Proposal on Enhancing E-Business Security

Enhancing E-Business Security: Exploring OSSEC as an

Intrusion Detection System

Statement of Problem

With the growth of the Internet and its potential, there has been subsequent change in business

model of organizations across the world. More and more people are getting connected to the

Internet every day to take advantage of the new business model popularly known as e-Business.

Internetwork connectivity has therefore become very critical aspect of today's e-business.

IDS are becoming the logical next step for many organizations after deploying firewall

technology at the network perimeter. IDS can offer protection from external users and internal

attackers, where traffic doesn't go past the firewall at all. In order to make the network highly

secure, an IDS/IPS system should detect all sorts of suspicious activities coming to/from hosts in

the network, and should take combative measures to prevent the attack.

The question is which Intrusion detection system (IDS) tool is appropriate to do the job?

There are several open source tools available for enterprise networks, depending on the level of

sophistication and security desired. That been said, I choose OSSEC as an IDS tool for this

project. To start with, OSSEC is an open-source, host-based intrusion detection system (HIDS)

that performs log analysis, integrity checking, Windows registry monitoring, rootkit detection,

time-based alerting, and active response. It's the application to install on your server if you want

to keep an eye on what's happening inside it. OSSEC is supported on Windows and all Unix-like

operating systems.

It is a platform to monitor and control a system. It mixes together all the aspects of HIDS (host-

based intrusion detection), log monitoring, and Security Incident Management (SIM)/Security

Information and Event Management (SIEM) together in a simple, powerful, and open source

solution.

In my research, I will elaborate on OSSEC as IDS tool, the technique it uses in intrusion

detection and then drill down to the functional applicability it provides.

Finally, I will the touch on the limitations of OSSEC and the recommended solution.

OSSEC as IDS tool

OSSEC is an Open Source Host based intrusion Detection System(HIDS) that allows one to

control and monitor security system. It integrates log in monitoring, Security information

management and event management(SIEM) by combining them into a open source solution that

is simple and powerful. OSSEC is essential for e-business since it assists customers in meeting

requirements for PCI. Customers running e-business plat forms are in a position to detect any

unauthorized log in files into their systems through the use of OSSEC especially on all products

and customized applications. It is build in a manner that caters for integrity surveillance, police

enforcement and monitoring. Through OSSEC e-businesses are able to quire an host based

intrusion detection that is comprehensive can be applied on majority of the server platforms. It

utilizes several operating systems such as Linux, windows, Solaris and Mac OS which are

readily available in the information technology markets. It allows customers to customers to

configure into the system alerts that they would require notifications on in real time. It prioritizes

issues that are critical for user hence immediately a customer makes a payment through the

platform an instant notification would be triggered. This is viable given it can be integrated with

sylog and smtp that allow communication via emailed enabled devices. It offers active response

initiatives that make it necessary to repulse an attack once it is initiated operating .The platform

is capable of offering a centralized management of servers across all the operating systems that it

is compatible with. Both agent less and agent based monitoring are made flexible if a business

utilizes OSSEC. This makes it essential for configuration of firewalls and routers .This ensures

that firewall are in a position to restrict the installation of software’s that can highly attack the

and only allows the installation of those that are in line with the customers security requirements.

This essential in contacting an e-business since it entails a lot of financial information between

them.

Many IDS tools are easily compromised however since OSSEC is easily extensible it allows that

the information leaves the servers and is stored in a more secure place. The architectural design

of OSSEC gives a combination of this strategy through delivering alerts and logs which are sent

to a centralized server. This architecture has mentioned before aids centrally managing all its

agents. To bring sanity in the architecture in terms of deployments the rights to manage the

server are made through the administrator. OSSEC installation is light give that it is barely below

1 MB since majority of its analysis is executed at the server hence occupying little space in the

central processing unit. The utilization of the architecture is essential since it user friendly and

provides room for improvement.

Many attacks that are launched on computers and networks often change the functioning of the

system. However OSSEC provides room for integrity checking on system files that offer an alert

once there is a change on the system (Azodi,2016, March). The alerts are not limited to an attack

but also may include instances of a typo by the system administrator, change in directory and

misuse by other employees who have the rights to access the system. Since applications,

operating systems and all devices in a network generate events on every status on the server it

makes it possible for OSSEC to collect the logs and analyze them. This particular capability is

essential for e-business players in detecting whether an error or an attack has occurred. Changes

in firewall rules and an installation of a new application on the client box are also made easy to

detect. OSSEC has the capability of integrating rootkit detection which facilitates the detection

of criminal hackers once they launch an attack to the e-business platform. Finally it is essential

for customer interaction since the architectural setting allows for active responses.

Technique applied by OSSEC on Intrusion Detection

OSSEC applies active response approach in detecting an intrusion whenever it occurs. Active

response is build in the platform with the aim of blocking potential offenders in a manner that

allows the system to protect itself rather than monitoring what happens passively. Due to this

capabilities OSSEC can also be classified as a intrusion prevention system(IPS) since it offers a

greater mechanism when preventing an attack to a network. While implementing OSSEC active

response is limited to acting in a manner that destructs internet protocol addresses(IP) and users.

There two major parts when it comes to the configuration of active responses. The first essential

part involves defining all the necessary commands while in the second part which is the active

response defines when they can be triggered. All commands are then referenced with

corresponding active responses that suit them. The reason behind this is that in the event

unfamiliar command is entered it provokes an error. Thus only the defined command can be

carried out using OSSEC otherwise any other attempt will be repulsed. The final component

after configuration is a connection between active responses and rules. Rules are the triggered

commands which are acted upon by active responses associated with them. Once configuration

files are checked, all enabled active responses into a file are generated and are subsequently held

under the existing OSSEC directory.

All commands initiated with the aim of preventing an attack as a component of active responses

are defined using<command> which is placed beneath<ossec_ config> that is the top level

element. All command elements utilize different elements to give an allowance of the number of

subjects that can be executed by the system. The relationship that exists between a command

and active response is maintained at a constant ratio. Active responses are triggered whenever

the rules that they are bound too are also triggered. If one tries to pass a particular IP address

related to the command then an active response will be triggered thus notifying the admin of an

impending danger.

OSSEC Architecture

OSSEC architecture makes use of two models which are the master agent architecture and the

local model. Under the master agent architecture the central server receives and monitors

information originating from agents. The local model uses one system to monitor information

flow.

OSSEC Architecture: Courtesy of: http://www.tothenew.com/blog/benefits-of-using-a-host-

based-intrusion-detection-system/

The OSSEC server remains the central peace in deploying OSSEC.OSSEC server is responsible

for storing events, system audit entries as well as checking the logs. System rules and

configuration options are contained within the server making it possible for managing a large

number of agents (Bereziński,2016). The agents are programs that are monitored within the

system. Agents are responsible for collecting raw data and channeling it to the server for

correlation and analysis. OSSEC offers its agents security by running a low privilege user that is

created during the installation process.

Functioning of OSSEC

On receiving logs from agents the OSSEC server carries an analysis then triggers active

responses to the system administrator in the event an error is detected. The internal processes

carried out by the OSSEC server are;

Analysis of events which is the main process.

Receiving remote logs from agents

Log collector which is responsible for reading all log files.

Agentd that is responsible for forwarding logs to the server.

Maild responsible for email alerts.

Execd the process executes active responses.

Log Analysis flow diagram-OSSEC courtesy of: http://www.tothenew.com/blog/benefits-of-

using-a-host-based-intrusion-detection-system/

Functional applicability of OSSEC in e-business

E-business involves many real time transaction especially if customer orders are to be met with

ease. OSSEC has real time alerting capabilities depending on priority which notify clients in the

event the system is triggered (Yeo,2017). Despite its intrusion capabilities the alerts can also be

incorporated in a business environment setting. Once a client on the other side creates a business

user account the communication between him or her and the system can be initiated. However

the communication will not be with an aim of by passing existing internet protocols but laying a

easy means of communication between the buyer and the seller. The buyer and owner of the

system still remains protected since OSSEC can only executes those commands that it is set to

perform. The platform is easily manageable in the 21st century since it only requires both parties

to operate under email enabled devices.

Since OSSEC allows for a centralized server to manage organizational policies across different

operating systems it will be easy for an e-business organization to integrate a client. Its capability

can easily match most of the operating systems that online users utilize such as windows. It will

be easy to monitor the e-business environment with ease as a result of both agent and agentless

information. Creating an online platform is easy within the platform since there is easy of

amending and creating new policies that match business requirements. Despite the ease of

amending policies they are triggered by the confirmation of an alert to the administrator on the

need of an account. This thus would protect the organization from any chances of the buyers

using the loophole to penetrate into the organization administrator portal.

Since the platform supports, switches, firewalls and routers it is ideal in maintaining client

information and organizational information. At the age of e-transactions malicious persons are

more interested in accessing user log inn in order to still their critical information. Since e-

business transactions involve exchange of financial information between the buyer and the seller

the platform can only be secured with OSSEC for the sake of maintaining data integrity. OSSEC

would make it difficult for hackers to by-pass its firewalls and IP addresses for them to access

any parties information. Such a system would also work in ensuring user confidence when it

comes to transacting online. This is essential because many entities and customers have fallen

trap to malicious ware that snips their information due to the failure of concerned organization to

use appropriate intrusion detection systems.

Limitations of OSSEC

One of the limitations of OSSEC is that it sends only a limited number of alerts per hour making

it easily by passable by a hacker .E-businesses are potential target by online hackers since they

can easily utilize different tools( Jain,2016, December). If a hacker engages OSSEC on the first

step and then launches an attack later it would be practically possible. This thus posses as a

potential risk for those e-business that may rely on the platform while protecting intrusion. In

order to be more convenient towards preventing intrusions the platform should consider

increasing the number of alerts. Though it is difficult that an attacker would trigger 12 active

responses without be noticed chances are such an attack can be triggered at times when the

system is busy thus the alerts be made to go unnoticed. An hour is quite a lot of time for an

attack to take place and before the system debugs allot damage and information would have been

made making the system more vulnerable to subsequent attacks.

Another limitation of OSSEC is that it does not have the capability to differentiate a friend and

an enemy. This is because once a error to the system is triggered through active response the

system tends to lock the network down. However most surprising the error could even be caused

by an organizational employee which is not actually a real threat. Once an alert is triggered the

network locks down until a technical professional resets the detection system. In the light of the

e-business clients can easily lose confidence with an organization whose networks often lock

down since transactions are often swift and they are expected to be more convenient .Such an

action can also lead to a loss of revenue as customer switch to organization that utilize a more

friendly system regardless of the security detection level.

OSSEC does not actually protect attacks but contributes towards uncovering it as an attacker

tries to bypass the system. Thus organization should not only depend on it as the only security

plan by also incorporate other mediums that report to actual attacks either through system

debugging or changing the system configuration to disadvantage the attacker. In e-business it

would be largely risky to entrust OSSEC on all occasions given the potential of risky it posses.

However if combined with other detection systems as well as staff who can react appropriately in

the event of an attack it becomes an appropriate tool for intrusion detection within organizational

network.

Students also viewed