Network analysis -- Enhancing security assessments

Network security assessment doesn't have to rely on expensive automated tools. In this tip, learn how to use data from freely available tools to produce a comprehensive view of network security.

An IT administrator can deafen his staff to the powerful temptation to use automated assessment technology by showing that performing security assessments using freely available network analysis tools can be instructive, effective and -- admittedly, in a nerdy way -- fun.

Ignore the sirens

The temptation to deploy and rely on automated monitoring, analysis and response technologies can be as overwhelming to network administrators today as the sirens' calls were to Ulysses and his crew during the Golden age of Greece. There's little danger that modern-day IT staff will perish if they trust the fate of their networks to automation, but organisations that rely too heavily on automation may fall prey to the "out of sight, out of mind" syndrome, and attacks may go unobserved. IT's analysis skills may erode over time as staff are diverted to other tasks. Users may introduce unauthorised applications that disrupt essential business applications before they are identified, and either accommodated or removed.

Many of today's sophisticated security and network products have their origins in command line applications and scripts that innovative IT administrators developed to monitor, collect, analyse and respond to security-related events before anyone thought to introduce commercial solutions that automate these processes. Variants and descendants of these applications are readily available as open source software, freeware or shareware. Preparing a toolkit composed of feature-rich traffic generation, capture and analysis tools is simple and inexpensive.

A starter kit for security assessments

Consider some of the security assessment activities you can perform using free or inexpensive network analysis tools:

1. Verify firewall forwarding policy configuration. Use a traffic-generating tool such as ping to verify that firewall rules allow or block traffic between your internal (trusted) networks and external networks, according to the security policy you intend to enforce.
2. Verify egress traffic policy configuration. Place a test system outside your firewall. On the test system, run an application such as Port Listener. Use a port scanner such as nmap, and attempt to connect to the test system at every listening port you configure in order to confirm that your firewall allows access to services you intend to make generally accessible (Web) and restricts the services that users connected to your trusted networks may access according to your Acceptable Use Policy (AUP).
3. Learn who's probing your networks, and from where. Open a firewall log and select a traffic source that is either probing or attempting to attack your network. Use a route analysis program (traceroute, tracert, visualroute) to identify the path over which the attack traffic is forwarded, the service providers along the path, the IP addresses along the way, and the network where the attack traffic originates. Use utilities such as dig, whois, and nslookup to perform reverse DNS lookups (IN-ADDR.ARPA) and whois queries. In real-life situations "“ your Web site is the target of a distributed denial of service (DDOS) attack, for example "“ use the information from address registries and domain name registries to contact technical support at ISPs and the administrators of the networks where the attack traffic originates and work cooperatively to isolate and disable the attack source.
4. Take stock of your network. A LAN traffic capture and analysis program such as Ethereal provides a wealth of information about your network. By observing the types of applications in use, you can identify hosts that provide unauthorised services (e.g., an employee running a personal Web site). You can also determine whether employees are complying with AUPs, whether rootkits and other malicious code are establishing back-channel connections to an attacker's computer, and whether your network is hosting a spam bot.

This handful of possibilities hardly does justice to the power and flexibility of such toolkits. The assessment activities you and your staff can perform are bounded only by your imagination and willingness to experiment with Internet protocols and applications. And your organisation's collective familiarity and expertise with Internet protocols will improve each time you assess your networks in this fashion.

A strategy for improving your organisation's assessment skills

Nurturing assessment skills among your IT staff can begin with simple exercises and gradually become more challenging. A popular introductory exercise is to have staff learn the information-gathering techniques attackers use. Have your staff begin by performing ping scans and port scans using nmap. As they become familiar with nmap, encourage them to try such advanced techniques as OS and service fingerprinting. Encourage them to share their experiences. Schedule a bag lunch conference where staff can discuss the methodologies and speculate how information gathering might be exploited on your network. Have them assess whether current security measures provide adequate defence.

What's the ROI?

An important outcome of encouraging such activities is that expertise becomes a core competency and core value in your organisation. The organisation is also less likely to become so dependent on automation that it cannot isolate and remedy problems for which automated response is not provided.

Automated assessment improves with each generation of analysis technology developed, and though many may argue that automation is necessary, it is still not sufficient to protect an organisation from all threats, known and as-yet unforeseen. Developing security expertise by employing basic network analysis tools complements automated assessments and enhances your organisation's ability to analyse, anticipate and respond to security problems.

About the contributor: David M. Piscitello is president of Core Competence. He has been involved in internetworking technology for 30 years and is an internationally recognised leader in internetworking and fast packet technology. Dave is currently serving as a Security and Stability Advisory Committee fellow for ICANN (Internet Corporation for Assigned Names and Numbers).