Session 1 Framework

Security Threat

Responsibility and Policy

Architecture

Response Flow

Preparation

Emergency Response

Yan Wang

2006.09

Agenda

Framework & Technology

Security Monitoring

Response Measure

Case Study & Discussion

Security Threat

Threat Evolution and Trends

Threat Categories

Attacks Fundamental

Evolution of Availability Threats

Exploit Trends

Three Key Threat Categories• Reconnaissance

Unauthorized discovery and mapping of systems, services, or vulnerabilities

• Access

Unauthorized data manipulation, system access, or privilege escalation

• Denial of Service

Disable or corrupt networks, systems, or services

How do these impact ISPs?

• Reconnaissance – Happens all the time. It is part of

the “attack noise” of the Internet (along with low level

attacks and backscatter).

• Access – Break-ins on the edge of an ISP’s network

(I.e. customer CPE equipment) can impact the ISP’s core.

• DOS – The core threat to an ISP – knocking out

customers, infrastructure, and services.

Reconnaissance Methods

• Common commands and administrative utilities nslookup, ping, netcat, telnet, finger, rpcinfo, File Explorer, sr

vinfo, dumpacl

• Public tools Sniffers, SATAN, SAINT, NMAP, custom scripts

Network Sniffer

nmap

nmap

Why Do We Care?

Why Do We Care?

Access Methods

Access Methods (cont.)

Denial of Service Methods• Resource Overload Disk space, bandwidth, buffers, ...

Ping floods, SYN flood, UDP bombs, ...

• Software bugs Out of Band Data Crash: Ping of death, fragmentation…

• Toolkits TRINOO, Tribal Flood Net and friends

• Distributed attacks for amplification

DoS

DoS type• Resource Overload

Disk space, bandwidth, buffers, ...

Ping floods, SYN flood, UDP bombs, ...

• Out of Band Data Crash

Ping of death, ...

• Routing Capacity

Fill up packet buffers, queues, flow tables, and processing capabilities.

DoS Sequence

DDoS

DDoS Step 1: Crack Handlers and Agents

DDoS Step 2: Install Trojan & Covert Communication Channel

DDoS Step 3: Launch the Attack

DDOS Attack Characteristics• DDOS Arrays (handlers and agents) a maintenance i

ntensive. Take time and effort to create.• Launching attacks from an agent can be considered

a one shot weapon. Once the attack is launched, there is a risk of traceback. If someone traces back to the agent, they could watch and wait to see if the perpetrator returns to the agent.

Attacks Fundamental

Address Resolution Protocol (ARP)

ARP Datagram

Internet Protocol

IP Header

Internet Control Message Protocol (ICMP)

User Datagram Protocol (UDP)

Transport Control Protocol

TCP Header

TCP Establishment and Termination

Packet Spoofing

IP Spoofing

TCP Blind Spoofing

TCP blind spoofing (Cont.)

ARP Based Attacks

Gratuitous ARP

Misuse of Gratuitous ARP

A Test in the Lab

A Collection of Tools to Do:

ARP spoof in Action

More on ARP Spoof

Selective Sniffing

SSL/SSH Interception

SSL/SSH Interception

SSL/SSH Interception

ICMP Based Attacks-smurf

Smurf’s Script Kiddy Tool

ICMP Unreachable Teardown

IP Based AttacksIP Normal Fragmentation

IP Normal Fragmentation (Cont.)

IP Normal Reassembly

IP Reassembly Attack

IP Reassembly Attack (Cont.)

Ping of Death Attack Denial of Service

Ping of Death Attack Denial of Service

UDP Based Attacks

Looping UDP

DoS - Fraggle Attack

TCP Based Attacks

SYN Attack

TCP SYN Flood

TCP SYN Flood

TCP Session Hijacking

TCP DDOS Reflection Attacks

TCP DDOS Reflection Attacks

TCP DDOS Reflection Attacks

TCP DDOS Reflection Attacks

Other Attacks

Incident Response Team A Computer Security Incident Response Team (CSIR

T) is a team that performs, coordinates, and supports the response to security incidents that involve sites within a defined constituency.

ISP Security

ISP need to:

• Protect themselves• Help protect their customers from the Internet• Protect the Internet from their customers• At any given time there are between 20 to 40 DOS/DDOS attacks on the Net

Role of Service Providers

Role of Service Providers

Role of Service Providers

ISP Security Actions

Policy

Policy• Avoid extensive damage to data, systems and networks

due to not taking timely action to contain an intrusion

• Minimize the possibility of an intrusion affecting multiple systems both inside and outside an organization because staff did not know who to notify and what actions to take.

• Avoid negative exposure in the news media that can damage an organization’s public image and reputation.

• Avoid possible legal liability and prosecution for failure to exercise due care when systems are inadvertently or intentionally used to attack others.

Preparing to Respond

• Create an archive of original media, configuration files, and security-related patches for all router and host operating systems and application software versions

• Ensure that backup tools and procedures are working

• Create a database of contact information

• Select and install tools to use when responding to intrusions

Preparing to Respond (Cont.)

• Develop a plan and process to configure

isolated test systems and networks when

required

• Keep response plans, procedures and tools up

to date

• Consider performing a practice drill to test tools

and procedures

CERT Infrastructure

• Information Platform （ Website ）• Tel, Mail• Event Processing System• Traffic Monitoring System• Intrusion Detection System

Security System Security System Architecture

Infra

structu

re

Identity Authen

Clock Synchronization

Security Monitoring System

Traffic Collection

Traffic Analyse and Account

emergency response service system

information issue system

Event

CooperationLeak Scan

Distributing IDS

IP info

CCERT Framework

CERNET Committee of Experts

Center CCERT

Regional CCERT

CCERT Expert Team

Campus CCERT

R&D Secretariat

Interprovincial CCERT

CCERT

R&

D

Liaison

Training

Analysis

Monitoring

Service

Committee of Experts

CCERT Framework

Response Flow

① Preparation② Detection③ Analysis④ Decision⑤ Control⑥ Announcement⑦ Statistic

Response Flow

0

10

20

30

40

50

60

70

80

90

1st Qtr 2nd Qtr 3rd Qtr 4th Qtr

helpdesk

Investigation

NOC

Traffic analyzing and monitoring

Signature based IDS

CERNETmanagement CNCERT/CC

OtherIRTs

UsersAdministrators

toolspatches

Attacksignature

Incident database

Whois info advisories

Common Event

Important Event

What Do ISPs Need to Do?

Components of Response

Analyze the event

Contain the incident

Eliminate intruder access

Restore operations

Update procedures based on lessons learned

Analyze Event

• What systems were used to gain access

• What systems were accessed by the intruder

• What information assets were available to those systems?

• What an intruder did after obtaining access

• What an intruder is currently doing

Contain the Intrusion

• Gain control of the systems involved

• Attempt to deny an intruder access to prevent

further damage

• Monitor systems and networks for subsequent

intruder access attempts

Eliminate Intruder Access

• Change all passwords on all systems accessed

• Restore system and application software and data, as needed

• What other systems might be vulnerable?

Restore Operations

• Validate the restored system

• Monitor systems and networks

• Notify users and management that systems are

again operational

Other• Build the Communications Channels to your Peers

and Customers• Build the Communications Channels to your Vendor

s

Preparation

• Securing the Router and the Management Plane

• Securing the Network and Data Plane

• Securing the Routing Protocol and Control Plane

• Anycast as a Security Tool

• Using IP Routing as a Security Tool

Terminology

Securing the Router and theManagement Plane

Routers do get Directly Attacked

Routers do get Directly Attacked

Router Security

Global Services You Turn OFF

Global Services You Turn OFF

Interface Services You Turn Off

Interface Services You Turn Off

Cisco Discovery Protocol

Cisco Discovery Protocol

Cisco Discovery Protocol

Use Enable Secret

Securing Access to the Router

RISK Assessment

Lock Down the VTY and Console Ports

VTY and Console Port Timeouts

VTY Security

VTY Security

Encrypt the Traffic from Staff to Device

SSH Support in ISP Code

Cisco IOS SSH Configuration

SSH Server Implementation

SSH Server Configuration Prerequisites

SSH Server Configuration

SSH Server Configuration (cont.)

SSH Server Configuration Summary

SSH Client Access

SSH Terminal-Line Access

Secure Copy (SCP)

Secure Copy (SCP)

Staff AAA to get into the Device

What is ISP AAA and ISP AA?

Separate Security Domains!