y be performed after the fact in near-real-time.
Clinton Administration’s Policy on Critical Infrastructure Protection
It is important to be familiar with the following legislative issues: The Clinton Administration’s Policy on Critical Infrastructure Protection: Presidential Decision Directive 63, May 22, 1998, was designed to set forth a policy for protecting critical infrastructure in the United States.
The Public Law 104-191 Health Insurance Portability and Accountability Act of 1996 helps improve portability and continuity of health insurance coverage in the group and individual markets. Among other things, it is designed to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, and to simplify the administration of health insurance.
The Financial Modernization Act of 1999, also known as the Gramm-Leach-Bliley Act or GLBA, includes provisions to protect consumers’ personal financial information held by financial institutions.
The fundamental goal of intrusion-detection and intrusion-prevention analysis is to improve an information system’s security. This goal can be further broken down:
Figure 1-4 illustrates the general idea of analysis. An IDS or IPS system will help identify-those anomalous activities that fall outside the realm of what is considered normal baseline activity for the environment. This is considered the general goal, but there is still much debate over how much anomalous data falls outside the realm of normal baseline activity. Some believe the gap is large, while others see very little difference between the two.
Figure 1-4: The relationship between baseline and anomalous network activity
There are many possible data-analysis schemes for an analysis engine, and in order to understand them, the intrusion-analysis process can be broken down into four phases:
Preprocessing is a key function once data are collected from an IDS or IPS sensor. In this step, the data are organized in some fashion for classification. The preprocessing will help determine the format the data are put into, which is usually some canonical format or could be a structured database. Once the data are formatted, they are broken down further into classifications.
These classifications can depend on the analysis schemes being used. For example, if rule-based detection is being used, the classification will involve rules and pattern descriptors. If anomaly detection is used, you will usually have a statistical profile based on different algorithms in which the user behavior is baselined over time and any behavior that falls outside of that classification is flagged as an anomaly. Both pattern matching and anomaly detection are covered later in this chapter.
Upon completion of the classification process, the data is concatenated and put into a defined version or detection template of some object by replacing variables with values. These detection templates populate the knowledgebase which are stored in the core analysis engine:
Once the prepossessing is completed, the analysis stage begins. The data record is compared to the knowledge base, and the data record will either be logged as an intrusion event or it will be dropped. Then the next data record is analyzed.
The next phase, response, is one of the differentiating factors between IDS and IPS. With IDS, you typically have limited prevention abilities—you are getting the information passively after the fact, so you will have an alert after the fact. Once information has been logged as an intrusion, a response can be initiated. With IPS, the sensor is inline and it can provide real-time prevention through an automated response. This is the essential difference between reactive security and proactive security.
Either way, the response is specific to the nature of the intrusion or the different analysis schemes used. The response can be set to be automatically performed, or it can be done manually after someone has manually analyzed the situation. For exam