Proactive Network Surveillance Framework

Abstract

Network security paradigm should be the one that permeates the enterprise, including people, processes and technology. Security failures occur when there is presence of weak spots among any of these. An organization which can not detect and remove such weak spots is going to perish. As can be seen around, most of the organizations today apply a few or many of the existing tools and techniques like firewalls, intrusion detection systems, anti-viruses, anti-spywares etc., to safe-guard the systems against hacking community. But as the number of network breaches, from outside as well from inside, are still on rise, much works needs to be done. This work analyzes trends in network security through an investigation of reactive and proactive network security strategies. Many of common practices have been studied, analyzed, compared and reported in this work. Prior to proactive security research, there existed a meager know how about the â who is our enemy?â , â what tools and techniques they use to attack networks?â , â what are their motives to do so?â etc. This knowledge was quite limited and primarily anecdotal. This made it difficult to create, test and deploy integrated security solutions, for better and efficient Network Security. Various exploits and their detrimental effects have been explored, their respective signatures are captured, analyzed and reported in this thesis work. Many open source Honeypots have also been analyzed by configuring them at the workplace. Comparison of features, their respective levels of interactions and risk factors associated with deployment have been focused. Finally, A Proactive Network Surveillance Framework is proposed. The framework consists of five layers, addressing security at various levels, following the onion model of defense in which defense consists of many layers. First layer of the framework: Core Security addresses the physical security issues. This layer also recommends changes at filesystem level to enhance security of the installed framework.