• Skip to main content
  • Skip to primary sidebar
  • Skip to footer

securitywing

Menu
  • About
  • Must Read
      • IIS Performance Boost
      • RFID Security
      • Web App Security Testing
      • How to Secure Home Network
      • Prevent Cross-Site Scripting Attacks
      • Renew Self-Signed Certificates
      • Penetration Testing Tools
      • VPN Concentrator
      • Forensic Investigation Tools
      • Digital Certificates
      • Cloud Security Issues
      • Advanced Evasion Prevention
      • Firewall Types
      • Tips to Prevent Data Exfiltration
      • Classified Info Handling
      • MySQL Security
      • Definition of 7 Types of Malware
      • VOIP Security
      • Why Antivirus Software Fails
      • 15 Network Security Vulnerabilities
      • Web App Security
      • IT Security Standards
      • Types of Virtualization
      • Android Security
      • Digital Signature
      • Advanced Malware Protection
    • Close
  • Consultancy
  • Contact

How to Protect Networks against Advanced Evasion Techniques(AET)

by wing

Evasion techniques evade the exiting network security devices such as signature based  IPS and firewalls to enter the internal network to deliver exploits in servers. Most of the Intrusion detection and prevention system rely on attack signatures to identify malicious strings in the traffic. The strings used to evade the devices are not malicious themselves. Their main purpose is to pass through IDS without triggering alarms. 

 

advanced evasion techniqueHow would a system administrator will come to know about the attack if the security device fail to recognize attack signature that resembles normal traffic? The truth is that preventing advanced evasion attack is extremely difficult because  signature based IDS cannot recognize something that is not in its database and which looks like normal payloads. At the end of this post you will learn about what we can do to prevent this advanced level of evasion (AET), but before that   we need to look how  network security administrator and system security administrator secure their network as part  of their daily job. Normally, network admin or system admin examine the firewall and other security device configuration and logs to give a certain level of assurance, while IT auditors do almost the same thing when they audit a network.

Firewall, IPS  protects a network from well known security threats. We transmit sensitive data in encrypted format when we transmit them via public network. Firewall mainly relies on its configuration rules to either allow or deny packets and services, while and IDS(intrusion detection system) also heavily rely on its database to match well-known attack signatures. That is why we always have to accept the risk that a novel signature without any prior records of existence may go undetected by the IPS.

Therefore, we need to remember that  encryption will protect our system only if any malicious string is not encrypted as a normal payload. Firewall defend the systems only when the set rules are not evaded by any evasion techniques.

 

Understand the threats and their impact.

Common evasion techniques are encryption, tunneling, traffic fragmentation, traffic insertion, resource exhaustion etc.

Remember that network based intrusion detection system, usually, do not check encrypted traffic.

Apart from authentication and authorization, the other major security concerns of an organization is to secure the following devices, which has becoming increasing ineffective to protect systems against advanced evasion techniques.

  1. Firewall configuration
  2. Proxy filtering
  3. DMZ

We have to realize that without a proper IT security team, we will always  stay one step behind than the advanced attackers. An organization’s management feel assured about security when they implement security detection and monitoring system, in which case they heavily real on the assurance provided by the vendors’ assurance on their products. Besides venrdors’ claim we get a sense of assurance from internal testing, auditor’s review of the system, security analyst’s evaluation. No matter whatever type of security assurance you have, make sure that your organization have a proper strategy against AET.

What is evasion and how they work?

Some attacks will be visible to you while the other will little visible or invisible. The attacks that goes undetected by our IDS are considered evasion. They work by fooling the logic of the IDS. A IDS consists of a number of logic and knowledge base that helps it to distinguish an attack from the flow of normal data flow.

Ask the following questions when you devise a security plan

  1. How do we know that our network security can protect us when  we will experience real attacks from both internal and external threats.
  2. Can we protect us against browser and other application exploits such as .pdf and Microsoft office vulnerabilities.
  3. Does all our security devices provide us enough security? Why do they fail?
  4. How do we identify the invisible evasion to our system?
  5. Network security device need to handle millions of concurrent connections. Is the security devices fast enough to follow all the traffic. Is it making our network slower?

The two types of server vulnerabilities are: client side vulnerabilities and server side vulnerabilities. Client side vulnerabilities are browsers, pdf readers, office programs, while server side vulnerabilities are web servers, name servers, file servers.

Evasion Testing Tools

Why evasion tools can break network security devices?

  • Most of the network security devices focus on the throughput of traffic. When you have a high speed network connection, you need to make sure the the network security device protecting the connection do not slow down the speed of the traffic because of its own processing limitations.
  • They fail to properly analyze network protocols. When the security devices only check the beginning of a connection for security and then it let the traffic pass without any monitoring, it expose itself to the risk of letting the malicious codes passing through the network.
  • By manipulating the size of the TCP segment size attackers can fool the security system because usually attackers use small fragments to attack and devices are designed to identify small size TCP segments as an attack signature. But, security mechanism fails when an attacker artificially increase the size of the segment-it may evade the security system.
  • Besides, we never know that whether the security devices has any design flaws or not unless the vendor declares it or IT auditor find it.

Remember that Evader just try to bypass the security device such as IPS or firewall, it never try to attack the real target.

 

What can we do to prevent evasion?

We have to accept the fact the evasion can happen at any time and our system will never be full proof. So, we need to decide to what extend our security device capable of protecting our network and accept some level of risk that is almost impossible to eliminate. Besides, we need to continuously improve our security monitoring procedures. Always measure the level of criticality of your IT assets. If your system is critical for your business continuity, plan for an advanced penetration testing and assess your IDS. Never forget to put stronger defense mechanism for all of the security layers: network and perimeter, human, servers and applications. Above all, make sure your organization have the right person who continuously trying to update your system against the advanced attacks.

Tools

You can use the Stonesoft’s free evasion technique tools to test the strength of your nework and security devices.

Related Posts:

  • Tips for Network Security Breach Investigation
  • 20 Ways to Secure Home Network
  • How to Protect Network Against Advanced Malware
  • Top 20 Windows Server Security Hardening Best Practices
  • 3 Simple Steps to Secure Gmail Account from Hackers

Filed Under: Network Security Tips Tagged With: network, protection, security, technique

Primary Sidebar

CISSP Sample Test

Take a CISSP Sample Test

CISA IT governance Sample test



Twitter Follow @securitywing

Categories

  • AWS
  • containers
  • Internet Security and Safety
  • IS Audit
  • IT Security Exams
  • Network Security Tips
  • Off Track
  • Telecom
  • Tutorial

Pages

  • About
  • Best IT Security Certification Exam
  • CISA IT governance Sample test
  • CISA Sample Test
  • CISSP Sample Test Online
  • Consultancy
  • Contact

Popular Posts

  • 8 Effective Ways to Impro...
  • 3 Steps to Install Miniku...
  • Yahoo Mail Security Setti...
  • How to Setup AWS CloudFro...
  • 5 Steps to Setup a Nexus3...
  • 3 Simple Steps to Capture...
  • How to Configure AAA (TAC...
  • How to Install AWS CLI an...
  • How to Configure SNMP in...
  • How to Renew Self-Signed...

Footer

Copyrights

Protected by Copyscape Duplicate Content Detection Software

Securitywing.com reserves the copyrights of all of its published articles.No contents of this site is permitted to be published to anywhere else in the Internet.If any contents are found in any other websites, securitywing reserves the rights to file a DMCA complaint. But you have the right to use the link of any relevant article of this site to point from your website if you consider that it might improve the quality of your article.

Tags

antivirus audit AWS backup browser check cisco cloud computer cyber data database encryption firewall home hsrp ids informaiton internet intrusion it kubernetes linux load balancing malware network protection putty risk router security security tips server ssh SSL switch tools virus vpn vulnerability web webserver website windows wordpress

Copyright © 2010-2023 ·All Rights Reserved · SecurityWing.com