What to ask when evaluating intrusion-prevention systems
Computerworld - An intrusion-prevention system (IPS) is part of an overall security strategy to protect your network from attack. The IPS literally prevents an attack by blocking bad stuff, such as viruses or malformed packets, from getting into the company network.
Sitting directly behind the firewall, the IPS examines in detail all the traffic passed by the firewall, reassembles it and "scrubs" it where necessary (removing any attempts at obfuscation or evasion) and compares it to a database of known attack patterns.
This brings us to the first and biggest difficulty faced by anyone when evaluating IPS products -- how effective is the detection mechanism? Asking vendors these questions can help you decide which IPS is right for your company.
What is the coverage like?
The total number of signatures is a well-used marketing trick, but quantity isn't always an indicator of quality of coverage. Sometimes, one well-written signature can detect a large number of exploit variations. However, some vendors with hardware-accelerated products and horsepower to spare will often throw signatures at the problem, with one signature for each variation -- not always the best approach.
Does it rely purely on pattern matching, or can it perform protocol decodes?
A protocol decoder is often the best (and sometimes the only way) to detect multiple exploits for complex vulnerabilities. However, don't believe all the hype about protocol decoders. It's not always necessary to have one, and sometimes, a few well-written signatures can work just as well. (Bear in mind that even a full protocol decoder needs to use pattern or variable matching in order to determine if the protocol-specific content it has extracted is malicious).
How susceptible is it to common evasion techniques?
There are a number of readily available evasion tools out there (fragroute, Whisker, etc.) and at the very least, any IPS should be able to handle them easily. Watch out for any product that comes with IP fragment reassembly or TCP segment reassembly disabled by default. This is often done purely for performance reasons or because the reassembly is suspect. These anti-evasion techniques should always be enabled.
How likely is it that variants of the same exploit or new exploits of the same vulnerability will be detected without a signature update?
What we are looking for here is a product where the signatures are written to detect the underlying vulnerability rather than a specific exploit. This means that when a new variation of an old exploit is produced, the IPS device stands a good chance of being able to block it without a signature update. You may only get
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Enhancing Application Protection and Recovery with a Modern Approach to Snapshot Management This CommVault Business Value and Technology White Paper explains how Simpana IntelliSnap® Recovery Manager can make your application recovery fast and reliable.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts