1. Accountability
1

2. Content
Auditing
- review of audit info
- protect log
Access Control Practice
- unauthorized disclosure of info
Access Control Monitoring
- IDS
- IPS
2

3. Auditing
- able to track
- detect intrusions
- reconstruct even and system
condition
- legal recourse material
- problem report
3

4. Audit
- store audits securely
- keep log size under control
- protect log
- right people to review data
- only admin can delete log
- contain activity of high privilege account
4

5. Access Control
Practice
Deny access to system by anonymous user
Limit,monitor admin/power user
Remove obsolete account
Disable unused service
Limit, monitor access rule
Audit system periodically
......
5

6. Unauthorized
disclosure of info
Object reuse
Emanation security
Tempest
White noise
Control zone
6

7. IDS
NIDS - HIDS
Signature based: pattern matching,
stateful matching
Anomaly based:Statistical, Protocol,
Traffic
Rule based
7

8. IDS type
Knowledge/signature-based
State-based
Statistical anomaly-based
Protocol anomaly-based
Traffic anomaly-based
Rule-based
8

9. IDS sensor, IPS,
Honeypot
Analysis engine, Filter received data
& detect suspicious activity
Prevent, intercept in network traffic
Sacrificial lamb
9

10. Threat
Dictionary attack
Brute force attack
Spoofing at logon
Phishing
Identity theft
10

11. Thank you!
11