Table 31 Probing and Scanning Example

Attack name	Probing and scanning
Class/subclass	Read/reconnaissance
Example implementations	Nmap (http://www.insecure.org/nmap) Nessus (http://www.nessus.org)
Prerequisites	Data scavenging
Pertinent vulnerability	None
Typical use	Learn IPs and applications available at victim network
Attack result	Disclosure of information
Likely follow-up attack	Almost anything
OSI layers	37
Detection	IDS and firewalls (with log analysis)
Protection	None
Detection difficulty	4
Ease of use	5
Frequency	5
Impact	2
Overall rating	37

The following list defines the components of the table:

• Member of class/subclass Refers to the class and subclass to which the specific attack belongs. In Figure 3-4, for example, the attack TCP spoofing is a member of the class spoof and the subclass transport.

• Sample implementations Provides examples of the given attack. In some cases, this might link to a website about the subclass of attacks rather than to a specific example.

• Prerequisites Lists required or optional attacks that enable or enhance the attack in question. Optional prerequisites are noted in the field with an (optional) marker. In this case, data scavenging is necessary first to determine the IP address ranges of the systems the attacker will scan.

• Pertinent vulnerability Cites the most common vulnerability type enabling the attack from the list of five vulnerability types discussed earlier in this chapter. In this example, there is no real vulnerability because some form of probing and scanning is always possible on IP networks.

• Typical use Explains the most common use of a particular attack. This generally relates to the attack result.

• Attack result Cites the most common attack result from the list of five explained earlier in this chapter.

• Likely follow-up attack Lists the attack most likely to be run after a successful attempt at the attack in question. In this example, after a probe and scan, almost any attack can be run. From the Internet, application manipulations are very common once a vulnerable system is scanned.

• OSI layers Lists the most common Open Systems Interconnection (OSI) layers used in the attack.

• Detection Lists the security technology that is capable of detecting but not preventing the attack. In this case, intrusion detection systems (IDS) are able to detect many types of scans and probes, and firewalls can also show scans if their log data is analyzed.

• Protection Lists the security technology that actually stops or helps to stop a particular attack. These technologies can also aid in detection but are never listed in both categories. Because there are always exceptions in network security, the inclusion of a particular technology does not mean it is 100 percent effective against the attack. Defense-in-depth still applies.

NOTE

The specifics of how detection and protection technologies work and how they should be implemented is the subject of much of the rest of this book. These technologies are highlighted in Chapter 4, "Network Security Technologies," and Chapter 6, "General Design Considerations," primarily, with their integration into the rest of the designs in the design section of the book. As a result, this chapter provides only summary information about detection and prevention and does not list all cases in which a particular technology detects or stops a specific threat. The information provided in Chapters 4 and 6 fully fleshes out how these threats can and cannot be detected or stopped. Also, in the following tables, "application security" is highlighted as a method of attack detection or prevention. Application security refers to the broad field of computer security outside of secure networking. Proper patching, local host audits, log file analysis, and hardened OS and application configurations are all examples of application security. More information on host security is included in Chapter 4.

The remaining five fields in Table 3-1 are numeric values, and the final field shows an overall rating of the attack. This rating can be used as a rough guide to determine the level of concern you should have for a particular attack. Higher numbers are always better for the attacker and worse for you. The criteria are rated on a 1 to 5 scale, and the overall rating is derived from this formula:

(Detection Difficulty * 1) + (Ease of Use * 2) + (Frequency * 3) + (Impact * 4) = Overall Rating

This formula produces a range from 10 (shouting nasty words at the network with the hope it will crash) to 50 (I won't even say).

WARNING

I chose the values for rating attacks in a completely subjective manner. Anyone with 10 minutes and a favorite spreadsheet program can begin to reproduce these values with weightings more appropriate to their security policy or even the specific area of the network. I selected the values based on my own and my customers' experiences.

These values are presented in summary at the end of this chapter and are used throughout Part 3 of this book, where they are tuned for specific network environments to show the threats most relevant to the network location.

The following describes the remaining five fields and the rating scale for each:

• Detection difficulty Refers to the approximate difficulty network staff will have in detecting the attack. Secure networking best practices (as discussed throughout this book) are assumed. Later, these values might trend up or down depending on the capabilities of a particular network design. The attacker is assumed to have midlevel competence. The probe and scan attack example earned a 4 because most modern scanners have the ability to scan so slowly that they stay below the radar of most IDS systems (1 = almost trivial to detect; 5 = almost impossible to detect).

• Ease of use Refers to how hard the attack is to execute. When tools for the attack are freely available in the public domain, the rating increases. For attacks with no publicly available tools or for which public tools are of limited use (as in the case of worms), the value trends lower. Probing and scanning earned a 5 in this category because almost anyone can scan. Even my Macintosh comes standard with a port scanner in the default installation (1 = elite skills required; 5 = script kiddie ability needed).

• Frequency Refers to how common the attack is in the area of the network in which it is most effective. For example, an Address Resolution Protocol (ARP) redirection attack (detailed later in the chapter) might have a midtier frequency rating even though it is almost never launched against an Internet edge (since the attack doesn't cross routers). As anyone who has ever looked at a firewall or IDS log will tell you, probing and scanning easily earns a 5 in this category (1 = attack is almost never seen; 5 = most large networks see this attack daily).

• Impact A measurement of the damage caused by the successful execution of the attack. This value certainly changes based on the type of asset the attack affects. The rating provided in this field is an average. If there is a very dangerous attack that is made possible by the listed attack, the impact rating tends to increase even if the listed attack is fairly benign. This is the case with probing and scanning. By itself, probing and scanning earns only a 1 in impact, but because scanning makes follow-up attacks more likely to be successful, the attack earns a 2 (1 = little to no impact; 5 = better brush up the résumé, just in case).

• Overall rating Refers to how this attack stacks up against others you are likely to encounter. This rating isn't as important as its relationship to the rest of the attacks under evaluation. For example, an attack rating of 30 doesn't mean that you can ignore the attack, but if you are dealing with several attacks that have higher ratings, you should give them priority (of course, with adjustments based on the location of the network or your own security policy). Later you will see how these overall ratings change based on the location of the network you are trying to protect. What was once a top-5 issue can struggle to be in the top 20 (10 = no worries; 50 = instant insomnia).

The next sections (beginning with "Read") are organized according to the scheme shown in Figure 3-4. The attack classes are the main section headings, with subclasses and attack elements comprising subsections. For each attack element, a table is provided showing the critical information that you, as a network designer, need. Think of the tables as you would the information included on the back of baseball cards: it's information you really want to know in an easy-to-reference format. As such, the tables are included at the beginning of each section and are followed by the supporting text.

Continue reading here: Data Scavenging

Was this article helpful?

0 0