NIPS

1. NIPS

2. NIPS NIPS essentially breaks down into two categories: • Chokepoint devices • Intelligent switches In addition to these architectural classes, NIPS designers make a choice between two types of technology: • General-purpose CPUs • Application-specific integrated circuits (ASICs).

3. How Chokepoint NIPS Work • A chokepoint NIPS could be located outside of your firewall or on your screened subnet in front of a device you want to protect, such as your web server. • They will often be configured without an IP address on either of the chokepoint interfaces to minimize their impact on the network's architecture. • Traffic that originates from the Internet is passed through the NIPS to your corporate firewall and beyond if it does not generate any alerts. • In IPS mode, traffic that does generate an alert can be dropped or rejected by the NIPS and never delivered inside your network. • These can also be run in IDS mode, where a report is generated but the packet is not dropped. These tend to either be a "firewall plus something" or an "IDS plus something."

4. Firewall Plus Something • Firewalls fall into three major categories, listed in increasing security protection: packet filter, stateful, and proxy or application gateway. • The overwhelming majority of deployed firewalls are stateful. Firewalls are the original IPS. • To be credible as an IPS, the firewall needs to add additional functionality, such as the ability to run IDS-type rules. • The next logical progression for many firewall vendors is to add intrusion detection capacity to their firewalls. • Because the firewall must collect and retransmit each packet that flows through it, a logical advancement would be to allow policy to define whether traffic identified as malicious should generate an alert and be forwarded to the destination or whether it should generate an alert and be dropped, thereby preventing the attack from being successful

5. Check Point FireWall-1 NG Check Point's central product is FireWall-1, which is the best-known example of a "firewall plus something" positioned as a NIPS. Check Point FireWall-1 NG has the following IPS features: • Attack protection with "Application Intelligence," a rudimentary content-inspection capability that blocks many well-known, well-defined attacks. • Access control based on stateful inspection, the capability this firewall is best known for. • Choice of software and appliance deployments. The software is available on a number of platforms to balance needs versus costs. The high end is based on the high-performance, secure, and expensive Nokia appliance.

6. Check Point and OPSEC • The OPSEC Alliance was founded in April of 1997. OPSEC has since grown to over 350 partners, making it the leading platform alliance by far for integrated Internet security solutions. Programmers find the interface very workable, which is probably the reason for the large number of partners. • OPSEC has enabled FireWall-1 to be extended into a number of areas outside of Check Point's core competency, including the following: • Authentication • Authorization • Content security • Intrusion detection and protection • Wireless

7. Modwall • Modwall was developed by Bill Stearns and is available from http://www.stearns.org/modwall. • Modwall is a set of firewall/IPS modules that can be inserted into an existing IPTables firewall on Linux. • Rather than focusing on the normal "allow this kind of traffic from here to here" firewall rules, modwall focuses on illegal packet traffic, which includes invalid or unassigned source or destination IP addresses, invalid TCP flag combinations, and packets that have been intentionally fragmented. • Modwall then allows the administrator to define what action to take, including dropping the traffic, logging it, and blocking traffic from the source for a limited amount of time.

8. IDS Plus Something • The "IDS plus something" classification for IPS products refers to those vendors who have traditionally had strong IDS tools and have added active functionality to stop the activity that generates an alert before it is delivered on the network or executed on a host. • An IDS plus something style IPS would generally be referred to as a NIPS, where blocking is done at the network level.

9. IntruShield • IntruShield is an example of a commercial IDS plus something style of NIPS. • In 2002, McAfee (McAfee was formerly named Network Associates) acquired the IPS company Entercept for integration into its product line. • The Entercept product line merged with the IDS products previously available from Network Associates to offer both NIPS appliances and a host-based IPS suite of products to protect desktops and servers. • IntruShield is a chokepoint architecture that uses classic IDS signature and anomaly techniques to identify attacks. • The standard product is shipped with a base rule set that can be customized.

10. IntruShield • You can enable or disable features to best meet the demands of your network. A lot of work has been put into the IntruShield user interface, and it is easy to switch between IDS (passive) mode and IPS (active) mode.

11. NFR Sentivist A NIPS that is directly positioned against IntruShield is NFR's Sentivist appliance. Intrusion prevention is designed and built with a focus on three distinctive areas in this "IDS plus something" NIPS technology: • NFR detection engine • Fine-grained blocking • Resistance to self-inflicted DoS

12. HogWash and Snort-Inline • HogWash was originally developed by Jed Haile and was the first to use Snort rules in a security gateway device. • This development effort seems to have stalled, and the work is being continued by Snort-Inline. • Rob Mcmillen was the next to lead the effort, hosted at http://snort-inline.sourceforge.net/. • With Snort 2.3, Snort-Inline became part of the Snort distribution • Three new advancement were: drop (standard IPTables drop and log), sdrop (silent drop, no logging), and reject, the noisiest rule (drop, log, forge a TCP reset or "ICMP Port Unreachable" message, as appropriate). LaBrea Technologies Sentry

13. Switch-Type NIPS • Another classification of NIPS is an intelligent switch you plug your network in to. • This is probably the most effective of the NIPS products available on the market place today, making the best use of firewalls, IDS tools, and routers/switches, ideally in a single parallel-processing, high-performance, low-latency device. • These switches have enough processing power to do more than just enhance the performance of a network by preventing Ethernet collisions. • Expect to see antivirus, traffic-shaping, load-balancing, and intrusion prevention in the network itself.

14. Switch-Type NIPS • Of course, this next generation of switches that use massive arrays of parallel ASICs to connect the internal and external segments of your network together are going to be expensive. By using many of the techniques employed by advanced NIDS tools, • The NIPS device can identify events on the network that are hostile. Because of its position (inline with the traffic of your entire network), the NIPS device can stop the hostile activity from ever being delivered to the target system. This also strongly enhances anomaly detection and network learning because all the traffic passes through the switch.

15. Protocol Scrubbing, Rate Limiting, and Policy Enforcement • A NIPS device can be used to clean garbage from the traffic stream, thus reducing the overall network load. • Another feature of switch-type NIPS devices is the ability to use rate limiting to apply Quality of Service (QoS) mechanisms to network traffic. • Because the NIPS device is already classifying traffic based on application, administrators can use this functionality to enforce organizational policy to drop traffic from unauthorized applications.

16. Environmental Anomaly Analysis • What is anomalous with a given application or protocol in one environment may not be anomalous in the next environment. • One of the immediate benefits of this capability is the support of an active change control program. NIDS and NIPS tools alike can detect a new version of an operating system or application and raise an alert, or even modify the rule set to take the new information into account. • This could help the operations administrators manage unauthorized change. Obviously, you can only process so many alerts, so this would be managed by the analyst or administrator to help determine where appropriate thresholds should be set.

17. Environmental Anomaly Analysis • Because the NIPS device is simultaneously tracking connection state for thousands or even millions of connections, it can take a "broad perspective" view to detect anomalies that involve many connections across an entire enterprise.

18. NIPS Challenges In order for NIPS devices to be deployed as reliable, effective devices, they must overcome several challenges: • Detection capabilities • Evasion resistance • Stable performance • High throughput • Low-latency, built-in security • The ability to passively determine operating systems and application versions

19. Security • The NIPS device must be secured against compromise because a compromised NIPS would give an attacker the ability to establish a man-in-the-middle attack against all the traffic entering or leaving the network. • This is typically performed by configuring the NIPS without IP or MAC addresses on data interfaces, using a hardened operating system that resists common attacks, and using a secured management interface that strictly defines who is permitted to connect to and administer the system. • Attackers will seek opportunities to break NIPS, whether using denial of service or to circumvent the protection the NIPS provides, so the NIPS device must be able to withstand any direct attacks.

20. Passive Analysis • In order to help the NIPS identify false-positive traffic, vendors make use of passive analysis techniques to identify host operating systems, network architecture, and what vulnerabilities are present on the network. • Three of the most well-known standalone tools for this purpose are P0f (available at http://www.stearns.org), RNA by SourceFire, and NeVO from Tenable Security, and they should be available to some extent on every NIPS. • Figure next provides a sample analysis using the NeVO system. Once this information is gathered, the NIPS can use it to classify attacks against internal systems based on their operating system and vulnerabilities.

22. Increased Security Intelligence in the Switch Products • Switch-based, "bump in the wire" NIPS is a fast growing market segment, and there is no possible way to predict what all the players will do. • TippingPoint, Enterasys, and Radware. All our efforts to get Cisco to share its plans have failed; however, between the existing Cisco Security Agent, the Network Admissions Program, and educational efforts to help network administrators get more security out of their existing IOS products, it seems certain Cisco will be a player. • A subset of these products includes the true NIPS devices, which are categorized as wire-speed switches, have IPS capability, and, in general, are based on parallel ASICs. These products include TippingPoint's UnityOne IPS and TopLayer Attack Mitigator.

23. TippingPoint's UnityOne IPS • TippingPoint's UnityOne IPS product was currently the overwhelming market leader for a switch-type NIPS. • It offers an inline NIDS that provides multigigabit performance, low latency, and multiple mechanisms to detect known and unknown attacks on the network. In addition to providing IPS features, UnityOne provides the ability to traffic-shape or rate-limit traffic for QoS measures. • It also provides policy enforcement by blocking applications that are prohibited by your organization's acceptable-use policy (such as peer-to-peer apps, web mail, or instant messaging).

24. TippingPoint's UnityOne IPS When the UnityOne device identifies malicious activity or activities that violate policy rules, the engine uses one of four available response mechanisms: • Monitor The UnityOne device monitors the activity, generating a log for later analysis. • Report The UnityOne device simply reports the event without detailed logging data. • Limit The UnityOne device restricts the throughput or rate of the malicious activity. • Block The UnityOne device simply drops the traffic before it is delivered to the destination

25. TopLayer Attack Mitigator • In the days before true gigabit IDS, TopLayer gained fame as the solution for high-bandwidth monitoring via load balancing. • Like TippingPoint's product, this is a very fast box with high availability, hot-swappable components, parallel ASICs, and a price tag to match the performance. • Attack Mitigator's roots are more from suppressing distributed denial of service resource exhaustion and protocol anomaly attacks than a true IPS, but it certainly has the chassis to build on and, like FireWall-1, is very good at well-known, well-understood attacks. • TopLayer calls its inspection technology TopInspect.

26. Switch NIPS Deployment Recommendations • Deploying a NIPS solution is a major project, Start off with reporting-only mode, study the false positives and negatives for your chosen solution carefully, invest the time in creating a sustainable process for configuration management, make sure Operations is a full partner in the process of NIPS deployment, and remember that your NIDS is still a valuable source of information. Begin Budgeting Now • You will probably be strongly considering the next generation of switches with security intelligence sometime in the next two years. This is going to be expensive, so speak to your manager and see what can be done to plan for this expense in a technology refresh cycle.

27. Switch NIPS Deployment Recommendations Review Products in Report-Only Mode • Before you start using a NIPS device to start blocking attacks on your network, run the device in report-only mode. Use this information to identify what events the NIPS would have dropped on your network, and what the impact would have been to the network. Work with Vendors Identifying Test Procedures for False Positives and False Negatives • Ask your vendor to detail its testing procedure for new rules and anomaly analysis techniques. Ensure the vendor uses a combination of "live" and "attack" scenarios at rates that are appropriate for your network environment before shipping you updates. Ask your vendor what techniques it uses to eliminate false-positive traffic, and how it exercises auditing to ensure it isn't missing attacks.

28. Switch NIPS Deployment Recommendations Be Wary of Absence of Auto-Update Mechanisms • consider the purchase of expensive switch NIPS is worm management, this makes being able to keep the device up to date with the latest signatures critical. Be Wary of Auto-Update Mechanisms • Auto-update mechanisms ease the implementation and deployment of NIPS products but can assert a new set of challenges on your organization. Ask your vendor to support a mixed-reporting mechanism, where new rules are placed in report-only mode for a specified amount of time. This way, the organization can take advantage of existing functionality in the NIPS while the analyst has the ability to identify false-positive alerts or performance burdens that affect throughput and latency on the network.

29. Switch NIPS Deployment Recommendations Document a Change-Management Mechanism • Identify who should be responsible for managing updates to NIPS software, and how often the software should be updated. Include information about how the organization should react to updates based on new Internet threats, such as a new worm or other exploitative threat. Having this policy in place before a new threat emerges will define how well your organization will be able to leverage NIPS technology.

30. Switch NIPS Deployment Recommendations Expect the NIPS to Be Blamed for All Problems • A new product like a NIPS is potentially invasive toward network operations. At some point, someone in the organization is bound to experience a problem and cast blame on the NIPS device. The best way to mitigate this problem is to clearly document the use and functionality of the NIPS device and utilize the logging features that come with the NIPS to identify traffic that is dropped, shaped, or altered in any way.

31. Switch NIPS Deployment Recommendations Use a Combination of NIPS and NIDS Where Appropriate • NIDS investments don't go out the window after a NIPS device is deployed. We can still leverage the technology of NIDS devices to aid in assessing threats, baselining attack statistics, and troubleshooting network problems with the addition of a NIPS device. After deploying a NIPS tool, many organizations focus their NIDS tools to monitor internal networks, to aid in identifying attacks that make it past the NIPS device, and to identify insider threats. We don't expect NIDS technology to go away anytime soon; instead, we expect the technology to continue to mature and add value to organizations that take full advantage of the functionality available.