1. Intrusion Detection System Snort

2. What is Snort? • Free and Open Source Intrusion Detection System • Monitor network traffic • Scan for protocol anomalies • Scan for packet payload signatures that represent potential attacks, worms, and unusual activities • Monitoring consoles available • Can be configured as an IPS

3. Where should it be placed? • Snort Tap Placement • Natural Choke Points • Areas where the network topology creates a single traffic path • Artificial Choke Points • Exist due to logical topology of the network • Intranet Trust/Un-trust Zone Boundaries • Similar to Natural Choke Points but are intra-network

4. How does it work? • Snort Rules • Primarily a signature based detection engine • Example: • alert tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"TELNET root login"; flow:from_server,established; content:"login|3A| root"; classtype:suspicious-login; sid:719; rev:7;) • While indicative of attacks, leaks, and protocol violations, false positives are generated

5. How to monitor? • BASE (Basic Analysis and Security Engine) • Number of unique alerts • Alerts ordered by category • Today’s alert • Most frequent src/dest ports

6. BASE – Main Screen

7. BASE – Policy Violations

8. Worm Propagation Analysis Example • Multiple Layers of Antivirus checkers in place: workstations, servers, email-stores, and email gateways • Most active updating checkers gets new signatures every 15 minutes • On September 2005, 3 bagle variants were released quickly • AV companies alerted us, but workstations were affected • Which of the 5000 workstations were affected?

9. Worm Propagation Analysis Example • alert tcp any any -> any any (msg:"Potential Bagle Propagation"; content:"osa6.gif"; classtype:policy-violation; sid:1000003; rev:3;)

10. Conclusion • Snort provides another tool in the toolkit and can help provide information about exactly who’s talking to who on the network • “Security is a process, not a product”