Security Essentials Day 2 Threat and the Need for Defense in Depth
Welcome. As we begin day 2, or the second major set of courses in Security Essentials, the focus
will be on defense in depth. This is a term that was coined by the Department of Defense and is a
crucially important concept in information assurance. The topics that we are going to cover areshown below.
Security Essentials
Day 2
Threat and the Need for
Defense in Depth
Information Assurance Foundations - SANS ©2001 1
Welcome. As we begin day 2, or the second major set of courses in Security Essentials, the focus
will be on defense in depth. This is a term that was coined by the Department of Defense and is a
crucially important concept in information assurance. The topics that we are going to cover are
shown below.
Security Fundamentals
Confidentiality, Integrity, Availability
Threat and risk
Security Policy
What it is and what it is not
How to implement an effective policy
Passwords
Overview of passwords
LC3
Crack
Incident Handling
6 step guide
Information Warfare
Defensive strategies
Offensive strategies
Web security
Web security vulnerabilities
Web security defenses
These are all components of a defense in depth risk management framework as we will explain in
our next slide titled, “Defense in Depth.”
1-1
Defense in Depth
We have covered: perimeter defense, vulnerability
scanning, host and network intrusion detection,
honeypots/honeynets and risk assessment; is there
more?
Now, we add security policy, password strength and
assessment, incident handling, information warfare and
web security.
Defense in Depth - SANS ©2001 2
Are we there yet? Sorry, not yet. The slide shows that while we have covered a lot of important topics, we
still have a ways to go! The concept behind defense in depth is conceptually simple. The picture we have
painted so far is that a good security architecture, one that can withstand the threat, has many aspects and
dimensions. We need to be certain that if one countermeasure fails, there are more behind it. If they all fail,
we need to be ready to detect that something has occurred and clean up the mess expeditiously and
completely, and then tune our defenses to keep it from happening to us again.
One of the most effective attacks that penetrates standard perimeters is malicious code. These are things like
viruses and Trojan software. They come in as attachments to email messages and on those floppies we bring
in from home (even though we aren’t supposed to), and the CD-ROMs we bring home from DEFCON. These
can do a lot of damage. Most people have heard of BackOrifice and NetBus but there are a score of other
Trojans. The best defense is keeping your anti-virus software up-to-date, and scanning at the firewall, server,
and desktop level. It isn’t particularly expensive or hard, but it takes discipline.
I find systems all the time that don’t even record when successful and unsuccessful logons and logoffs occur.
That's just basic, sensible auditing and they don't turn it on. If there is ever a problem, how will we run it to
ground? You may or may not be in a position where you can affect whether these things are done at your
organizational level, but you can often take the responsibility for your office, shop, division, or desktop. There
are even personal firewall software products – like TCP Wrappers, BlackICE Defender, Zone Alarm, Norton
Internet Security, McAfee Personal Firewall – these range from free to commercial software, and they provide
perimeter protection at the host level. I use a personal firewall on my home systems when I connect to my ISP
so that I can stop the simple attacks that many of my friends have experienced. The threat is targeting each of
us. What role and responsibility are you willing to accept for defense in depth?
1-2
Defense In Depth (2)
Network
Host
Application
Info
Defense in Depth - SANS ©2001 3
This diagram shows another way to think of the Defense In Depth concept. At the center of the
diagram is your information. However, the center can be anything you value, or the answer to the
question, “What are you trying to protect?” Around that center you build successive layers of
protection. In the diagram, the protection layers are shown as blue rings. In this example, your
information is protected by your application. The application is protected by the security of the host
it resides on, and so on. In order to successfully get your information, an attacker would have to
penetrate through your network, your host, your application, and finally your information protection
layers.
Using a Defense in Depth strategy does not make it impossible to get to your core resources – the
resource at the center of the diagram. For example, your defense layers might be trivial or easy to
compromise. However, a well-thought-out Defense in Depth strategy, utilizing the strongest
protections feasibly possible at each layer, present a formidable defense against would-be attackers.
Next, we are going to take you on a tour of three famous attacks to see what lessons we can learn
from them. Along the way, we are going to discuss the three key dimensions of protection and
attack. Most of you are already familiar with them. They are: confidentiality, integrity, and
availability. Throughout the Security Essentials program, you will be deploying countermeasures to
protect confidentiality, integrity, and availability; and you may experience attacks against these
dimensions. We can think of these as the “primary colors” of information assurance. By mixing and
matching these -- and we do mix and match, because they are interrelated -- we are able to develop
either a very strong attack, or develop a strong defense. On our next slide, titled, “Agenda,: let’s take
a look at the material we are about to explore.
1-3
Agenda
• Principles of attack and defense
• Risk and threats
• Three famous attacks
• Introduction to vulnerabilities
• Basic countermeasures
• Summary
Defense in Depth - SANS ©2001 4
This slide shows the main topics we are going to cover. We will discuss the threats that are arrayed
against our computer systems. To focus that discussion, we will be concerned with some of the more
famous attacks that have occurred. Now, information assurance can get really complex, but these
kinds of problems decompose nicely. As we work our way through the material, we are going to be
pointing out aspects of confidentiality, integrity, and availability, in both the attacks and also the
defenses we discuss. So if you are new to security, or if you just want a quick review, the way I
think about these things is – a credit card.
Have you ever had a credit card not be accepted? Three different times in a row, when I was buying
tires at a local store in my town, my credit card did not clear. All three times, the bank said their
computers were down. Well, that is an availability attack. Well, it certainly felt like an attack to
me! I live in a small town and a lot of people know me – and so to have my card rejected was very
embarrassing. Confidentiality makes sure that no one but you knows your credit card number. An
example of a confidentiality defense is the way that “padlock” on the bottom of your Internet
browser closes (for Netscape) or appears (with Internet Explorer) when you are executing a secure
transaction -- the bit stream is encrypted to foil casual eavesdroppers. An example of an integrity
attack would be telling someone they lie so much, their own mother doesn’t believe them! (Ha ha -
well, maybe that’s not exactly right.) It might be spoofing by using someone else’s credit card, or
modifying the balance of someone else’s account.
We will continue to explore these fundamental principles on our next slide titled, “Three Bedrock
Principles.”
1-4
Three Bedrock Principles
• Confidentiality
• Integrity Confidentiality
• Availability
Integrity Availability
Defense in Depth - SANS ©2001 5
Keep in mind that the keys we have been discussing are interrelated. So, an attacker may exploit an
unintended function on a web server and use the cgi-bin program “phf” to list the password file.
Now, this would breach the confidentiality of this sensitive information (the password file). Then,
on the privacy of his own computer system, the attacker can use brute force or dictionary-driven
password attacks to decrypt the passwords. Then, with a stolen password, the attacker can execute
an integrity attack when they gain entrance to the system. And they can even use an availability
attack as part of their overall effort to neutralize alarms and defensive systems, so they can’t report
his existence. When this is completed, the attacker can fully access the target system, and all three
dimensions (confidentiality, integrity and availability) are in jeopardy.
Now, I chose a very simple, well-known attack for a reason. A large number (in fact, an
embarrassingly large number) of corporate, government, and educational systems that are
compromised and exploited are defeated by these well-known, well-published attacks.
Now, not all the bad things that happen to computer systems are attacks per se. There are fires, water
damage, mechanical breakdowns, and plain old user error. But all of these are called threats. We
use threat models to describe a given threat and the harm it could do if the system has a
vulnerability as we will see on our next slide titled, “Threats.”
1-5
Threats
• Activity that represents possible danger
• Can come in different forms & from
different sources
• You can’t protect against all threats
• Protect against the ones that are most
likely or most worrisome based on:
– Business goals
– Validated data
– Industry best practice
Defense in Depth - SANS ©2001 6
In security discussions you will hear a lot about threats. Threats, in an information security sense, are
any activity that represent possible danger to your information. Danger can be thought of as anything
that would negatively affect the confidentiality, integrity, or availability of your systems or services.
Thus, if risk is the potential for loss or harm, threats can be thought of as the agents of risk.
Threats can come in many different forms and from many different sources. There are physical threats,
like fires, floods, terrorist activities, and random acts of violence. And there are electronic threats like
hackers, vandals, and viruses. Your particular set of threats will depend heavily on your situation – what
business you are in, who your partners and enemies are, how valuable your information is, how it is
stored, maintained and secured, who has access to it, and a host of other factors.
The point is there are too many variables to ever possibly protect against all the possible threats to your
information. To do so would cost too much money, take too much time, and too much effort. So, you
will need to pick and choose what threats you will protect against. You will start by identifying those
threats that are most likely to occur or most worrisome to your organization.
The way to do this is by identifying three primary areas of threat. The first is based on your business
goals. If your business is heavily dependent on a patented formula you would consider theft of that
formula to be a likely threat. If your business is the movement of fund transfers over a network, you
would consider attacks on that network link to be a likely threat. These are two examples of business-
based threats.
The second type of threats are those based on validated data. If your web site is repeatedly hacked
through your firewall, you would consider Internet hackers to be a major threat. If your main competitor
always manages to find out key confidential information about your business plans, you would start
considering corporate espionage a threat. These are examples of threats identified because of validated
instances of damage based on those threats. In some ways these may be the most serious, because they
have already happened and are likely to happen again in the future.
The final type of threats are those that are widely known in the security industry. To protect against
them is just good common sense. That is why we put badge readers and guards in buildings, why we use
passwords on our computer systems, and why we keep secret information locked in a safe. We may not
have had attacks against any of these, but it is commonly understood to be foolish not to do so.
1-6
Vulnerabilities
• Weaknesses that allow threats to
happen
• Must be coupled with a threat to
have an impact
• Can be prevented (if you know
about them)
Defense in Depth - SANS ©2001 7
The third element of the risk spectrum is the notion of Vulnerabilities. (Remember that the first two
elements are risk and threats.) In security terms, a vulnerability is a weakness in your systems or
processes that allows a threat to occur. However, simply having a vulnerability by itself is not a bad
thing. It is only when the vulnerability is coupled with a threat that the danger starts to set in. Let’s
look at an example.
Suppose you like to leave the doors and windows to your house unlocked at night. If you live in the
middle of the woods, far away from anyone else, this may not be a bad thing. There really aren’t
many people that wander around and, if you’re high enough on the hill, you’ll be able to see them
coming long before they present a danger. So, in this case, the vulnerability of having no locks is
there, but there really isn’t any threat to take advantage of that vulnerability.
Now suppose you move to a big city full of crime. In fact, this city has the highest burglary rate of
any city in the country. If you continue your practice of leaving the doors and windows unlocked,
you have exactly the same vulnerability as you had before. However, in the city the threat is that
much higher. Thus, your overall danger and risk is much greater.
Vulnerabilities can be reduced or even prevented, provided, of course, that you know about them.
The problem is that many vulnerabilities lay hidden, undiscovered until somebody finds out about
them. Unfortunately, the “somebody” is usually a bad guy. The bad guys always seem to find out
about vulnerabilities long before the good guys.
1-7
Relating Risk, Threat and
Vulnerability
Risk = Threat x Vulnerability
Defense in Depth - SANS ©2001 8
OK, we’ve spent the last few slides talking about risks, threats, and vulnerabilities. The three
concepts are extremely interrelated. Their relationship can be found in this simple formula:
Risk = Threat x Vulnerability
This formula shows that risk is directly related to the level of threat and vulnerability you, your
systems, or your networks face. Here’s how the formula works:
If you have a very high threat, but a very low vulnerability to that threat, your resulting risk will be
very low. In the example we used before, if you live in a high crime neighborhood (thus, high threat)
but you keep your doors and windows locked (so you have a low vulnerability), your overall risk is
very low.
If you have a high vulnerability to a threat (by keeping your doors and windows unlocked), but the
threat itself is minor (by living in the woods), once again you have a very low risk factor.
If, however, you have a high level of threat potential (a high crime area) and your vulnerability to
that threat is very high (no locks), you have a high risk factor.
Of course, this formula is nice, but keep in mind that, as we stated way up front, there are no
absolutes in security. Thus it is usually impossible to assign numeric values to areas like threats and
vulnerabilities, so this formula should be used as an aid to guide your thinking rather than an absolute
mathematical calculation. When you begin to get into discussions and arguments about risks, threats,
and vulnerabilities (and yes, you will get into arguments about this stuff) you can refer back to this
basic formula to help guide you in your decision making process.
1-8
The Threat Model
• Threat
• Vulnerability
• Compromise
Vulnerabilities are the gateways
by which threats are manifested.
Defense in Depth - SANS ©2001 9
On the bottom of your slide, it says that “vulnerabilities are the gateways by which threats are
manifested”. So, for a threat model to have any meaning at all, there has to be a threat. Are there
people with the capability and inclination to attack - and quite possibly harm - your computer
systems and networks? What is the probability of that happening? The probability is high that any
non-private address will be targeted several times a year. The most common countermeasure for
most organizations is to deploy firewalls or other perimeter devices. These work quite well to reduce
the volume of attacks that originate from the Internet, but they don’t protect systems from insiders, or
attacks like macro viruses which are able to pass through firewalls about 99% of the time.
So there is a threat, and there are certainly vulnerabilities, and when a threat is able to connect to its
specific vulnerability, the result can easily be system compromise. Again, the most common tactic is
to protect systems with perimeter devices such as firewalls. It’s cost-effective, it’s practical, and it’s
highly recommended. Even the most open universities or other research environments that require
themselves to be very open should be able to do some perimeter defense, even if they can only do it
at the department or building level, or even if they can only do it at the host level.
In the past few slides, we have been discussing theory that provides a framework to understand and
use tools like the ones we discussed in risk management – the big picture. Now we want to move
away from theory a bit into some historical applications of confidentiality, integrity, and availability.
Our next slide is titled, “Four Lessons From History.”
1-9
Four Lessons From History
• Morris worm – Availability - 1988
• Melissa – Availability - 1999
• W32.SirCam worm – Confidentiality
- 2001
• Code Red II – Integrity - 2001
Defense in Depth - SANS ©2001 10
Hopefully, we can learn enough from history to help prevent us from having to repeat it. The attacks
we are going to discuss, perhaps the three most famous information security defense failures are: the
Morris worm, SirCam, and Code Red variant II. These span from 1998 to 2001. We don’t have time
in this course to explore each of these in great detail, but you should be familiar with each of these as
a security professional. As homework, please try an internet search for these attacks and read a bit
more. There are information security lessons that we ought to be able to learn from these well-
known attacks. In each case, there was a computer system vulnerability, and it was exploited.
In each of the cases, there was an absence of defense in depth. In fact, in the case of most systems
affected by the Morris worm, and the Code Red attack, the exploit did not have to penetrate any
defensive perimeters. So, that’s “defense in shallow!”
As we go through each of the attacks, try to look out for the three primary security dimensions:
confidentiality, integrity, and availability. Consider how the defenses for each failed, or did not exist
in the first place. The vulnerability is listed in every case; so please note how the threat was able to
exploit the vulnerability to compromise or affect the target system(s).
1 - 10
The Morris Worm
• Availability attack (Denial of
Service)
• Common vulnerabilities in fingerd
and sendmail allowed rapid
replication
• Internet communications effectively
lost
Defense in Depth - SANS ©2001 11
If you haven’t read Zen and the Art of the Internet, you probably should. It is available at
http://sunland.gsfc.nasa.gov/info/guide/The_Internet_Worm.html. We’ll do a small reading from that
section:
“On November 2, 1988, Robert Morris, Jr., a graduate student in Computer Science at Cornell, wrote an
experimental, self-replicating, self-propagating program called a worm and injected it into the Internet. He
chose to release it from MIT, to disguise the fact that the worm came from Cornell. Morris soon discovered
that the program was replicating and reinfecting machines at a much faster rate than he had anticipated --
there was a bug. Ultimately, many machines at locations around the country either crashed or became
"catatonic." When Morris realized what was happening, he contacted a friend at Harvard to discuss a
solution. Eventually, they sent an anonymous message from Harvard over the network, instructing
programmers how to kill the worm and prevent reinfection. However, because the network route was
clogged, this message did not get through until it was too late. Computers were affected at many sites,
including universities, military sites, and medical research facilities. The estimated cost of dealing with the
worm at each installation ranged from $200 to more than $53,000.
The program took advantage of a hole in the debug mode of the Unix sendmail program, which runs on a
system and waits for other systems to connect to it and give it email, and a hole in the finger daemon
fingerd, which serves finger requests. People at the University of California at Berkeley and MIT had
copies of the program and were actively disassembling it (returning the program back into its source form)
to try to figure out how it worked.
Teams of programmers worked non-stop to come up with at least a temporary fix, to prevent the continued
spread of the worm. After about twelve hours, the team at Berkeley came up with steps that would help
retard the speed of the worm. Another method was also discovered at Purdue and widely published. The
information didn't get out as quickly as it could have, however, since so many sites had completely
disconnected themselves from the Internet.”
Additional information on the Morris worm can be found at
http://www.software.com.pl/newarchive/misc/Worm/darbyt/pages/worm.html.
1 - 11
Morris Worm –
Defense in Depth
• Threat
– No perimeter defense (directly accessible
from the Internet)
– Multiple services on same system
– Unpatched systems
• DiD
– Separation of services
– Apply patches
Defense in Depth - SANS ©2001 12
Robert Morris released the worm to illustrate the problem with unpatched systems. If finger had
been running on a separate system from the mail system, the Internet would have been more resilient
against the attack.
1 - 12
Melissa Virus
• Availability attack
• New “strain” slipped through most
perimeters
• Users activated macro despite
warnings
Defense in Depth - SANS ©2001 13
The Melissa macro virus was first observed Friday, March 26, 1999, and quickly became one of the most well-
known and widely-spread macro virus infections to date. Many sites were aware of Melissa on Friday, others
over the weekend, and of course still others found out Monday morning, so that March 29 was indeed a
challenging day. By late Friday, an excellent description of the virus, including how to identify and contain it at
the host level, had been developed and published by the Computer Emergency Response Team (CERT) at
Carnegie Mellon.
According to Network Associates’ web site (www.nai.com), the virus was first discovered on an "alt.sex"
newsgroup and spread rapidly. This extraordinarily rapid spread of Melissa serves as a warning of how fast a
virus with an unknown signature can spread. If you examine the virus source code, you can see the virus
replicated so rapidly by going through Microsoft Outlook address books and sending itself to the first 50 entries
in each book.
Now, the Melissa virus did no damage in the sense of deleting or stealing files; and only sites with desktop
systems running Microsoft’s Outlook email client were directly affected. However, even systems that did not
spread the virus directly by email still had their Microsoft Word documents infected, and continued to pass on
the virus. Moreover, the cost of dealing with Melissa is in the millions of dollars. How did a virus that does no
explicit damage (such as deleting files) do so much harm? Wreak this much havoc? Well, most of the financial
losses are in the area of lost productivity. This is a big availability attack.
- Some sites have reported that they shut down email entirely for multiple days.
- Others lost email connectivity for several hours while cleaning the virus from their servers.
- System administrators and help desk resources were tied up fighting the virus for periods ranging from three
to five days at most affected organizations.
The Microsoft macro capability is a significant vulnerability, and the opportunity exists for far more serious
attacks than Melissa. And I find this quite interesting because almost all actual users of Microsoft Office
products rarely take advantage of the macro language.
1 - 13
Melissa Virus –
Defense in Depth
• Threat
– Danger of monoculture
– Inadequate security awareness
– Failure to filter principle of least privilege
• DiD
– Simpler email
– Unable to detect state
• Amount of email flowing into a system at a given point in
time
Defense in Depth - SANS ©2001 14
Melissa was able to spread very quickly because everyone was running the same system. This
allowed an attacker to find a single problem and use it to impact companies large and small.
1 - 14
W32.SirCam
• Confidentiality attack, mailed out
random files from hard drive
• Discovered July 2001
• Spread by mail attachments or
unprotected shares
Double file extensions: subject.doc.exe
Defense in Depth - SANS ©2001 15
SirCam was able to spread either by unprotected shares or as an email message. You will recall from
Day 1, Legion is a tool to scan for these Windows unprotected shares. The email message attack
contains an attachment with the classic double file extension e.g. subject_of_email_message.zip.exe.
As a reminder, we were introduced to this trick with sexxxymovie.mpeg.exe on newsgroups to
encourage users to download a variant of SubSeven.
The most common first extensions were .doc and .xls, but many others are possible. The second
extension will be something executable, such as .exe, .com, or .bat. The attached file contains both
the malicious code decoy file copied from the sending infected system.
This attack actually has elements of confidentiality, integrity, and availability. The availability attack
was partly because it deleted files, also, if a number of systems were infected, it put a heavy load on
the mail relay system (the computer that funnels an organization’s email to and from the Internet).
The integrity attack includes the fact that copies of malicious code were copied to multiple locations
on the hard drive. We will look at this problem more with Code Red.
The confidentiality attack was very serious. SirCam chose random files from the hard drive to send
out as the decoy mail message. Over thousands and thousands of mail messages, many of these
turned out to be private for proprietary information.
Additional information about SirCam can be found here:
http://www.symantec.com/avcenter/venc/data/[email protected]
On the next slide titled, “Why So Many Users Executed SirCam,” we learn why so many people
actually double-clicked on the attachment.
1 - 15
Why so many users executed SirCam
Windows Explorer, tools,
folder options
Defense in Depth - SANS ©2001 16
Though many users will doubleclick on anything, years of security awareness training has taught a
lot of people not to doubleclick on executable files from strangers. Many of the recipients had no
clue they were opening an attachment with malicious code for two reasons. First, if the machine is
configured like the slide above, the file will of course appear without the .exe, .com, or .bat
extensions. Second, since the file contains a valid file, chosen at random from the sending infected
system, there really is a .doc or .xls file to look at. The unsuspecting victim never sees the malicious
code.
Your next slide is titled, Search For Unprotected Shares Before SirCam Finds Them.” Since this is
such a big issue, we are going to introduce a new tool to help us find these and other problems. Its
called DumpSec.
1 - 16
Search For Unprotected Shares
Before SirCam Finds Them
DumpSec actually does a lot more than just find shares
Defense in Depth - SANS ©2001 17
Unprotected shares are much-sought-after treasures for attackers. Depending on which share is
unprotected, it could lead to a full compromise of the system. However, this tool can do a lot more.
Let’s take a quick tour.
1 - 17
DumpSec Features
• Dumps user, group, and replication
information
• Dumps file system, registry,
printers and shares permission and
audit settings
• Dumps password policies
• Lists installed and running services
Defense in Depth - SANS ©2001 18
Like SCAT, DumpSec provides a host of information grouped in an easy to find manner. DumpSec
is a great aid to auditors. But, what makes it attractive to attackers is that it can be used in
conjunction with the null session vulnerability that violates the confidentiality of the system.
1 - 18
Null Session
net use \\172.20.244.164\IPC$ “” /USER:””
Defense in Depth - SANS ©2001 19
The null session exploit is an attack against confidentiality. In essence, it’s just “finger” on steroids.
The attacker “logs in” to the Windows NT or Windows 2000 system using the “net use” command
listed on your slide. After logging in, it is possible to gather a great deal of information from the
Windows registry. Though this could be done by hand, it would be very tedious, so there are tools to
make this a reasonable task. The tool shown in the screen shot is DumpSec by SomarSoft. It was
available for free from www.systemtools.com, but they seem to have disappeared, which is a
tragedy. They were wonderful folks and were among the first folks to develop security information
and tools for NT. However, the software is still out on the Internet if you search with an internet
search. DumpSec is available from either www.somarsoft.com or www.systemtools.com. [Editors
Note: the web site www.systemtools.com is again functioning. CMW]
The screenshot shown on the slide was from before I entered the “null session”. Afterwards, I would
be able to enumerate boatloads of information about users, if that system was vulnerable to a null
session attack. Enumerate is a popular term in the industry to describe what we used to call “depth
first, breadth second” searches. So what? Why do you care? Well, if you find a PDC or BDC
(Primary Domain Controller or Backup Domain Controller) you can use null sessioning to get a long
list of user names, including all the members of the Administrator group. Then you could try
consecutive ‘net uses’, trying different passwords. I am not really big on passwords, since they can
be sniffed, or attacked by brute force, but they do have their place. There are a lot of weak
passwords out there and every little bit helps. So, the longer we delay an attacker while they try
dictionary attacks on our passwords, the more likely we are to catch them in the act.
1 - 19
Gather User Information
Defense in Depth - SANS ©2001 20
After executing the null session command we just showed you, DumpSec provides broad access to
information about the valid users of a system. This information can be put to a myriad of uses.
The last logon time can indicate if an account is active. This can help the attacker to determine its
suitability for brute force attacks.
If you were so silly as to not require users to have passwords, this would be painfully obvious to an
attacker.
RAS information can also indicate other systems that may not be as well-secured that could be used
as a backdoor entry point to the main server.
Keep in mind that on Day 1, we showed how to eliminate or control anonymous access to a
Windows 2000 system using administrative tools and configuring the security policy to control this.
1 - 20
