How To Monitor Network Traffic

Intrusion detection is an important and difficult task when maintaining a secure computing system. It may not be possible to detect intrusions unless the necessary tools and a well executed strategy are implemented. If an intruder is not detected properly, the SA staff may not be able to determine the full extent of the intrusion and damage caused. Moreover, it may be difficult to completely remove the intruder’s effects from the compromised system. A compromised system may have other repercussions: Legal action may be taken against an agency with a compromised system which is used to launch additional attacks. There is also the possibility of lost business opportunities, loss of reputation, and lost revenues.

Monitor Network Traffic

System security is an ongoing iterative process requiring careful planning and implementation. The system administrative staff is responsible for a well documented active strategy for detecting signs of intrusion or suspicious activity and should always Monitor Network Traffic. Network and system activities must be monitored. Reviews of alerts, error reports, system logs, user behavior, and system activities must be done in real time. Periodic audits of all equipment connected to the computing network must be completed. A well defined and documented network map must be maintained to determine if any unauthorized changes have occurred. Vulnerability testing must be done to identify security weaknesses in the computing system. Correctness of the file system and its content must be verified using checksums and other possible tools. The staff maintaining system security must be well trained and know their responsibilities. If the admin understands how to Monitor Network Traffic, the staff must be prepared to implement an intrusion response once an intrusion has been detected.

Monitor Network Traffic: Detecting Signs of Intrusion

Verify that software used to monitor the systems is not compromised.

Regularly monitor network activities and system activities by reviewing:

  1. Alerts
  2. Error reports
  3. Network traffic
  4. System performance
  5. System usage
  6. Process activity
  7. User behavior

Keep the network configuration and all of its associated hardware documented

  1. Keep an inventory of all hardware
  2. Periodically audit all equipment attached to the network
  3. Investigate any unexpected hardware devices attached to the network.
  4. Monitor for unauthorized packet sniffing.
  5. Look for any unexpected routes on the network and investigate them thoroughly.

Regularly perform vulnerability testing to identify system weaknesses

Verify the file systems and their content with checksums and other possible tools.

  1. Document the results of system checks.
  2. Document and investigate any anomalies.

Update system verification metrics after completing system updates.

  1. This will require running and documenting new checksums.
  2. Document and investigate any anomalies.

Inspect physical security measures for theft, tampering, or intrusion by Monitor Network Traffic

  1. locks
  2. keys
  3. keycards
  4. CCTV
  5. Alarms
  6. portable media

Log all physical security breaches.

Train the computer systems staff in intrusion detection

  1. Document responsibilities for staff members
  2. Provide a contact check list when intrusions are detected
  3. document an intrusion response plan

Detecting Signs of Intrusion

If you never detect an intrusion, does this imply your systems have never been compromised by an intruder?

General Approach to detection:

  1. Monitor your systems and look for unusual (or suspicious) activity.
  2. Investigate anything unusual (or suspicious).
  3. If some activity cannot be explained, initiate intrusion response procedures.

Implementing intrusion detection:

  1. Protect the integrity of your intrusion detection tools (hardware and software).
  2. Monitor the system behavior.
  3. Physical forms of intrusion: output devices, portable media.
  4. Follow through from incidence reports.

Detecting Signs of Intrusion

  • Integrity of detection software: Software cannot be compromised
  • Integrity of hardware: cannot be compromised
  • Behavior of networks: Monitor and inspect Activities
  • Behavior of systems: Monitor: network activity, memory usage, cpu usage, disk usage.
  • Physical forms of intrusion: Attached hardware devices, unauthorized access to physical resources.
  • Follow through: Review reports of suspicious system and network behavior and events.
  • Do not rely on software tools that reside on compromised systems.

Examples:

  • Replace the ps command to filter out processes used by the intruder.
  • Replace the editor software to open files other than the files requested.
  • Modify the system log files.

Be suspicious:

  • What software produced the current output?
  • What other software does this output rely on?
  • What software can you trust?
  • Write protected media is ideal for software to test a system.

 

Method:

  1. physically attach a suspect data device to a secure device for testing.
  2. Attach to the suspect system a write protected system disk, boot and test.
  3. Generate an image of the suspect system disk mount it on a verified system and examine it there
  4. Use external media containing a verified set of software to examine the suspect system.
  5. Use verified software to examine the suspect system.

 

Policy considerations:

  • System security policy should specify the level of verification required when examining each class of data and service provided by the organization’s systems.
  • If a file can be immutable, it should be.
  • Monitor and inspect Network Activities

Traffic, performance

  • ICMP – internet control message protocol pings, port probes, simple network management protocol queries.
  • Log files: routers, firewalls, hosts, devices
  • Alert reports
  • Error reports
  • Network performance statistics reports.

 

Unexpected behavior:

  1. unexpected changes in network performance such as variations in traffic load at specific times.
  2. traffic coming from or going to unexpected locations
  3. connections made at unusual times
  4. repeated failed connection attempts
  5. unauthorized scans and probes
  6. Nonstandard or malformed packets

 

If you allow third parties access to your systems (vendors, contractors, suppliers, partners, customers, …), you must monitor their access.

Notify users of system monitoring – this is known as disclosure. Most notification of monitoring is done at login time using a login banner.