?? 292-295.html
字號:
</SELECT>
</font></td>
</tr>
</table>
</form>
<!-- LEFT NAV SEARCH END -->
</td>
<!-- PUB PARTNERS END -->
<!-- END LEFT NAV -->
<td rowspan="8" align="right" valign="top"><img src="/images/iswbls.gif" width=1 height=400 alt="" border="0"></td>
<td><img src="/images/white.gif" width="5" height="1" alt="" border="0"></td>
<!-- end of ITK left NAV -->
<!-- begin main content -->
<td width="100%" valign="top" align="left">
<!-- END SUB HEADER -->
<!--Begin Content Column -->
<FONT FACE="Arial,Helvetica" SIZE="-1">
To access the contents, click the chapter and section titles.
</FONT>
<P>
<B>Intrusion Detection: Network Security beyond the Firewall</B>
<FONT SIZE="-1">
<BR>
<I>(Publisher: John Wiley & Sons, Inc.)</I>
<BR>
Author(s): Terry Escamilla
<BR>
ISBN: 0471290009
<BR>
Publication Date: 11/01/98
</FONT>
<P>
<form name="Search" method="GET" action="http://search.earthweb.com/search97/search_redir.cgi">
<INPUT TYPE="hidden" NAME="Action" VALUE="Search">
<INPUT TYPE="hidden" NAME="SearchPage" VALUE="http://search.earthweb.com/search97/samples/forms/srchdemo.htm">
<INPUT TYPE="hidden" NAME="Collection" VALUE="ITK">
<INPUT TYPE="hidden" NAME="ResultTemplate" VALUE="itk-full.hts">
<INPUT TYPE="hidden" NAME="ViewTemplate" VALUE="view.hts">
<font face="arial, helvetica" size=2><b>Search this book:</b></font><br>
<INPUT NAME="queryText" size=50 VALUE=""> <input type="submit" name="submitbutton" value="Go!">
<INPUT type=hidden NAME="section_on" VALUE="on">
<INPUT type=hidden NAME="section" VALUE="http://www.itknowledge.com/reference/standard/0471290009/">
</form>
<!-- Empty Reference Subhead -->
<!--ISBN=0471290009//-->
<!--TITLE=Intrusion Detection: Network Security Beyond the Firewall//-->
<!--AUTHOR=Terry Escamilla//-->
<!--PUBLISHER=John Wiley & Sons, Inc.//-->
<!--IMPRINT=Wiley Computer Publishing//-->
<!--CHAPTER=10//-->
<!--PAGES=292-295//-->
<!--UNASSIGNED1//-->
<!--UNASSIGNED2//-->
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="290-292.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="296-298.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
<P><BR></P>
<H4 ALIGN="LEFT"><A NAME="Heading10"></A><FONT COLOR="#000077">Local Vulnerabilities</FONT></H4>
<P>A number of security policy settings can compromise a system. A vulnerability checker, such as SAFESuite, eNTrax, or KSA, needs to plow through the system and find any weaknesses. A vulnerability is not necessarily a hack. For example, if the Administrator password is blank, this is not exactly what you would call a well-known and carefully orchestrated hack. A configuration error such as this is simply poor administration, unless you had set the password yesterday, and today you find that it has been cleared.
</P>
<P>NT vulnerability checkers look for NT configuration problems such as the following:</P>
<DL>
<DD><B>•</B> Guest account enabled, which allows remote users without an account to be able to access some of the resources on your system.
<DD><B>•</B> Guest account has no password, allowing remote users access <I>without requiring a password</I> (at one time this was a default setting on NT).
<DD><B>•</B> Password composition and aging rules.
<DD><B>•</B> Weak passwords that can be broken with a cracker.
<DD><B>•</B> Failed login thresholds.
<DD><B>•</B> Permissions on registry entries (numerous hacks have occurred because registry entries were not adequately controlled with DAC, including the famous HKEY-CLASSES_ROOT key whose lack of protection in NT 3.51 allowed arbitrary users to control which programs were launched for given file extensions).
<DD><B>•</B> Remote registry access enabled, allowing remote administrators the opportunity to change critical system settings.
<DD><B>•</B> Individual registry settings.
<DD><B>•</B> Improper permissions on system files and directories, such as the NT perfmon utility that can be used to sniff network packets.
<DD><B>•</B> Unknown services that do not ship by default with NT.
<DD><B>•</B> Running services that are vulnerable to attack, such as SMB running on a Web server, which gives remote probers plenty of information useful for cracking attempts (or the Alerter, which might be used by internal hackers to display Trojan Horse screens asking other users for passwords).
<DD><B>•</B> Shares with permission access control settings, giving full access to remote users.
<DD><B>•</B> Whether IP forwarding is enabled, which can be used to facilitate network attacks.
</DL>
<P>For each of the problems listed, many scenarios exist. David LeBlanc of ISS identified registry key permissions for the Winlogon entry, which allowed Server Operator users to set the initial program for other users. The same flaw allowed operators to change the initial program run when the NT operating system booted. Thus, one easily could get a copy of files from another user even though under normal conditions one would not have read permission to those files. Also, Server Operator users could exploit this hole to easily gain Administrator rights. Plenty of other examples demonstrate vulnerabilities ranging from mild to severe.
</P>
<P>This list represents only a subset of the suite of vulnerabilities a local system can face. Because tracking the security state of these items is nearly impossible with automation, you should invest in one of the NT scanners described in this chapter.</P>
<H3><A NAME="Heading11"></A><FONT COLOR="#000077">Intrusion Detection Products for NT</FONT></H3>
<P>In this section are descriptions of some of the leading NT IDSs. Unfortunately, it is impossible to describe all of the IDS offerings for NT today. The selections here were chosen because in many ways they are complementary rather than competitive.
</P>
<H4 ALIGN="LEFT"><A NAME="Heading12"></A><FONT COLOR="#000077">Look for These Features</FONT></H4>
<P>As in your examination of UNIX IDSs, you need to consider both the features provided by the tools that are important for managing the IDS <I>and</I> the list of attacks detected. You should consider the following systems management factors:</P>
<DL>
<DD><B>•</B> Is the product client-server? If so, is it heterogeneous so that it works across UNIX and NT systems?
<DD><B>•</B> Does the product provide distributed systems management? For example, if the event log is used, can you configure event logs on all of the target machines from the central console?
<DD><B>•</B> How useful are the reports? Can you create your own reports from the data?
<DD><B>•</B> What is the scalability of the tool? How many target nodes can the tool concurrently analyze?
<DD><B>•</B> What kinds of alerts and countermeasures are possible? Can the IDS disable network connections, kill logins, disable logins, or execute administrator defined programs or scripts?
</DL>
<P>Because new product releases appear at least every quarter, you should contact the IDS vendors directly for the latest information on tools you are interested in deploying. Naturally, only by running the products in pilot projects will you be able to properly evaluate them.
</P>
<H4 ALIGN="LEFT"><A NAME="Heading13"></A><FONT COLOR="#000077">Centrax</FONT></H4>
<P>Slightly more than a year old, Centrax (<A HREF="www.centraxcorp.com">www.centraxcorp.com</A>) is a company formed primarily by experts from the CMDS team formerly with SAIC. Many skilled IDS programmers also have joined the Centrax team. The chief product developed by Centrax is called eNTrax.</P>
<P>eNTrax provides key benefits to an organization including the following:</P>
<DL>
<DD><B>•</B> Detection and response of information threats and misuse
<DD><B>•</B> Deterrence of further misuse
<DD><B>•</B> Damage assessment
<DD><B>•</B> Possible prosecution support
</DL>
<P>eNTrax is comprised of two main components: a Command Console and a Target Service. The Command Console provides centralized management of the network. Figure 10.1 shows the main eNTrax console. From the console, you can monitor, detect, and respond to security problems on remote systems. At the console an administrator is alerted to potential misuses and attacks. Responses to attacks can be configured in advance, or an administrator can choose a security alert and interactively respond. Today, eNTrax supports remote system shutdown, remotely killing the login session of the offending user, and disabling the login capabilities of a user. The Command Console manages configuration and collection of audit data from target computers. This feature is valuable because it consolidates log files from NT targets onto a common server. You can keep the raw audit data as NT records it or rely on the event database that eNTrax constructs from the data.
</P>
<P><A NAME="Fig1"></A><A HREF="javascript:displayWindow('images/10-01.jpg',1024,768 )"><IMG SRC="images/10-01t.jpg"></A>
<BR><A HREF="javascript:displayWindow('images/10-01.jpg',1024,768)"><FONT COLOR="#000077"><B>Figure 10.1</B></FONT></A> Command Console for eNTrax.</P>
<P>A target computer is any workstation or server on the network. Each target computer creates audit data as a user performs work such as opening files, copying files, or deleting files. The Target Service, installed on each workstation and server in the network, enables a communications channel between the Command Console and the target.
</P><P><BR></P>
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="290-292.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="296-298.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
<!-- all of the reference materials (books) have the footer and subfoot reveresed -->
<!-- reference_subfoot = footer -->
<!-- reference_footer = subfoot -->
<!-- BEGIN SUB FOOTER -->
<br><br>
</TD>
</TR>
</TABLE>
<table width="640" border=0 cellpadding=0 cellspacing=0>
<tr>
<td align="left" width=135><img src="/images/white.gif" width=100 height="1" alt="" border="0"></td>
<!-- END SUB FOOTER -->
<!-- all of the books have the footer and subfoot reveresed -->
<!-- reference_subfoot = footer -->
<!-- reference_footer = subfoot -->
<!-- FOOTER -->
<td width="515" align="left" bgcolor="#FFFFFF">
<font face="arial, helvetica" size="1"><b><a href="/products.html"><font color="#006666">Products</font></a> | <a href="/contactus.html"><font color="#006666">Contact Us</font></a> | <a href="/aboutus.html"><font color="#006666">About Us</font></a> | <a href="http://www.earthweb.com/corporate/privacy.html" target="_blank"><font color="#006666">Privacy</font></a> | <a href="http://www.itmarketer.com/" target="_blank"><font color="#006666">Ad Info</font></a> | <a href="/"><font color="#006666">Home</font></a></b>
<br><br>
Use of this site is subject to certain <a href="/agreement.html">Terms & Conditions</a>, <a href="/copyright.html">Copyright © 1996-1999 EarthWeb Inc.</a><br>
All rights reserved. Reproduction whole or in part in any form or medium without express written permision of EarthWeb is prohibited.</font><p>
</td>
</tr>
</table>
</BODY>
</HTML>
<!-- END FOOTER -->
?? 快捷鍵說明
復(fù)制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -