- "Do I Know This Already?" Quiz
- Threats to Security
- Common Threat Categories
- Network Attacks
- Detection and Mitigation Techniques
- Scanning and Penetration Testing
- Review All Key Topics
- Define Key Terms
- Q&A
- References
This chapter is from the book
This chapter is from the book
This chapter is from the book
Detection and Mitigation Techniques
While 100% prevention of cyberattacks isn’t possible unless a system is isolated from Internet access, there are measures that organizations can take to help reduce the likelihood of a successful attack. One of the first documented signature-based antivirus programs, created in 1987 by Bernd Robert Fix, was used to remove the Vienna virus. This virus infected .com files on DOS-based systems. The antivirus would then only alert on things that it had already seen. As malware and viruses evolved, antivirus software evolved. Next-generation antivirus (NGAV) protects against a group of behaviors, using predictive analytics driven by machine learning (ML) and AI to detect and protect against threats.
Endpoint detection and response (EDR) solutions emerged around 2013, creating a new category for responding to threats. EDR merged legacy AV capabilities with AI and ML. This allowed teams to analyze behaviors on specific endpoints (such as laptops or mobile phones) and respond to issues at any given time.
As the attack surface for organizations expanded and more data was being collected and processed, extended detection and response (XDR) was born. XDR gives organizations a look at threats across their entire technology ecosystem, including endpoint, network, and cloud. Organizations now have the ability to respond to threats and issues in near real time. With XDR sensors on all devices from the perimeter to the endpoint, security teams can get the full picture of what happened in one location.
In addition to implementing antivirus software, regularly updating and patching systems is critical to protecting data. The patches supplied by vendors typically include security fixes for vulnerabilities found in the software. Not applying patches leaves systems vulnerable to attacks. Threat actors can use these holes to gain unauthorized access to systems and data, take over all the systems, or launch attacks on other systems.
Detection Tools
There are many ways to detect and mitigate network-based attacks. One way to do this is to use an intrusion detection system (IDS). An IDS (hardware or software) monitors computer network traffic and sends alerts when it detects malicious activity or unauthorized access to systems as data enters and exits the network, in real time. An IDS analyzes network traffic, log files, and other data sources to detect suspicious activity associated with known threats. This is considered a network intrusion detection system IDS (NIDS). Whereas host-based intrusion detection system (HIDS) are directly on the host system or endpoint and monitor the traffic for that specific host vs. the entire network.
To boost security, organizations can deploy an intrusion prevention system (IPS) within their network traffic flow. An IPS, whether in hardware or software form, actively monitors for suspicious activity and blocks it as necessary. When a threat is detected and blocked, an alert is immediately sent to the system administration for further investigation.
These detection and prevention systems add an additional layer of protection when used along with firewalls.
Firewalls are network security devices that sit at the edge of a network, monitoring incoming and outgoing traffic to identify and block potential cyber threats based on predetermined security policies. Hardware or software firewalls act as a barrier between the internal network and the public Internet. The original firewalls were designed to inspect data packets as they traversed the network. Over time, firewalls improved, addressing application vulnerabilities and utilizing machine learning for advanced detection and prevention.
As illustrated in Figure 3-2, firewalls can be broken up into two categories:
Host-based firewall: Firewall on the endpoint that protects that specific device
Network-based firewall: Firewall on the network that protects the entire network
)
Figure 3.2 Host-Based Versus Network-Based Firewalls
Firewalls come in various types, each with distinct capabilities. Some of these types include
Packet filtering firewalls
Proxy, application-aware firewalls
Web application firewalls
Next-generation firewalls (NGFW)
Packet filtering firewalls inspect data packets as they traverse the network based on a predefined set of rules. These firewalls inspect the surface-level data, such as source and destination IP addresses and ports, to decide whether to allow or drop a packet. Any packet that fails inspection is dropped. Inspections are based on security policies and firewall rules similar to the example rule presented in Table 3-2.
Table 3-2 Sample Firewall Rule
Direction |
Protocol |
Source Address |
Destination Address |
Source Port |
Destination Port |
Action |
|---|---|---|---|---|---|---|
Inbound |
TCP |
Any |
22.34.145.6 |
Any |
80 |
Allow |
Inbound |
TCP |
Any |
Any |
Any |
Any |
Deny |
With most firewalls, the order of the rules matters. Each rule inspects packets until one proves true. Once an action is taken, no other inspections are done on that packet. The rule outlined in Table 3-2 will allow incoming traffic to 22.34.145.6 over port 80 while denying all other traffic.
Because packet filtering firewalls inspect only surface-level data, they provide only basic levels of protection and are easier to bypass.
Packet filtering firewalls can be either of the following types:
Stateless: Inspect each packet individually
Stateful: Track connections and use previous data packets to make a final decision
A proxy, application-aware firewall operates at the application layer of the OSI model. These devices monitor application traffic between a client and server for malicious activity based on the content or payload of the packet in addition to the source and destination IP information.
When a client wants to establish a connection with a server, the proxy firewall first authenticates the client and then forwards the request to the server on behalf of the client. This allows the firewall to inspect and filter all traffic between the client and server, reducing the risk of malicious traffic reaching the server or client.
Web application firewalls (WAFs) are similar to proxy firewalls but are specific to protecting against web-based server attacks such as SQL (structured query language) injection and cross-site scripting (XSS). WAFs monitor and filter HTTP traffic between the web server and the Internet. They offer features such as user-defined policies, traffic logging and alerting, and rule sets that can be customized to provide the appropriate level of protection for a specific web application.
Next-generation firewalls (NGFWs) take the detection and protection game a step further and introduce machine learning (ML) and behavior analytics to allow or deny traffic. These devices conduct deep packet inspection (DPI) to determine whether the packet should be allowed or denied. NGFWs are the most popular firewall type today and provide various services and features in addition to firewall services. These services include malware scanning and filtering, network address translation (NAT) services, advanced threat intelligence, and more.
Individually, all the systems can be utilized during an investigation by reviewing the logs from each system. These logs can also be sent to a Security Incident and Event Management (SIEM) platform that enables analysts and engineers to gather data from all the sources in one location for more efficient and improved security investigations.