Eicon Networks SHIVA 1100, Руководство администратора, Страница: 59 / 136

Intrusion detection
System Administrator’s Guide 59
Intrusion detection
External attackers attempting to access desktops and servers on the private network
from the Internet are the largest source of intrusions. Attackers exploiting known flaws
in operating systems, networking software and applications, compromise many
systems through the Internet.
Generally firewalls are not granular enough to identify specific packet contents that
signal an attack based on a known system exploit. They act as a barrier analogous to
a security guard screening anyone attempting to enter and dismissing those deemed
unsuitable, based on criteria such as identification. However identification may be
forged. On the other hand intrusion detection systems are more like security systems
with motion sensors and video cameras. Video screens can be monitored to identify
suspect behavior and help to deal with intruders.
Firewalls are often easily by-passed through well-known attacks. The most
problematic types of attacks are tunnelling-based and application-based. The former
occurs when an attacker masks traffic that should be normally screened by the firewall
rules by encapsulating it within packets corresponding to another network protocol.
Application-based attacks occur when vulnerabilities in applications can be exploited
by sending suspect packets directly with those applications.
These attacks can potentially be detected using an intrusion detection system (IDS).
The IDS logs information and sends alerts, so that administrators may be able to
contain and recover from any harm caused.
Setting up intrusion detection and blocking
IDB operates by offering a number of services to the outside world that are monitored
for connection attempts. Remote machines attempting to connect to these services
generate a system log entry providing details of the access attempt, and the access
attempt is denied.
Because network scans often occur before an attempt to compromise a host, you can
also deny all access from hosts that have attempted to scan monitored ports. To
enable this facility, select one or both of the block options and these hosts are
automatically blocked once detected.
Several shortcut buttons also provide pre-defined lists of services to monitor. The
basic button installs a bare bones selection of ports to monitor while still providing
sufficient coverage to detect many intruder scans. The standard option extends this
coverage by introducing additional monitored ports for early detection of intruder
scans. The strict button installs a comprehensive selection of ports to monitor and
should be sufficient to detect most scans.
Warning: The list of network ports can be freely edited, however adding network
ports used by services running on the Shiva unit (such as telnet) may compromise
the security of the device and your network. It is strongly recommended that you
use the pre-defined lists of network ports only.