21-3
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 21 Rules
Rules Overview
How do you get root access? You do not have a preexisting account, and physical access isn’t feasible.
The first few options that come to mind are password guessing, password brute force, or exploiting a
known weakness on the host.
You decide to exploit services running on the host, so you need to find out what it is running. To do this,
you have a number of techniques: port scans, OS fingerprinting, banner probing, etc.
Once you’ve identified a vulnerable service or software, you can attack it with a catalogue of exploit
software. Depending on what you find and your available exploits, there are a number of different
effects, usually allowing you to execute arbitrary code.
You now own the host. What happens next is up to you. You have many options: you can install a root
kit, you can crash the machine, etc. You have full access—you can do just about anything on to/from
that host.
Back to Being the Admin
You must now express the plan in terms of information that is reported to you. This attack plan contains
an attack with a follow up of some kind. You might write your plan like:
•
probe
•
attacker to target, buffer overflow
•
attacker to target, root login (compromised host)
At this point, the black hat has compromised the host. What happens next is up to the attacker. This
makes the next few steps especially hard to predict. They want to be able to manipulate the world, they
want to make change. Your newly compromised host is the instrument for change. You can specify
additional potential steps in the plan that make it even more urgent to take care of the situation
immediately. Such as:
•
target to FTP server, code download
•
target to secondary target, buffer overflow
The attacker is now using your compromised host as a launching point for further attacks.
One you’ve mapped out the anticipated attack to watch for, you can define a monitoring plan. The
following task flow outlines the tasks involved in implementing a monitoring plan:
Step 1
Ensure your reporting devices are providing all the data you need. This step involves ensuring that each
device is generating logs about the events that you expect to occur as the result of the probes and attacks.
Depending on the device type, this can involve several substeps, such as specify a logging level, enable
logging for the specific event, and ensuring that the reporting device publishes events to the
Local Controller appliance. It can also involve enabling administrative access to the reporting device
from the Local Controller appliance.
Step 2
Configure CS-MARS to pull events from the reporting devices on your network. This step involves
adding each reporting device to Local Controller. If the reporting device type is not directly supported,
you must define a custom device type for the reporting device. To add a supported reporting device, see
Adding Reporting and Mitigation Devices, page 2-16
. To define a custom device type, see
Adding User
Defined Log Parser Templates, page 15-1
and
Define a Custom Device/Application Type, page 15-2
.
Step 3
Ensure that the event types that you need to study are accepted and processed by Local Controller. If
they are not, you must define a custom log parser template for each event and a custom device template
to which the custom log parser templates are associated. For device types supported by CS-MARS, this
should not be necessary. To define a new parser template, see
Adding User Defined Log Parser
Templates, page 15-1
and
Add Parser Log Templates for the Custom Device/Application, page 15-3
.
