In today's NetworkNewz, Paul Desmond is going to show us how you can
recover from a security breach and catch the person who has broken
into your network.
And, by the way, it's the New Year and officially the new millennium,
I would like to wish everyone a Happy New Year, and may there be many
more to come.
Patrick Stoddard
NetworkNewz Editor
By Paul Desmond
Network forensics can help you recover from a security breach and
potentially catch the culprit.
You've got a sound security setup, with firewalls, intrusion
detection, authentication and authorization - the gamut. Still, one
day you find that valuable data is missing from a corporate server.
You have no idea whether it's in the hands of an external hacker or a
malicious insider. Now what do you do?
Research aims to unmask intruders
A sampling of forensics-related products
If you've tuned in to the latest security buzz, you'll have heard
that finding the culprit may well require the expertise of a network
forensics specialist. Network forensics involves finding the extent
of a security breach and recovering lost data. Forensics experts also
try to determine how the intruder got past your security mechanisms
and, potentially, who the person is.
It seems there's good reason for the growing buzz. In its annual
computer crime study released in March, the Computer Security
Institute (CSI) found that 90% of 643 companies and government
agencies it surveyed detected a computer security breach within the
previous year, and 74% acknowledged financial losses. The total loss
for the 273 respondents that were able to quantify it was more than
$265 million, an average of nearly $1 million each. That's more than
twice the loss of about $120 million reported in the 1999 CSI study.
Each of the Big 5 accounting firms has forensics practices, as do
consulting outfits such as METASeS, a Meta Group spinoff in Atlanta.
In addition, many vendors sell products that help with forensics,
from log analyzers to programs that make an image of computer hard
drives. You should use some of these, such as logging tools, to
gather data regularly. Others, including the imaging products, are
meant for use only by experts as part of their forensics process.
Forensics feeds off data collected by intrusion-detection systems,
firewalls, switches, routers, servers and various other devices.
Forensics evidence exists in three main places: on the perpetrator's
computer, on the "victim" computer and on the network devices in
between the two, notes Mark Pollitt, unit chief of the Computer
Analysis Response Team for the FBI Laboratory in Washington, D.C.
The key to finding the culprit is to be dogged about collecting log
data from each device in the chain.
"Logs are the key to everything," agrees John Frazier, Chief
Information Security Officer at i2 Technologies, a vendor of supply-
chain management tools. "When there are no logs, there is no way to
evaluate the extent to which you've been compromised."
It's important to store copies of logs from any given device on a
separate server. Doing so will reduce the chance of an intruder
compromising the log to cover his tracks, says Steph Marr, vice
president of information security for Predictive Systems, a New York
network consulting firm. For devices such as routers and switches
that pump out system log records, Marr recommends keeping a copy of
those logs on the same subnet as the device and periodically
forwarding copies to a centralized server. That could help forensics
experts find a series of seemingly innocuous events that, taken
together, indicate an attack.
Understanding the forensics buzz means knowing what to do if you ever
have to call in those forces. Should your company be the victim of an
attack, the first order of business is to take the victim computer
offline. Secure it as a crime scene until forensics experts can take
an image of it, Pollitt says.
