0

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner (OpenVAS) on a regular basis (nightly). My concerns are whether
a) wouldn't this render my ids reports during the scan useless and if so,
b) what can i do to prevent this?
I thought of disabling the ids during vulnerability scans, but i believe an intelligent attacker could see these times as the perfect moments for undetected scanning on his own/attacking.

3 Answers 3

1

You've got a number of options.

The first and most common is to instruct the IDS to ignore attacks originating at the vulnerability scanner, and to configure the vulnerability scanner to correspond to the IDS.

The second solution, which requires a lot more work, but has a lot more value is to take this as an opportunity to validate the behavior of both tools and the network. If you analyze the behavior of the vulnerability scanner and the IDS, you should be able to make a fairly precise prediction about the behavior of the IDS in response to the vulnerability scanner. Configure your IDS to record the predicted events and to screen them from reporting, or set them to a very low priority. For example, "I expect to see a port scan from IP Y between timestamp T1 and T2 every night that hits ports P1,p2", etc." That confirms that both security tools are working, and should radically increase your confidence that your network has not been penetrated. (An adversary is going to want to disable your IDS and your vuln scanner; the adversary is very unlikely to do so in a way that will match your predictions). If your adversary is that good, you didn't have a chance in the first place.

Somewhere I have a information assurance/risk management/security management model. As your security practice becomes more and more sophisticated it should enable you to make better and better predictions about your network/environment.

And remember Wallace's first law of network security; if you don't effectively manage your network, your adversary will be happy to do so.

1

On a) most IDS' allow the option of blocking addresses from generating alerts which answers your b).

I believe the approach you are taking is a decent approach however, I need chime in that it is BEST to perform dual scanning. From the OUTSIDE of your perimeter, and from the inside. The reasoning is simple, external scanning usually finds nothing more than low hanging fruit. It is not something one should rely on as being secure. With an INTERNAL scan, you'll often see more services which may be vulnerable. Most admins/engineers have the tendency to think: "Well this is only visibly internally not to worry" which is a horrible approach. If it is not needed disable it. If it is needed by specifics, then create specific rules. Example, you have an internal database that is ONLY accessible to a webserver... There is no need to have this open to your entire internal infrastructure. Minimize the exposure. This allows for defense due to an internal compromise (client side, etc).

Scanners ONLY detect known knowns most of the time. They are not the holy grail of defense. Most IDS', IPS' generate so many alarms, most go ignored. I have found it works best to document the network, document the services, determine which services need access to whom, what, when where, and why. Then I move from there. E.g., "this database is only in use during business hours... Therefore let me create a function/script to solely allow access during those hours." Risk analysis 101. Designing a network from the ground up (since its already in play) is much more secure than slapping on band-aids

1
  • Just to clarify, there is a difference between configuring the IDS to block alerts, and whitelisting the IP so that the attacks go through. You definitely want to perform the latter. The former if the alerts become overwhelming.
    – k1DBLITZ
    Apr 1, 2014 at 16:24
1

If it's that much of a secure environment you should never disable your IDS.

Besides, if your IDS picks up your vulnerability scanner - Thats good as you know your IDS is working and not been tampared with.

I'd recommend something like: 1. Add your IP (which you'll be doing your scan from) to a whitelist so you're excluded from your rules then do your vunerable scan and then remove your IP after the scan. 2. Remove your IP from whitelist and retest with your vunerable scanner - hopefully your IDS will detect your scanner (that way you know your IDS is working) 3. Remove yourself from block list, if you got blacklisted. Back to operation as normal this prevent any external attacks or been open to form of attack during your scan period.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .