IDS/IPS
Intrusion detection and prevention systems monitor network or system activity for malicious behaviour.
An IPS records information about observed events, notifies security administrators about important activity and produces reports. It also attempts to block detected threats. Responses can include stopping an attack, changing the security environment or modifying the attack's content.
The four types of IPS in these notes are:
- Network-based intrusion prevention (NIPS): monitors the network for suspicious traffic by analysing protocol activity.
- Wireless intrusion prevention (WIPS): analyses wireless protocols to detect suspicious activity on a wireless network.
- Network behaviour analysis (NBA): examines traffic for threats that produce unusual flows, including DDoS attacks, some forms of malware and policy violations.
- Host-based intrusion prevention: software that examines events within a host for suspicious activity.
SIEM
Security Information and Event Management combines Security Information Management (SIM) and Security Event Management (SEM) in one security management system.
SIEM collects security information from servers, end-user devices, network equipment and applications. It categorises the data and can send an alert or take another action when predefined rules identify a possible problem.
Bringing the data together helps security teams see activity across the network, identify incidents earlier and respond before more damage occurs.
A SIEM system can collect and interpret logs from:
- Firewalls
- Web filters
- Endpoint security tools
- Access points
- Routers
- Switches
- Application servers
- Honeypots
The system uses those logs for analysis, reporting and monitoring. IT teams use the results when responding to security incidents.
Firewall
A firewall monitors network traffic and permits or rejects it according to rules. It can be a dedicated device or software running on a device or server.
Firewall methodologies
Firewalls can be grouped by the methods they use and by generation.
First generation: packet-filtering firewalls
Packet-filtering firewalls inspect incoming and outgoing packets and decide whether to allow them based on source and destination IP addresses, protocols and ports.
Each packet is treated independently. The firewall cannot tell whether it belongs to an existing traffic flow; it makes a decision from the packet's header and its filtering rules.
The example filtering table in my notes used these rules:
- Block packets coming from the 192.168.21.0 network.
- Block incoming packets directed to the internal Telnet server on port 23.
- Block incoming packets directed to host 192.168.21.3.
- Allow known services to the 192.168.21.0 network.
Second generation: stateful firewalls
Stateful inspection adds connection state to the decision. Unlike a basic packet filter, a stateful firewall tracks connections such as TCP flows. A decision can therefore depend on both configured rules and the packet's history in the state table.
Third generation: application-layer firewalls
Application-layer firewalls inspect traffic up to the application layer. They can block particular content and recognise misuse of applications or protocols such as HTTP and FTP.
A proxy firewall sits between the two sides of a connection. Traffic passes through the proxy instead of a direct connection between the endpoints, and predefined rules determine what is permitted.
An application-layer firewall can also provide network address translation (NAT).
Next-generation firewall (NGFW)
Next-generation firewalls combine functions including deep packet inspection, application control and SSL/SSH inspection to address threats such as malware and application-layer attacks.
Firewall types
The two broad deployment types are host-based and network-based firewalls.
Host-based firewall
A host-based firewall runs on a network node and examines incoming and outgoing packets. It may be part of the operating system or a separate application.
Network firewalls alone do not provide all the protection needed inside a trusted network. A host-based firewall protects an individual machine against attacks and unauthorised access.
Network-based firewall
A network firewall filters traffic entering or leaving a network according to its rules, protecting the internal network. It can have two or more network interfaces and is often a dedicated system running specialised software.
Both types have their own advantages.
EDR
Endpoint Detection and Response continuously monitors endpoints, meaning individual computers rather than the network itself. It collects data for analysis, identifies suspicious activity or threats, then reports or responds to them.
It can also be used against advanced persistent threats (APTs), fileless attacks, malicious scripts and stolen credentials.
Honeypot
Honeypots provide information about threats, attackers, their tools, and their tactics, techniques and procedures (TTPs). The information collected can help an organisation understand attacker behaviour and study threats that do not yet have established signatures or detection methods.
A honeypot is a deliberately exposed or vulnerable system that simulates infrastructure, services or configurations to attract an attacker.
Honeypots are part of deception technology: decoy IT assets are placed where an attacker may mistake them for valuable targets. The aim is to observe attacks in a controlled environment. Analysts can then write detection rules, develop protections and feed indicators back into their threat intelligence and monitoring systems.
Honeypot types
High-interaction honeypot
These imitate the services of a real production system and offer a more complete environment for an attacker to interact with.
An example is a full operating system configured to record everything an attacker does, while containing the attack so malware cannot spread to assets outside the honeypot environment.
Low-interaction honeypot
These run a limited set of services and can act as an early detection mechanism. They are easier to deploy, but their restrictions and lack of fully functional services limit what an attacker can do.
Examples include systems intended to observe automated vulnerability probes, brute-force attempts, SSH bots and input-validation probes.
Malware honeypot
Some honeypots are designed to attract malware attempting to infect exposed systems. They can provide samples of previously unseen malware for analysis.
One example is an emulated USB device that attracts USB-spreading malware so its behaviour can be observed.
Spam honeypot
Spam honeypots imitate open proxies or mail relays to collect information about spam and malware campaigns delivered by email.
A fake open SMTP relay can reveal who is trying to use it and the content of current campaigns. Other examples include forum or comment honeypots that collect attempts to distribute false information, malware or phishing links.
Client honeypot
Most honeypots listen for connections as servers. A client honeypot instead reproduces important parts of a client's environment to study more targeted attacks.
Real customer data should not be used. The environment uses fabricated information while appearing to be a legitimate host. That can include operating system details, running services and open ports.
NDR
Network Detection and Response provides visibility into known and unknown threats moving through a network. It combines central analysis of traffic with response workflows and automation.
Why might signature-based tools such as older IDS/IPS systems be insufficient on their own? A tool relying on existing signatures cannot recognise a new attack until a suitable signature exists. Those tools may also lack the ability to correlate multiple data points over time or provide much in the way of response.
NDR gives teams real-time awareness of relevant network activity so they can identify network-based threats sooner.
Centralised logging
Centralised logging collects logs from networks, infrastructure and applications in one location for storage and analysis. It gives administrators a combined view of activity and makes it easier to investigate problems.
Logs provide an audit trail of system activity, events and changes. They help with functionality problems, performance investigations and security incidents. They also show when a change happened and who made it, and are often needed for regulatory requirements.
For example, when a database is slow, its slow-query log may not tell the whole story. A system can include a frontend, middleware and databases. You may also need logs from the underlying servers, storage, name resolution and network.
Understanding a distributed system therefore involves bringing together events from its components. Relevant log sources include:
- Server infrastructure
- Storage
- Databases
- API gateways
- Load balancers
- Firewalls
- Other components involved in serving the application
Troubleshooting often requires correlating events across several of those sources. Logging in to each component manually and reading hundreds or thousands of lines becomes burdensome and makes important events easy to miss.
The practical alternative is one viewing system: a tool that connects to the components, collects their logs in real time and presents the results in a readable interface.
OpenCTI
OpenCTI is an open-source platform for managing cyber threat intelligence and observables. It structures, stores, organises and visualises technical and non-technical information about cyber threats.
Source: OpenCTI on GitHub.
NIST
The NIST Cybersecurity Framework can help an organisation start or improve its cybersecurity programme. It brings together established practices for improving an organisation's security posture.
It also supports communication between internal and external stakeholders. In larger organisations, it helps connect cybersecurity risk management with wider enterprise risk management processes.
Source: NIST Cybersecurity Framework.