2

If an attacker can establish a VPN connection to the company network and have access to internal resources (by getting various certificates and credentials used to authenticate to the VPN server), which is quite dangerous, how can we detect and monitor such events properly?

What should be the criteria for detecting such attackers on vpn level?

Which tool should be used for such type of monitoring?

And , I would also like the monitoring tool to generate the geographical information of attacker on a map.

(Environment , its openvpn running on centos linux , a machine with both public and private interfaces)

Improve this question
3

properly monitoring will depend on your network configuration and the environment where you feel comfortable. following the scenario and as a quick answer you probably want to do a deep study of this concepts and how apply because tool recommendation will be really specific to your network and you didn't give much info about your network and services.

IDS from wikipedia

An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station

IPS from wikipedia

Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, attempt to block/stop it, and report it

the use of honeypots is really recommended,

In computer terminology, a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of data (for example, in a network site) that appears to be a legitimate part of the site but is actually isolated and monitored, and that seems to contain information or a resource of value to attackers, which are then blocked. This is similar to the police baiting a criminal and then conducting undercover surveillance, and finally punishing the criminal.

The SNMP protocol from wikipedia

SNMP is widely used in network management systems to monitor network-attached devices for conditions that warrant administrative attention. SNMP exposes management data in the form of variables on the managed systems, which describe the system configuration. These variables can then be queried (and sometimes set) by managing applications.

Improve this answer
5
  • Ok , you are not sure about the tool but What should be the criteria for detecting such attackers? i mean what should be the rules or signatures or what else – Ijaz Ahmad Khan Jan 3 '16 at 17:04
  • i was talking about topology network . there are many ways you can configure a openvpn server on a centos machine. in a global scpe i could tell you for ips and ids use snort , for the honeypot check this link and if you need snmp check cacti link – Sarastro Jan 3 '16 at 17:14
  • Lets forget about the tool for a moment , on what basis one should be detecting such events. – Ijaz Ahmad Khan Jan 3 '16 at 17:16
  • 2
    @IjazKhan some of that criteria is up to you. If a hacker uses the internal resources in a normal way, like a real user would, there is no standard thing we can tell you to look for. – schroeder♦ Jan 3 '16 at 17:19
  • let say the attacker its connected to de vpn server as you ask first , he/she , will whant to gain access to the services or the hosts in the network, and depending on the security standards you follow, the attacker will need to gain access, if you didnt follow any security standard probably he/she will get access really easy without causing much noise in your network if you do follow those configuration and usage standars , the attacker will generate suspicious traffic of the network (depending on the experience of the attacker), – Sarastro Jan 3 '16 at 17:36
1

If an attacker can establish a VPN connection to the company network

Which means that either your VPN is insecure by design, that the necessary credentials were stolen because some remote user or similar was hacked or that the attacker has hijacked the remote VPN endpoint and connects directly from there.

how can we detect and monitor such events properly?

The attackers system is in this case usually no different from a legal remote system, because it either uses the credentials of an existing system or it is the (hijacked) system itself. You might find out that the connection is from an unusual source IP address or at an usual time or that there are parallel connections with the same credentials but there is not much more you could do.

At the end you have to deal with this problem like with any other kind of system compromise. It does not matter much if the attacker came in through the VPN, through malware transported with phishing mail or drive-by-downloads or through other ways. What matters is that the attacker is inside the network and causes harm. If you know what normal behavior is in your network you can monitor the network for unusual activity using IDS (Intrusion Detection Systems) or BDS (Breach Detection Systems) etc. But if you don't understand what is normal in your network then all you could do is monitor for common exploits. This offers protection against attackers which use common tools but not more.

There is no system which you can simply put into the network and which will make you fully safe. IDS and BDS or similar systems will help you but work best if you really know your network.

Improve this answer
0

Yes , i got one idea for detection criteria , Your monitoring system ( such as ELK ) can send an alert to the system admin to review the login whose is from such a location that is unexpected ( where you don't expect your employee to be )

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.