|
It’s no secret that today’s security threat landscape is changing on a daily basis. In order to keep up, IT requires more innovative ways to complement their traditional approach to gathering threat intelligence. In today’s online world, threat volume is rising, propagation speed is increasing, and attacks are becoming more elusive.
All of this makes tracking compromised systems extremely challenging, while actually mitigating problems often appears impossible. Despite mature technologies such as firewalls, intrusion detection and prevention systems, and antivirus, maintaining the security of large and complex networks is still more difficult than it was 10 years ago.
At the same time, user expectations and competitive business needs are greater than ever regarding interoperability, connectivity, and immediate access to data.
As a result, security’s bright side may be on the “dark” side.
What’s a Darknet?
A growing number of organizations are leveraging darknets to increase their security intelligence and, in turn, enhance their security posture. In its simplest definition, a darknet is an area of routed IP address space in which no active services reside. While traditionally every client, server, and network device has a unique IP address for each network connection, a darknet is comprised of a range of addresses for which there are no associated valid services or hosts. Thus, the network is “dark.”
What makes a darknet a powerful security tool is that, after initial tuning, any traffic entering it from any source is most likely hostile. In contrast to a traditional network setup, wherein legitimate IP packets are routed to legitimate destination IP addresses and from legitimate source IP addresses, no legitimate packets should be sent to or from a darknet. Although some packets may enter as the result of misconfiguration, the majority are likely sent by malware that scans for vulnerable services in order to upload, launch, and propagate malicious code.
With the use of darknets, security administrators can spot scanning activity without using complicated analysis technology committing already overburdened resources, and, with a reduced occurrence of false positives. By significantly reducing the effort to analyze traffic, and at the same time improving intelligence gathering, darknets are an efficient tool for providing organizations critical information to help them protect the security and availability of their information assets.
Public Projects
One of the easiest ways for organizations to reap the benefits of a darknet is to participate in any one of a number of public darknet projects. These projects include, among the most well known, the Cooperative Association for Internet Data Analysis, or CAIDA, headquartered at the San Diego Supercomputing Center, an extension of the University of California at San Diego (www.caida.org); the Team Cymru Darknet Project, a corporation of geographically dispersed technologists interested in making the Internet more secure (www.cymru.com); and the Internet Motion Sensor project of the University of Michigan, headquartered in Ann Arbor, Michigan (http://ims.eecs.umich.edu)).
These public darknets measure, characterize, and track the traffic that enters the globally routable unused address space they are monitoring. A variety of providers, enterprises, and academic institutions participate in these efforts, offering resources, deploying sensors, and sharing captured data.
In turn, the project providers keep participants updated regarding emerging threats such as worms, network scanning activities, botnets, denial of service attacks, and more. This enables security administrators to proactively protect their own networks by putting in place the mechanisms to identify and mitigate those threats. A participant organization that receives a report on botnet controllers, for example, can check his or her organization’s firewall logs to determine whether hosts on their internal network are communicating with any botnet controllers and leverage that intelligence to put appropriate countermeasures in place.
Enterprise Darknets
Mid-sized to large organizations can also benefit from implementing their own private darknet. The greater the number of users is in an enterprise, the more devices administrators have to manage, and the greater the need is for safer, faster, and more reliable network traffic analysis. With a private darknet, organizations can quickly differentiate between legitimate and malicious traffic on their networks.
This practice can be especially useful for organizations that communicate regularly with international partners. For these organizations, it is not an option to block all traffic from specific source countries in order to reduce their security risk; with online business activities traversing the globe, international enterprises must remain accessible to partners and associates regardless of their location. Darknets provide a tool for allowing authorized connections from around the globe while also singling out unauthorized connection attempts from any source, near or far.
However, before organizations invest in a private darknet, they must have a proven test environment in place. Once space is allocated in this test environment, the organization can distribute known bad traffic to ensure it reaches the darknet test environment and that security administrators understand what to do with that data.
When the test period is complete, the organization can then identify the unused network space to be allocated to the darknet, monitor it for a period of time to ensure it is not being used, then, if necessary, implement network changes to make sure no legitimate traffic is routed to that space. A collector must also be set up within the darknet that captures any traffic that enters. To further streamline intelligence gathering, organizations may choose to write scripts that automatically respond to certain conditions—for example, sending an SMS message to the security administrator should a known worm appear or suspicious activity occur. Organizations that have security measurement requirements might also consider archiving traffic that is captured by the darknet and storing it in a database for use in supplementing reports from their more traditional security devices.
Darknets are another avenue for organizations to maintain optimal security of their networks. They provide a complement to traditional security solutions – such as firewall and antivirus technology – and give IT valuable security intelligence.
About the Author:
Michael Smith is a senior manager with Symantec Global Services. His experience includes management and technical contribution to enterprise level projects in both the government and commercial sector, and he currently manages a 24x7 Incident Response Team for a large organization.
Go Back
|
