Security Monitoring and Attack Detection Planning Guide
Chapter 2 - Approaches to Security Monitoring
On This Page
IntroductionNo company would contemplate conducting business from premises that did not have adequate physical security, such as locks, alarm systems, cameras, fencing, or even security guards. Yet many companies are only becoming aware of the necessity for equal security measures to protect network assets from both external attack and internal intrusion. Security systems such as cameras and motion detectors are useful ways of detecting attempts to enter a building or a restricted area. However, organizations also need to implement systems that monitor network assets and detect attackers. Hence security monitoring is an important component of a successful network security strategy. In August 2004, the United States Secret Service, in conjunction with Carnegie Mellon University Software Engineering Institute's CERT Coordination Center, released a white paper that documents instances in which institutions have been vulnerable to massive fraud committed by their own internal users. For more information, see the "Insider Threat Study: Illicit Cyber Activity in the Banking and Finance Sector" white paper at http://www.secretservice.gov/ntac/its_report_040820.pdf. This report is in English. The 2004 E-Crime survey documents further evidence of this threat. The respondents to this survey included government and organizations in the information, telecommunications, banking, and financial sectors. The survey revealed that 43 percent of respondents detected an increase in electronic crime and data intrusions and that 70 percent reported at least one electronic crime in the previous year. The total cost of electronic crimes for all respondents exceeded 600 million U.S. dollars. For more information about the 2004 E-Crime survey, see the 2004 E-Crime Watch Survey Shows Significant Increase in Electronic Crimes press release at http://www.csoonline.com/releases/ecrimewatch04.pdf. Continued increases in business regulations and a greater awareness of the threats that external and internal attackers present has resulted in increased demands to implement effective security monitoring. To plan effective security monitoring, you must know what technologies are available to implement your solution. This chapter describes the Microsoft technologies that enable security monitoring and correlate security logs for analysis and archival. Note: This document distinguishes between internal and external attacks. An internal attack is one that an employee, usually an administrator, carries out. An external attack comes from outside the organization. Although the increasing prevalence of technologies such as wireless networking makes it possible for external attackers to mount attacks that originate inside the network perimeter, these are still considered external attacks. Implement Security MonitoringYou can record security events using the built-in security event log file that is included in all versions of Microsoft® Windows® from Microsoft Windows NT® version 3.1 and later. This log file provides the basis for security monitoring on Windows-based networks. Additional utilities and programs can correlate these recorded events into a central repository. The security event log file uses a custom database format to record security monitoring data. You can read parts of this file, such as computer names and IP addresses, in a text editor. However, to read all the information in the security logs requires a suitable program, such as the Event Viewer console. The security event log file (SecEvent.evt) resides in the %systemroot%\System32\config directory. Unlike application and system logs, default NTFS file system permissions only allow members of the Administrators group and the system account to access this file. The security event log records two types of event: success audits and failure audits. A success audit event indicates that an operation that a user, service, or program performed completed successfully. A failure audit indicates that a similar operation did not complete successfully. For example, if you enable logon audits for failure events, the security event log records unsuccessful logon attempts. Note: Microsoft Windows Server™ 2003 with Service Pack 1 provides the ability to configure different security audit levels for different users. For more information about this feature, see Chapter 4, "Design the Solution." The following table lists security event categories and the events that each category logs. Table 2.1: Security Event Auditing Categories
The Audit Policy Group Policy setting controls which events create entries in the security logs. The path to these settings is Computer Configuration\Windows Settings\Security Settings\Local Policies. You can configure the Audit Policy settings through the Local Security Settings console, or at the site, domain, or organizational unit level through Group Policy in conjunction with Active Directory. Security logs provide a good foundation for comprehensive security monitoring. Group Policy settings provide centralized configuration of security log audit levels and the default security settings only allow administrators to access the security logs. However, monitoring of distributed attacks and implementing forensic analysis requires a monitoring system that can correlate audit events centrally. Correlate Security Audit EventsThe correlation of security audit events involves the collection of security events from multiple computers and placement of this information into a central location. Security personnel can then analyze this central repository to identify policy violations or external attacks. The repository can also provide the foundation for forensic analysis. This section introduces the Microsoft products and utilities that can correlate multiple security event logs. Several third-party products can also perform these functions. Event Comb MTEvent Comb MT (multi-threaded) is a component of the Windows Server 2003 Security Guide that enables you to parse and collect events from multiple event logs on different computers. Event Comb MT runs as a multi-threaded application that enables you to specify numerous parameters when scanning event logs, such as:
Some specific search categories are built in to Event Comb, such as Account Lockouts, which searches for the following events:
If you want to search for attacks against the default Administrator account, you can add event 12294 (account lockout threshold exceeded) from the system log. This event is particularly important, because the account lockout threshold does not apply to the default Administrator account. Hence an attacker can make multiple attempts to compromise the default Administrator account without triggering the account lockout mechanism. Note: Event 12294 appears as a Security Accounts Manager (SAM) event in the system log, not in the security log. Event Comb MT can save events to a table in a Microsoft SQL Server™ database, which makes it useful for long-term storage and analysis. You can use a range of client programs to access the information in the SQL Server tables, such as SQL Query Analyzer, Microsoft Visual Studio® .NET or numerous third-party utilities. Event Comb MT v10.0 also includes command-line options that you can use to create scripts to automate the collection of events from security logs at regular intervals. Because Event Comb MT does not provide any form of client collection agent or automatically forward events to a central repository, it might not be suitable for all threat scenarios. Event Comb MT is available as a free download from the Account Lockout and Management Tools Web site, at http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e. The Windows Server 2003 Security Guide is available at http://www.microsoft.com/downloads/details.aspx?FamilyId=8A2643C1-0685-4D89-B655-521EA6C7B4DB Microsoft Operations Manager 2005Microsoft Operations Manager (MOM) monitors multiple servers in an enterprise environment. The MOM agent collects events from the event logs and forwards them to the MOM management server. The MOM management server then places those events into the MOM database. MOM 2005 and later can collect events from computers that do not run MOM agents. MOM uses its management pack rules to identify issues that affect the operational effectiveness of servers. You can define additional rules to look for certain events and, when those events occur, send instant notifications by e-mail, pop-up messages, or to pager devices. Although MOM provides many useful functions for security monitoring and attack detection, MOM was not designed for this purpose. Future releases of MOM are likely to provide greater facilities for collation of security logs. Independent Software Vendor SolutionsMicrosoft products do not provide an end-to-end solution for all aspects of security monitoring. The key gaps in current Microsoft product offerings include:
Microsoft partners provide the following products (listed in alphabetical order) that fill these gaps:
|
In This Article
|
