Serious hackers don't shoot in the dark when attempting to penetrate a system. Instead, they will systematically identify what systems and services your company is running to determine your weakest link. Are you connected to a partner network that has a firewall equivalent to Swiss cheese? Does your remote access system require only mediocre authentication? Do you have in-house staff develop Web pages that haven't been checked for security holes? These are the weaknesses hackers are looking for.
In every hacker's tool bag are a variety of free probing and fingerprinting tools, the purpose of which is to identify specifics about your hardware and software configurations. Some of these tools will undoubtedly check for open ports on your routers and firewalls and identify what system services are available for exploitation. To get an idea of what a hacker would see, download and run some of these tools against your own network. Be sure to let your staff know when these tools are being run, in case there are performance issues when certain scans are launched, and always test them against a few non-critical machines first.
The first step in preventing a hacker from accessing your systems is to block unnecessary, incoming ports on your firewalls. The ports that remain open should be protected as much as possible by patching the services that use those ports, such as Web services, e-mail and FTP. The latest patches should be available from the software vendor. CERT lists vulnerability information about services you may be running. Additionally, Cassandra is an excellent online vulnerability database, freely available to assist you in identifying which vulnerable services you are running, and includes many applications not listed elsewhere.
To determine if someone is using such tools to probe and fingerprint your systems, you'll need to implement at least one type of logging tool that will record port scans, fingerprinting, failed login attempts, etc. Ideally, any open ports should be monitored with an intrusion prevention system [IPS], which will detect and prevent most attacks before they reach your systems. A very common freeware intrusion detection system [IDS], which only detects attacks and does not prevent them, is Snort. A quick Google search will yield plenty of free support and add-ons for Snort.
Whatever system you implement to detect probing and fingerprinting, you'll want to keep an eye on the log files to identify which machines seem to be probing your systems. Many firewalls and intrusion detection/prevention systems can alert you via e-mail or launch a program when an attack is detected, but none of these systems are capable of reaching through the hacker's monitor and slapping their hands. Someday…
About the author
Vernon Haberstetzer, president of security seminar and consulting company i.e.security, has seven years of in-the-trenches security experience in healthcare and retail environments.
