How to detect computer network intrusion

Muthoga Kioni

We are usually alert to any strange activity in our bodies. Anything out of the ordinary, high fever or that persistent pain is an alert of the existence of pathogens. These pathogens are obviously unauthorised and unwelcome.

Staying alert to unauthorised computer network activity similarly requires identification of behaviour that is out of the ordinary. The best way is to monitor the behaviour of network users.

There are various contexts in which the observation of user behaviour is vital. During these hard economic times, when drought and the global credit crunch has threatened the survival of many companies, we have witnessed mass layoffs. ICT departments are often left with numerous network accounts that have to be disabled.

Abnormal activity

This sudden workload stretches the department and some accounts are invariably never deactivated. This exposes the affected company to the risk of unauthorised access.

• .

  Keep Reading

• 
  Kibaki and Raila's 'marriage of convenience' that failed
• 
  ACK Archbishop supports catholic bishops' statement on state of the nation
• 
  Kenya's most hated birds pose big threat to Coast ecosystem
• 
  How invasive species became Kenya's million-bird menace

Of course this is not the only risk to network security. Most network breaches are usually internal. The insider threat resides with a current employee or a service provider’s employee. The use of accounts that belong to former employees and the insider threat can be detected through the tracking of network activity.

To track any abnormal network activity, you begin by analysing and mapping the normal day to day activities. These include who accesses which servers and when, when the data transfer peaks, who is authorised to access the network externally, which network services and applications are used and when. Finally, monitoring the use of removable storage devices. These parameters have to be observed and documented on a regular basis in order to build an accurate profile of what is normal for a particular network.

Detecting abnormalities

Any anomaly outside this normal profile will allow network administrators to identify breaches as they happen.

For instance, a computer programmer in a multinational company downloaded sensitive client data from the main database with the intention of selling the data to Internet data brokers. This data theft was detected while it was taking place, not after the breach, when the IT staff were alerted to a surge of data leaving the servers that did not match the normal network body language profile.

Determining the normal body profile and then detecting abnormalities is what alerts us to the presence of pathogens in our systems. This concept is similarly applied to network security.

The writer is an ICT Security and Forensic Specialist. Email: [email protected]