The NSDB and Signatures

The Network Security Database (NSDB)

Accessing the NSDB from the Director Interface

Accessing the NSDB from your HTML Browser

Anatomy of an NSDB Entry

NetRanger Signatures

Embedded Signatures

String Matching Signatures

The NSDB and Signatures

This chapter describes the following topics:

The Network Security Database (NSDB)

This section introduces the Network Security Database (NSDB)---Cisco's HTML-based encyclopedia of network vulnerability information---and describes the following topics:

Accessing the NSDB from the Director Interface

To access the NSDB from the Director interface, click an Alarm icon and then click Show>NSDB on the Security menu. It is not necessary to click an Alarm to view the NSDB; not clicking an alarm before accessing the NSDB opens the main index page, which is pictured in Figure 8-1.

Note You must set a browser preference before you can access the NSDB from the Director interface. To set a browser preference, open nrConfigure by clicking Configure on the Security menu. On nrConfigure, click Preferences on the File menu.Type the path to your HTML browser in the Browser Location field, then click OK.

Figure 8-1: The Network Security Database

Accessing the NSDB from your HTML Browser

To access the NSDB directly from your HTML browser, type the following URL into the browser's location field:

/usr/ciscosec/nsdb/html/all_sigs_index.html

Anatomy of an NSDB Entry

A typical NetRanger NSDB entry contains the following critical security information:

Signature Name---The name of the signature.
Signature ID---A unique ID for the signature.
SubSignature ID---An optional SubID for the signature.
Signature Description---A concise explanation of the signature and what exploits it detects.
Benign Triggers Description---A concise explanation of any "false positives" that may appear to be an exploit but are actually normal network activity.
Related Vulnerability Information---Each signature can have zero or more related vulnerabilities. Each vulnerability information page provides background on the vulnerability and a link to any available countermeasures.
User-defined Notes---The user-defined notes page is an empty template in which you can fill in security information customized to your network security environment.

Figures 8-2 and 8-3 illustrate how these sections are presented in HTML.

Figure 8-2: Signature Name, Signature ID, SubSig ID, and Description

Figure 8-3: Benign Triggers Description and Links

NetRanger Signatures

NetRanger's signatures distill network information and compare it against a rule set indicating typical intrusion activity. If a signature detects misuse or unauthorized activity, it generates an event, which, if it indicates a severe violation, causes an alarm to appear on the Director's user interface.

There are two types of signatures:

Embedded signatures
String Matching Signatures

Embedded Signatures

Embedded signatures have the following characteristics:

They are embedded in the Sensor's binary files.
They are not user-configurable.
Although they detect misuse in TCP-based services (for example, FTP, Telnet, and HTTP), they also detect unauthorized use in ICMP, UDP, NetBIOS, and Windows networking services, among others.

String Matching Signatures

String matching signatures have the following characteristics:

Unlike embedded signatures, they are user-configurable.
They all have a Signature ID of 8000.
They must have a unique SubSignature ID assigned to them.
They search packet information on specific ports, in any of three traffic directions (incoming, outgoing, or both).
They use regular expressions to perform string matching on packets.
The regular expressions can be up to 64 characters in length.

A string-matching signature looks like the following example:

RecordOfStringName     2101     21     1     1     "[Rr][Ee][Tt][Rr][]+passwd"

where RecordOfStringName is the generic title, 2101 is the SubSignature ID, 21 is the port number to detect on (FTP), 1 is the direction (1= to port, 2=from port, 3=both), 1 is the number of string match occurrences to allow before generating an alarm, and "[Rr][Ee][Tt][Rr][]+passwd" is the regular expression to match on.

Detecting a string match is only the first step in identifying misuse; once misuse is identified, NetRanger requires further instructions to send an alarm. When the number of occurrences for a particular RecordOfStringName's regular expression match the Occurrences limit, an action is triggered by a corresponding SigOfStringMatch token.

The following section provides a procedure for setting up corresponding RecordOfStringName and SigOfStringMatch tokens to detect and alarm on the string "secret" used during a Telnet session.

Step 1 On the Director interface, click a Sensor icon and click Configure on the Security menu.

Step 2 On nrConfigure, double-click Intrusion Detection.

Step 3 Click on the Profile tab.

Step 4 Click Manual Configuration, and then click Modify Sensor.

Step 5 Scroll down to the "Matched Strings" signature and click it.

Step 6 Click Expand to open the String Signatures dialog box.

The String Signatures dialog box (see Figure 8-4) consists of a grid containing the following columns: string to search on, SubSignature ID, port to scan, direction of traffic to scan, the number of string matches to allow before triggering an action, the action to trigger, and destinations for the data captured by the signature.

Figure 8-4: The String Signatures Dialog Box

Step 7 Click Add.

Step 8 Enter [Ss]ecret in the String column.

This regular expression detects instances of the strings "Secret" and "secret".

Step 9 Enter a unique number in the ID column.

Step 10 Enter 23 in the Port column.

TCP Port 23 is the well-known port for Telnet traffic.

Step 11 Select To & From from the Direction list.

Step 12 Enter 1 under Occurrences.

Step 13 Select Reset under Action.

Step 14 Enter a 5 in each destination column.

Step 15 Click OK to save the new signature.

Step 16 Click OK to close the Intrusion Detection dialog box.

Step 17 Click Apply to apply the new signature.

Each time the Sensor detects the string "secret" or "Secret" during a Telnet session, it now resets the user's TCP connection, and sends level 5 alarms to all destinations.

Table of Contents

The NSDB and Signatures