detection Systems – Part II

Robert Davis — Sat, 24 Nov 2012 00:12:33 +0000

Intrusion detection aids in reacting to network infrastructure incursions. Derivatively, the main value of intrusion detection is early incident or event awareness and subsequent, timely intervention resulting in a loss experience that is less than what might otherwise ensue from a security breach. “After all of the access control rules are implemented and the software is updated and patched, an IDS should provide the ability to determine if and when security controls have been bypassed.” Consequently, the primary IDS purpose is to provide the ability to view IT activity in real time and to identify unauthorized IT activity.

Source:

Davis, Robert E. IT Auditing: Assuring Information Assets Protection. Raleigh: Lulu.com, 2010.

Network Infrastructure Security: Intrusion Detection Systems – Part I

Robert Davis — Wed, 21 Nov 2012 18:28:59 +0000

IT decentralization clearly has increased the need for effective network security. In response, entities typically deploy several layers of information security technologies. Furthermore, due to technological and operational diversity, it is critical to have standard processes to control access that will permit economies of scale.

Network monitoring of packets to identify malformed packets and known attacks should be an entity’s Threat Management control objective. “Unauthorized access incidents are often preceded by reconnaissance activity to map hosts and services and to identify vulnerabilities.” Precursor exploits may include port scans, host scans, vulnerability scans, pings, trace-routes, DNS zone transfers, Operating System fingerprinting, and banner grabbing. Such unethical, if not unlawful, activities are discovered primarily through Intrusion Detection System (IDS) or Intrusion Prevention System (IPS) software and secondarily through log analysis.

Source:

Davis, Robert E. IT Auditing: Assuring Information Assets Protection. Raleigh: Lulu.com, 2010.

Data Communications Risk in Distributed Computing – Part V

Robert Davis — Sat, 08 Sep 2012 00:14:43 +0000

Reducing data communication error risk for teleprocessing systems

Teleprocessing is the handling of data through a communications channel, such as telephone lines, microwave towers, or artificial satellites. It permits datum to be posted to files in a second location, with the processing results being printed in a third location.

A major problem created by teleprocessing capabilities is the potential devaluation of information assets based on data communication errors affecting information reliability. Consequently, technology owners must evaluate the ability of teleprocessing systems to resist such data corruption to ensure information asset devaluation is minimized and information reliability is maximized.

Sources:

Davis, Robert E. IT Auditing: IT Service Delivery and Support. Mission Viejo, CA: Pleier Corporation, 2008. CD-ROM.

Watne, Donald A. and Peter B. B. Turney. Auditing EDP Systems. Englewood Cliffs, NJ: Prentice-Hall, 1984. 6, 236-7, 467

Davis, Robert E. “IT Hardware Risks.” Suite101.com. Retrieved on 10/03/2010

Strangio, Christopher E. “Data Communications Basics: A Brief Introduction to Digital Transfer.” Camiresearch.com. Retrieved on 10/03/2010

“View Part I of the Data Communications Risk in Distributed Computing series here”

Post Note: “Data Communications Risk in Distributed Computing – Part V” was originally published through Suite101.com under the title “Data Communications Risk in Distributed Computing”

@TempleU News flash! Just received a Temple University appointment letter! As of 08/29/2012, I am the (First and Inaugural) CISA in Residence at Temple University! (Job Description Link: http://www.linkedin.com/in/havecisawilltravel)

Data Communications Risk in Distributed Computing – Part IV

Robert Davis — Wed, 05 Sep 2012 19:56:04 +0000

Signal fading is a decline in transmission strength. Fading can occur when a signal is transmitted by microwaves. Under certain conditions, the signal picked up by the receiving unit can be quite weak. A weak signal is more susceptible to transmission noise and error.

Signal distortion can result from lack of synchronization between the time datum is sent and the time they are received. Lack of synchronization typically occurs when a signal travels several paths with different delays in each path. This will result in distortion when there is overlapping in the receipt of data from the different signal paths.

Sources:

Davis, Robert E. IT Auditing: IT Service Delivery and Support. Mission Viejo, CA: Pleier Corporation, 2008. CD-ROM.

Watne, Donald A. and Peter B. B. Turney. Auditing EDP Systems. Englewood Cliffs, NJ: Prentice-Hall, 1984. 6, 236-7, 467

Davis, Robert E. “IT Hardware Risks.” Suite101.com. Retrieved on 10/03/2010

Strangio, Christopher E. “Data Communications Basics: A Brief Introduction to Digital Transfer.” Camiresearch.com. Retrieved on 10/03/2010

“View Part I of the Data Communications Risk in Distributed Computing series here”

Post Note: “Data Communications Risk in Distributed Computing – Part IV” was originally published through Suite101.com under the title “Data Communications Risk in Distributed Computing”

Data Communications Risk in Distributed Computing – Part III

Robert Davis — Fri, 31 Aug 2012 23:31:36 +0000

The electrical signal may be changed by mechanical component failure of the communications network, or by a problem related to the characteristics of data communications. Of these two error sources, the characteristics of data communications are by far more important.

Root causes of most data communication errors

Errors associated with the communication of data, rather than a mechanical failure, are generally due to noise, fading, or distortion.

Communication noise is electrical interference with the signal. It may be background noise or impulse noise, and it may be random or cyclical. Background noise usually has little effect on the transmission of a signal. Impulse noise, such as a sudden voltage surge, is more likely to mask or distort a signal. As long as the noise occurs randomly, it is usually easy to detect an error. Conversely, cyclical noise, such as voltage oscillation, can create compensating errors that are difficult to detect.

Sources:

Davis, Robert E. IT Auditing: IT Service Delivery and Support. Mission Viejo, CA: Pleier Corporation, 2008. CD-ROM.

Watne, Donald A. and Peter B. B. Turney. Auditing EDP Systems. Englewood Cliffs, NJ: Prentice-Hall, 1984. 6, 236-7, 467

Davis, Robert E. “IT Hardware Risks.” Suite101.com. Retrieved on 10/03/2010

Strangio, Christopher E. “Data Communications Basics: A Brief Introduction to Digital Transfer.” Camiresearch.com. Retrieved on 10/03/2010

“View Part I of the Data Communications Risk in Distributed Computing series here”

Post Note: “Data Communications Risk in Distributed Computing – Part III” was originally published through Suite101.com under the title “Data Communications Risk in Distributed Computing”

Data Communications Risk in Distributed Computing – Part II

Robert Davis — Wed, 29 Aug 2012 14:00:46 +0000

A common type of data communications risk

According to Christopher E. Strangio, the distance over which data moves within IT can vary from a few thousandths of an inch, as is the case within a single integrated circuit (IC) chip, to several feet along the main circuit board’s backplane connections. However, datum frequently must be sent beyond the local circuitry constituting an IT configuration.

In data communications, electronically encoded content is transmitted in the form of electrical signals. An inadvertent change in a signal will result in the datum received being in some way different from the datum sent. Typically, this increased information reliability risk is based on the probability of change in an electrical pulse due to the data communications facilities utilized for moving datum from one location to another.

Sources:

Davis, Robert E. IT Auditing: IT Service Delivery and Support. Mission Viejo, CA: Pleier Corporation, 2008. CD-ROM.

Watne, Donald A. and Peter B. B. Turney. Auditing EDP Systems. Englewood Cliffs, NJ: Prentice-Hall, 1984. 6, 236-7, 467

Davis, Robert E. “IT Hardware Risks.” Suite101.com. Retrieved on 10/03/2010

Strangio, Christopher E. “Data Communications Basics: A Brief Introduction to Digital Transfer.” Camiresearch.com. Retrieved on 10/03/2010

“View Part I of the Data Communications Risk in Distributed Computing series here”

Post Note: “Data Communications Risk in Distributed Computing – Part II” was originally published through Suite101.com under the title “Data Communications Risk in Distributed Computing”