State of the Practice of Computer Security Incident Response Teams ...

Attack tools are more difficult to detect and discover, due to the anti-forensic nature, dynamic
behavior, and modularity of these tools. Attack tool developers use techniques to
hide the nature of their attack. Some tools can vary the patterns and behaviors at random,
through predefined decision paths, or through direct intruder management. And the
modularity of some tools can allow polymorphic tools to self-evolve, as well as tools that
can run on multiple operating system platforms.
• faster discovery of vulnerabilities
The number of newly discovered vulnerabilities reported to the CERT/CC continues to
double each year, making it more difficult for administrators to keep up to date with
patches.
• increasing permeability of firewalls
Although firewalls are often relied upon to provide primary protection from intruders,
technologies and protocols are being designed to bypass typical firewall configurations.
Some of this also arises from increased demands for off-site access and more complex
protocols being allowed through the firewall.
• increasingly asymmetric threat
A single attacker can relatively easily employ a large number of distributed systems to
launch devastating attacks against a single victim. Each Internet system’s exposure to attack
depends on the state of security of the rest of the systems attached to the global
Internet.
• increasing threat from infrastructure attacks
Attacks that affect key components of the Internet can broadly affect organizations and
users who have increasing dependency on the Internet. Distributed DoS attacks, worms
and viruses, attacks on the Internet Domain Name System (DNS)), and attacks against
routers are among the infrastructure attacks that have the potential to disrupt day-to-day
business. The impacts of these infrastructure attacks are denial of service, compromise of
sensitive information, misinformation, and having time and resources diverted from other
tasks.
These trends still hold true at the date of the publishing of this report. One trend that has actually
continued to increase, creating a major impact on CSIRTs and their related constituencies,
is the speed of attacks. With worms such as Slammer and Blaster, and mass email
spreading viruses like Sobig.F, the time to respond to an incident has become drastically reduced.
Because of this, CSIRTS and their constituencies need to be more prepared to take
actions that previously might not have been acceptable, such as blocking certain types of traffic
or shutting down certain services to stop the spread of activity. Some of the actions taken
may cause undesirable affects. For example, when the Slammer worm hit in January 2003,
many sites had to block SQL traffic, causing an impact on legitimate services running on
non-infected systems, as part of a way to stop the worm from spreading. In cases such as
these, CSIRT and IT staff have to take quick action; there may not be time for discussion with
CMU/SEI-2003-TR-001 111