Firewall Wizards mailing list archives
Re: Passwords
From: Vin McLellan <vin () shore net>
Date: Sun, 17 Oct 1999 21:50:47 -0400
Don Helms <dhelms () sw org> wrote:
However, you can track the activity on a given account and see if the patterns change. For example, the guy that logs in to one app every moorning, does his work and goes home. If suddenly that user is running this app, that app and poking round at random, his password might have been compromised. Also keep an eye on time of day for new and unusual activity.
Rick Smith <rick_smith () securecomputing com> replied:
Does anyone have experience with such a thing in an operational environment? My impression was that these systems were had very limited benefits. At most they might help with network and server performance tuning, not security. In the real world it seemed that they'd either be useless at detecting intrusions or they'd be constantly nagged with false alarms (i.e. changes from one project to another).
I'm one of probably hundreds of thousands who have benefited from a similar system that recognized when my telephone credit card number had been swiped (probably when it was used in one of several airports on a business trip) and flipped overseas for criminal exploitation. I got a call from Bell Atlantic asking if I had bounced around Europe over the weekend. I also recall that TRW -- somewhere in the mid-80s, I think -- claimed great success in establishing and codifying a pattern of use for valid subscribers who had legitimate access to your personal credit history... and using variance in that pattern to identify hackers who had somehow obtained valid passwords and were using them (in off hours and through different access points) than the legitimate users of a particular account. Don't most users have fairly set patterns of use: working hours, IP address, at least? Exceptions outside those patterns should be fairly easy to alarm. That's really only an attempt to automate and scale the know-your-users credo that is the norm for small installations. I suspect its only when you get into subtle variances (which app, etc.) that you get swamped with false alarms. YMMV. Anyone have a name for any of the utilities which can do this? Suerte, _Vin
The fact that an intrusion took place doesn't prove the password was compromised, though it's probably the way to bet with most systems these days. Rick. smith () securecomputing com "Internet Cryptography" at http://www.visi.com/crypto/
Current thread:
- Passwords Rex Murphy (Oct 06)
- Re: Passwords Rick Smith (Oct 12)
- Re: Passwords Don Helms (Oct 16)
- Message not available
- Re: Passwords Rick Smith (Oct 16)
- Re: Passwords Rick Smith (Oct 12)
- <Possible follow-ups>
- RE: Passwords sean . kelly (Oct 12)
- RE: Passwords Siglite (Oct 16)
- RE: Passwords Peter J. Kunz (Oct 16)
- RE: Passwords LeGrow, Matt (Oct 18)
- RE: Passwords Doty, Ted (ISSAtlanta) (Oct 18)
- Re: Passwords Vin McLellan (Oct 18)