Upload
phamdat
View
217
Download
1
Embed Size (px)
Citation preview
“The Effectiveness of McAfee Host Intrusion Prevention”
Crystal CummingsCPSC 6126
Columbus State UniversityColumbus, United States
Submitted November 9, 2009
1
Abstract— The purpose of this paper is to select
an intrusion detection system and suggest ways to
possibly improve it. In order to this, we need to
understand the purpose of intrusion detection
systems and know how to measure them. The
paper we chose to critique does just that, it
examines how to measure the performance of the
various types of intrusion systems. IT groups in
corporations are tasked every day to keep their
network safe and secure. Meanwhile, malware
attackers are working everyday to find a loophole
in the security of “secure networks”. The damage
could be catastrophic if the proper research was
not done by a corporation to choose the correct
intrusion detection system for their specific needs.
We will evaluate McAfee Host Intrusion
Prevention according to the proposed
measurement matrix. Lastly, we will comment on
what is next for McAfee Host Intrusion
Prevention, whether it is worth it to suggest
improvements or choose the latest technology
currently available.
Keywords- networks, intrusion systems, data
security, malware, performance.
I. INTRODUCTION
Intrusion detection systems are on the rise.
Technology is barely keeping up because of the
many malware attackers that are in existence today.
This is why corporations are desperately seeking a
“cure all” intrusion detection system. Does one
exist? If not, who comes close? Before we can
answer the questions we need to clearly define
what intrusion detection is and decide how to
measure it. The problem we will attempt to solve
is to identify one meaning of intrusion detection of
the many that are out there and to decide if McAfee
Host Intrusion Prevention is strong enough to
thrive in the virus prone networks of today. My
contribution will be to apply an intrusion detection
system to the measurement matrix proposed and to
identify if it can be improved to meet the changing
needs of a corporation or if a new way to secure
the network needs to be explored.
The measurement matrix proposed takes the
various types of outputs an intrusion system can
have and correlates it to the types of architecture in
which the intrusion system could potentially be
operating. The architectures are file, host, network,
and enterprise. As stated in our textbook, the
primary focus of computer security is intrusion
prevention, where the goal is to keep the bad guys
out of your system or network. The purpose of an
intrusion detection system is to detect attacks
before, during, and after they have occurred [1].
We will create a fictitious corporation to illustrate
the use of an intrusion detection system.
Corporation C uses McAfee Host Intrusion
Prevention as its intrusion detection system of
choice. Corporation C uses it to defend against any
unauthorized intrusion and zero-day attacks. To
improve the total cost of ownership, the company
decides to install it on every laptop along with
McAfee anti-virus software. The installation was
not customized; we just followed the defaulted
prompts. How does this corporation fit into the
intrusion systems model?
2
The main limitation of the chosen article is
that it does not mention any specific intrusion
system or software. It is very general and only
names the types of intrusion systems. It also does
not provide any real life examples as to the
application of the proposed solution. It also seems
to need additional work in relation to enterprise –
based networks.
The remainder of this paper is structured
as follows: Section 2 is an overview of my related
work. Section 3 details my proposed solution.
Section 4 concludes this paper.
II. RELATED WORK
We first have to decide what definition of
intrusion detection we would like to go with since
there are so many. One of the first definitions was
from Amoroso. His definition states intrusion
detection is, “the process of identifying and
responding to malicious activity targeted at
computing and networking resources” [2]. Ptacek
and Newsham defined intrusion as, “unauthorized
usage of or misuse of a computer system” [3].
Alessandri et al. defined intrusion as, “a malicious
activity threatening the security policy that leads
to a security failure, that is to a security policy
violation” [4]. Lastly, Bace and Mell defined
intrusion as, “attempts to compromise the
confidentiality, integrity, availability, or to bypass
the security mechanisms of a computer or
network” [5]. We will use a definition inspired by
Alessandri et al. Intrusion will be defined as an
activity that leads to the violation of the security
policy of a computer system. Since we have our
definition, analysis can begin. The types of outputs received from an
intrusion system are based on the work of Johnson
[6]. The article goes on to extend Johnson’s work
and define the “types of output” as the following:
Detection – indicates the occurrence of a
possible intrusion.
Recognition – indicates the type of attack.
Identification – indicates declaring the
exploits used to achieve the intrusion.
Confirmation – indicates that an attack
plan is deduced.
Prosecution – indicates the identity of the
originator of the intrusion [7].
We also need to take into account the types
of techniques that could potential correlate the type
of outputs to the type of architectures. Figure 1
shows a view of all the types discussed above. For
example, file hashes can be used in intrusion
detection systems operating at the file data level.
In Figure 2, we see that McAfee, which would fall
into the host-based category, would only protect
against recognition and detection outputs. It is
assumed that anomaly techniques were applied and
we know that confirmation and identification are
not achievable with any reasonable confidence
levels in an anomaly-based system. However,
host-based system using signature techniques are
expected to work at the confirmation and
identification level depending on the
discrimination abilities of the signatures [1]. We
will now look at what an actual customer of
3
McAfee Host Intrusion Prevention had to say along
with other case studies done on McAfee.
Figure 1. – Intrusion System Matrix
Figure 2. – Intrusion System Footprint
In a McAfee Study, TeliaSonera AB - The
largest telecommunications provider in Sweden
and Finland, offering mobile and fixed network
services to the Nordic and Baltic countries
commented, “We think McAfee best meets our
need for central managing, and we agreed with
their future views on anti-virus technologies and
policies,” adds Larsson. “We knew we could
evolve easily with McAfee over time.” “The Host
Intrusion Prevention solution was one of our main
reasons for choosing McAfee,” adds Stenlund.
“From the beginning, we used it as a desktop
firewall product. Now that it has more
functionality, it integrates better with our Windows
and Microsoft applications and helps us secure our
patch update process” [8].
The Tolly Group conducted a study where
they found that McAfee provides lower Total Cost
of Ownership when compared to Symantec and
Trend Micro. It offered increased reliability and
availability by alleviating the need for in-house IT
infrastructure and resources. It is easy to deploy
and offers flexibility for company growth [9].
Lastly, Cascadian Labs also conducted a
study comparing McAfee, Symantec and Sophos.
They concluded McAfee is a comprehensive suite
targeted at very large enterprises. It has flexible
Active Directory support, a robust reporting
engine, and multi-server database roll-up features
that are useful for companies with thousands of
users and with multiple locations. The most recent
version includes a significant change to the
management console. However, as with previous
versions, McAfee’s installation, deployment, and
basic usability and management features are clearly
more complicated than those of Sophos and
Symantec. In testing, they used the default
configurations. McAfee had decent signature-
4
Techniques
Intr
usio
n Sy
stem
s
Architectures
based detection rates but its day-zero protection
was very poor. Some of this poor performance can
be attributed to the need to configure rules when
using its run-time HIPS configuration, a difficult
and time-consuming task for even a seasoned
security administrator [10].
There are challenges faced by all intrusion
systems. For example, the prosecution output type
requires that information be gathered with high
integrity and totally secured from change.
Although, this is a common requirement in secure
systems, it requires levels necessary to allow
criminal prosecution, within a system that has
intruders present [11]. For an enterprise system,
the technology challenge appears to be the
development of discriminates that will separate
intrusion and non-intrusion events in mixed-trust
data flows. These data flows will often be
occurring on equipments not owned by the
enterprise and therefore the ability to provide local
monitoring of the network will be limited. A view
of these interactions is shown in Figure 3.
Figure 3. – Challenging Areas
III. PROPOSED SOLUTIONS
We have already proposed a solution to the
first problem, which was to identify and adopt one
definition of an intrusion detection system. We
concluded that we would use the following
definition: “an activity that leads to the violation
of the security policy of a computer system”. The
second problem was to apply McAfee to the
measurement matrix proposed. It was determined
that since McAfee is a host- based system, but
uses signature and behavioral intrusion prevention,
it would be able to measure recognition, detection,
identification, and confirmation abilities. An
updated view of Figure 2 is shown below to
include the coverage of having signature based
host system. Lastly, we were tasked with
determining any potential improvements McAfee
could make to be more beneficial to a corporation
or to simply have it replaced.
Figure 2a. – Updated Intrusion System
Footprint
5
McAfee
Host Intrusion Systems
Three areas provide insight into the
performance of intrusion systems. They are the
number of outputs covered by the system, the
types of architecture supported by the intrusion
system, and any areas that overlap each other. We
can conclude that McAfee covers four out of five
outputs, two out of four architectures and produces
no overlap.
While this may be suitable for some
organizations, we doubt that it is suitable for most
given the current technological advancements
today with the various attacks and viruses. For
example, many corporations require some of their
employees to be mobile. It may be for
telecommuting or business related travel. The
employees, at some point, may need to work off-
the-network, in which case, they would need
access to a laptop that is not on the corporations’
network. When these remote employees log on to
the company network, it may be via VPN from a
Wi-Fi hotspot. Still, laptops issued by corporations
require a good intrusion detection system whether
out or in the network. We do not recommend
improving this software to make it more robust.
We will opt for a more advanced technology that
would give greater scalability. Desktop
virtualization is the latest technology that
practically eliminates the use of host intrusion
software at the endpoint or any other point on the
network except at the server level. Desktop
virtualization creates a virtual image on a desktop
or laptop. No data physically resides on the hard
drive; it resides on the server, so if someone were
to physically steal the end device it would be a
waste of time because there is no data to steal.
There are many desktop virtualization
vendors. The major players are VMware, Cisco,
Sun Microsystems, Citrix, and Microsoft. As of
now, no one vendor beats the other, it all depends
on the level of comfort and familiarity the IT
professionals in the corporation have with a
specific vendor. This is a subject area for further
research and next steps.
As for an ideal endpoint security suite, we
believe it should take ownership of the endpoint
security problem and not overly complicate the life
of the security administrator or end-user. It should
be simple, which means it should provide complete
protection with minimal management. It should
also be seamless to the end user and administrators
until it is actually needed and even then, it should
not affect the performance of the system. The
administrators would need to be able to maintain
the security policies through a user-friendly
interface. Every threat should be handled through
the signature database or by other protection
designed to handle outliers and new threats based
on their patterns or behaviors. Lastly, a good
notification system should be in place to alert
administrators about computers that need attention
and the threats it has uncovered [10].
IV. CONCLUSION
The most important impact of the proposed
solutions is the realization that corporations have to
stay ever vigilant in protecting their networks
regardless of the type of network or system chosen.
6
We can safely say that large footprints represent
intrusion systems that provide a broad range of
applicability, thus a wider range of output
information is gained during an intrusion. Smaller
footprints, however, are very specific in their
application. We can also conclude that McAfee is
good at what it does, but that is it, it does not lend
itself for much growth. As a result, removing local
desktops and using virtual hosts with their own
intrusion detection systems provides intruders with
a smaller, more closely-guarded target. However,
this particular solution may not be cost-effective or
reasonable in all cases.
The challenge in security is in keeping
pace with changing threats, as malware attackers
adapt to stay ahead of defenses. Signatures have
demonstrated their worth, but also their limitations
and other approaches have moved antivirus on
significantly. Using anti-malware experts’
experience to define easy to use behavioral
controls based on common threat behavior allows
antivirus tools to block malware proactively.
Signatures provide the ability to define the threat
and clear the damage. For the signature piece, time
remains a challenge when dealing with the
creation, testing and deployment of the system.
Most recently, in-the-cloud security linked the
customer and vendor. It uses the concept of
behavioral heuristics to identify potential threats,
allowing an informational fingerprint to be sent to
the security vendor and, if recognized, blocking the
threat.
Blending reactive and proactive controls
provides the best of both worlds: proactive
behavioral detection that can be easily
implemented to defend against the unknown and
signature-based detection to give an understanding
of the attack and its implications. In-the-cloud
security has continued the progress along this
evolutionary path, virtually closing the gap
between discovery and signature defense [12].
Future work includes but not limited to a
deeper comparison of the measurement matrix,
which includes an examination of all the
performance metrics at all points of overlap on the
intrusion footprint. Likewise, it would be
beneficial to understand the additional benefits that
could be realized at points where there is no
overlap.
REFERENCES
[1] Stamp, M. (2005). Information Security:
Principles and Practice. Wiley-Interscience.
[2] Amoroso, E.G. (1998), Intrusion Detection:
An Introduction to Internet Surveillance,
Correlation, Traps, Trace Back, and
Response, Intrusion.Net Books, Sparta, NJ.
[3] Ptacek, T.H. and Newsham, T.N. (1998),
Insertion, Evasion, and Denial of Service:
Eluding Network Intrusion Detection, Secure
Networks Inc., Syracuse, NY.
[4] Alessandri, D., Cachin, C., Dacier, M., Deak,
O., Julisch, K., Randell, B. and Riordan, J.
(2001), Towards a Taxonomy of Intrusion
Detection Systems and Attacks, IBM Research,
Zurich Research Laboratory, Zurich.
7
[5] Bace, R. and Mell, P. (2001), Intrusion
Detection Systems, NIST Special Publication
on Intrusion Detection System, NIST,
Gaithersburg, MD.
[6] Johnson, J. (1958), “Analysis of image
forming systems”, Proceedings of the Image
Intensifier Symposium, US Army Engineering
Research Development Laboratories, Fort
Belvoir, VI
[7] Tucker, C., Fumell, S., Ghita, B., & Brooke, P.
(2007). A new taxonomy for comparing
intrusion detection systems. Internet Research,
17(1), 88-98. http://search.ebscohost.com,
doi:10.1108/10662240710730515
[8] http://www.mcafee.com/us/local_content/
case_studies/library/cs_teliasonera_ab_s.pdf
[9] Tolly Group, The. (2008, February 27). TCO
Evaluation of McAfee Total Protection
Service vs. Symantec Endpoint Protection
Small Business Edition 11.0 and Trend Micro
Client Sever Messaging Security for SMB.
McAfee, Inc. Retrieved from
http://www.tolly.com/DocDetail.aspx?
DocNumber=208255
[10] Cascadia Labs. ( 2007, November). Endpoint
Securities for Enterprise. Sophos. Retrieved
from
http://www.sophos.com/sophos/docs/eng/mark
eting_material/cascadia-sesc-review.pdf
[11] Sommer, P. (1999), “Intrusion detection
systems as evidence”, Computer Networks –
TheInternational Journal of Computer and
Telecommunications Networking, Vol. 31, pp.
2477-87.
[12] Potter, B., & Day, G. (2009). The
effectiveness of anti-malware tools. Computer
Fraud & Security, 2009(3), 12-13.
http://search.ebscohost.com,
doi:10.1016/S1361-3723(09)70033-8
Images:
Figure 1. Intrusion System Matrix. Source:
Article by Tucker, C., Fumell, S., Ghita, B., &
Brooke, P. in Internet Research (2007).
8
Techniques
Intr
usio
n Sy
stem
s
Architectures
Figure 2. Intrusion System Footprint. Source:
Article by Tucker, C., Fumell, S., Ghita, B., &
Brooke, P. in Internet Research (2007).
Figure 2a. Updated Intrusion System Footprint.
Source: Article by Tucker, C., Fumell, S., Ghita,
B., & Brooke, P. in Internet Research (2007).
Figure 3. Challenging Areas. Source: Article by
Tucker, C., Fumell, S., Ghita, B., & Brooke, P. in
Internet Research (2007).
9
McAfee
Host Intrusion Systems