What to ask when evaluating intrusion-prevention systems
Computerworld - An intrusion-prevention system (IPS) is part of an overall security strategy to protect your network from attack. The IPS literally prevents an attack by blocking bad stuff, such as viruses or malformed packets, from getting into the company network.
Sitting directly behind the firewall, the IPS examines in detail all the traffic passed by the firewall, reassembles it and "scrubs" it where necessary (removing any attempts at obfuscation or evasion) and compares it to a database of known attack patterns.
This brings us to the first and biggest difficulty faced by anyone when evaluating IPS products -- how effective is the detection mechanism? Asking vendors these questions can help you decide which IPS is right for your company.
What is the coverage like?
The total number of signatures is a well-used marketing trick, but quantity isn't always an indicator of quality of coverage. Sometimes, one well-written signature can detect a large number of exploit variations. However, some vendors with hardware-accelerated products and horsepower to spare will often throw signatures at the problem, with one signature for each variation -- not always the best approach.
Does it rely purely on pattern matching, or can it perform protocol decodes?
A protocol decoder is often the best (and sometimes the only way) to detect multiple exploits for complex vulnerabilities. However, don't believe all the hype about protocol decoders. It's not always necessary to have one, and sometimes, a few well-written signatures can work just as well. (Bear in mind that even a full protocol decoder needs to use pattern or variable matching in order to determine if the protocol-specific content it has extracted is malicious).
How susceptible is it to common evasion techniques?
There are a number of readily available evasion tools out there (fragroute, Whisker, etc.) and at the very least, any IPS should be able to handle them easily. Watch out for any product that comes with IP fragment reassembly or TCP segment reassembly disabled by default. This is often done purely for performance reasons or because the reassembly is suspect. These anti-evasion techniques should always be enabled.
How likely is it that variants of the same exploit or new exploits of the same vulnerability will be detected without a signature update?
What we are looking for here is a product where the signatures are written to detect the underlying vulnerability rather than a specific exploit. This means that when a new variation of an old exploit is produced, the IPS device stands a good chance of being able to block it without a signature update. You may only get
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Building a Bridge to the Next Generation Data Center Selecting a widely adopted operating system is a foundational component of a standardization strategy.
- OpenStack and Red Hat: IDC White paper Most OpenStack deployments are by public cloud providers that are early adopters of technology and use OpenStack in a do-it-yourself deployment and support...
- Live Webcast Best Practices for the Hyperconverged Enterprise Network To the Age of Constant Connectivity and Information overload
- Live Webcast Unmasking the Differences between Consumer and Enterprise File Sync & Share The consumerization of IT combined with the rapid pace of the modern mobile workplace is forcing enterprise IT teams to evaluate file sync...
- Live Webcast Government Agency Webifies Outdated COBOL Applications Let this CTO tell you how his agency converted 1980s-era green screens into an e-filing portal for the 100,000 cases handled each year...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,...
- Getting Ready for BlackBerry Enterprise Service 10.2 Find out how BlackBerry® Enterprise Service 10 helps organizations address the full spectrum of EMM challenges, while balancing the needs of both the... All Applications White Papers | Webcasts