New dimensions in intrusion defense

Sourcefire’s open source IDS engine, Snort, has long been the gold standard of signature-based intrusion detection systems. Snort’s commercial sibling, Sourcefire 3D, takes Snort a step further by adding passive vulnerability assessment and service-anomaly detection to the mix. 3D stands for Discover, Determine, and Defend, referring to Sourcefire 3D’s capability to use knowledge of the services and vulnerabilities that are present in the network in order to defend against attacks intelligently.

The Sourcefire 3D system comprises three layers: RNA (Real-Time Network Awareness) sensors, which perform asset discovery, vulnerability assessment, and anomaly detection; Intrusion Sensors, which analyze network traffic and alert on or block threats; and the Defense Center, which aggregates information from all the sensors and allows you to manage the system centrally. In addition to a variety of alerting methods, Sourcefire 3D can block traffic via inline Intrusion Sensors, or via third-party firewalls, switches, and routers. It can also facilitate remediation of vulnerabilities via third-party patch and configuration management solutions.

We found the RNA sensor interface remarkably intuitive and easy to navigate. RNA was useful in providing powerful security data for review, with its capability to determine host OSes as well as which services are running and even which applications are running them (Apache vs. IIS, for example). As network hosts communicated on our network, the RNA sensor quickly populated its database, and we found this database of services extremely helpful in performing an audit of firewall rules and monitoring for policy compliance. Within minutes of setting up the RNA sensor, we could quickly see all of our live SSH, Web, and mail servers, and locate peer-to-peer file-sharing and other network policy violations.

Unlike other solutions that identify unauthorized services and other behavioral anomalies, Sourcefire requires you to create rules for flagging them. As a result, generating service-anomaly alarms is less intuitive with RNA

than with, say, Lancope’s StealthWatch. Although we successfully created Snort signatures that utilized service profile information, we needed assistance from Sourcefire support to get the alarms firing properly.

In our testing, we found that the distance between the sensor and the host was directly linked to the accuracy of the service profile. Further, although RNA can determine that Apache is running on port 80/tcp of a host, it can’t determine if a required patch or security setting is needed. When Sourcefire incorporates the capability to perform targeted active scans (using Nessus) in its upcoming 4.5 release, both the accuracy of service profiles and the completeness of vulnerability information should be improved.

As with most anomaly-based detection systems, Sourcefire 3D requires a baseline of network traffic to be created as a point of reference. After a baseline of services is created, RNA can flag when a new or unauthorized service appears. This anomaly detection will empower a trained analyst to detect a zero-day attack.