This document summarizes a seminar presentation on Tripwire, an open source intrusion detection system (IDS). Tripwire monitors key files and directories on a system and detects any changes or modifications. It works by creating a database of file attributes when first installed and then comparing this baseline to the current system to detect any differences. If unauthorized changes are found, Tripwire reports these violations. It can be used to detect intrusions and malware on servers and network devices. Tripwire provides visibility into changes across an organization's infrastructure and helps restore systems to a known good state.

1. Seminar on the topic..
“…..TRIPWIRE…..”
……AN OPEN SOURCE IDS…..
PRESENTED BY,
ASHALEKSHMI.S.S.

2. CONTENTS…
WHAT IS TRIPWIRE???
BASIC PURPOSE.
OPERATIONS.
 ACTUAL WORKING.
WHERE IS TRIPWIRE USED.
TRIPWIRE FOR NETWORK DEVICES.
APPLICATIONS.
ADVANTAGES.
LIMITATIONS.
CONCLUSION.

3. WHAT IS TRIPWIRE ?
 Reliable intrusion detection system.
 Tool that checks to see what changes have been
made in our system.
 Pinpoints, notifies, determines the nature, and
provides information on the changes on how to
manage the change.
 Mainly monitors the key attributes(like binary
signature, size and other related data) of your files.

4. …..
 Tripwire has a powerful feature which pinpoints the
changes that has taken place, notifies the administrator of
these changes, determines the nature of the changes and
provide you with information you need for deciding how to
manage the change.
. All Tripwire installation can be centrally managed.
Tripwire software’s cross platform functionality enables you
to manage thousands of devices across your infrastructure.

5. BASIC PURPOSE..
Tripwire is a free and open-source software tool.
It functions as a host-based intrusion detection system.
Intrusion detection systems are of two main types,
network-based (NIDS) and host-based (HIDS) intrusion
detection systems.
Intruders usually leave traces of their activities (changes in
the system state).

6. BASIC PURPOSE…
Tripwire looks for these by monitoring key attributes of
files that should not change—including binary signatures,
size, expected changes in size, etc.—and reporting its
findings.
While useful for detecting intrusions after the event, it can
also serve many other purposes, such as integrity assurance,
change management, policy compliance, and more

7. OPERATIONS TAKES PLACE…
First, a baseline database is created storing the original
attributes like binary values in registry.
If the host computer is intruded, the intruder changes
these values to go undetected.
The Tripwire software constantly checks the system logs
to check if any unauthorized changes were made.

8. ….
If so, then it reports to the user.
User can then undo those changes to revert the system
back to the original state.

9. TRIPWIRE MANAGERS..
There are two types of Tripwire Manager
Active Tripwire Manager
Passive Tripwire Manager
 This active Tripwire Manager gives a user the ability to
update the database, schedule integrity checks, update and
distribute policy and configuration files and view integrity
reports.

10. ….
The passive mode only allows to view the status of the
machines and integrity reports.

11. ACTUAL WORKING…
 Install Tripwire and customize the policy file.
 Install the Tripwire software into the system and then
specify the files to be checked by writing the policy files.
Using the version 4.0 writing the policy file is made very
easy.
 Initialize the Tripwire database .
 The database is initialized with the important key
attribute in the file to be checked. Build database of
critical system files to monitor based on the contents of
the new, signed Tripwire policy file.

12. Actual working…
 Run the integrity check .
 Compare the newly created Tripwire database with the
actual system files, looking for missing or altered files,
according to the integrity check timing specified by in the
policy file for different files that are to be monitored.
 Examine the Tripwire report file .
 View the Tripwire report file to note any integrity
violations.

13. ……
 If unauthorized integrity violations occur, take
appropriate security measures .
 If monitored files have been altered inappropriately, the
system administrator have to take immediate action, you
can either replace the original files from backup copies
reinstall the program, or completely reinstall the operating
system.
 If the file alterations were valid, verify and update the
Tripwire database file.

14. …..
If the changes made to monitor files are intentional, edit
Tripwire’s database file to ignore those changes in
subsequent report.
 If the policy file fails verification, update the Tripwire policy
file .
 To change the list of files Tripwire monitors or how it treats
integrity violations, update the supplied policy file,
regenerate a signed copy, and update the Tripwire database.

15. WHERE IS TRIPWIRE USED ?
Tripwire for Servers(TS) is software used by servers.
Can be installed on any server that needs to be monitored
for any changes.
Typical servers include mail servers, web servers, firewalls,
transaction server, development server.
It is used for network devices like routers,
switches, firewall, etc.

16. …..
If any of these devices are tampered with, it can
lead to huge losses for the Organization that
supports the network.

17. TRIPWIRE FOR NETWORK DEVICE
 Tripwire for network devices maintains a log of all
significant actions including adding and deleting
nodes, rules, tasks and user accounts.
 Automatic notification of changes to your routers,
switches and firewalls.
 Automatic restoration of critical network devices.
 Heterogeneous support for today’s most
commonly used network devices.

18. APPLICATIONS.
Tripwire for Servers(used as software).
Tripwire for Host Based Intrusion Detection System(HIDS)
and also for Network Based Intrusion Detection System
(NIDS).
Tripwire for Network Devices like Routers, Switches etc.

19. ADVANTAGES…
Increase security: - Immediately detects and pinpoints
unauthorized change.
Instill Accountability :- Tripwire identifies and reports the
sources of change.
Gain Visibility:- Tripwire software provides a centralized
view of changes across the enterprise infrastructure and
supports multiple devices from multiple vendors

20. ADVANTAGES..
Ensure Availability:- Tripwire software reduces
troubleshooting time, enabling rapid discovery and
recovery. Enables the fastest possible restoration back to
a desired, good state

21. LIMITATIONS..
Ineffective when applied to frequently changing files.
Higher learning curve to install, edit, and maintain the
software.
Cost Effective

22. CONCLUSION..
Although having some limitations ;Tripwire is a reliable
intrusion detection system. It is a software that can be
installed in any type of system where damaged files are to
be detected.
The main attractive feature of this system is that the
software generates a report about which file have been
violated, when the file have been violated and also what in
the files have been changed. To some extend it also helps
to detect who made the changes. New versions of Tripwire
is under research and development.

23. REFERENCES…
Tripwire
http://www.tripwire.com
Gene H. Kim and Eugene H. Spafford, 1994.
Experiences with Tripwire: Using Integrity checkers for
Intrusion Detection, Purdue Technical Report CSD-TR-
93-071, Coast Laboratory, Department of Computer
Sciences, Purdue University.

25. THANK YOU………