Home > Security

Computerworld - Network intrusion-detection systems (IDS) are becoming a standard information security safeguard. Together with firewalls and vulnerability scanners, intrusion detection is one of the pillars of modern computer security.
In this article, I'll examine five mistakes that companies commonly make while planning and deploying their IDS systems. In addition to the obvious mistake of not evaluating the IDS technology at all, these mistakes will decrease or eliminate the added value that companies would derive from running an IDS.
While the IDS field is still in motion, several classes of products have formed. Most IDS products loosely fall into network IDS. Network IDS monitors the entire subnet for network attacks against machines connected to it, using a database of attack signatures or a set of algorithms to detect anomalies in network traffic. Alerts and attacks analysis would be handled by a different machine that collects the information from several sensors.

	Anton Chuvakin, Ph.D., GCIA, is a senior security analyst at a major information security company. His areas of expertise include intrusion detection, Unix security, forensics and honeypots. In his spare time, he maintains his security portal. www.info-secure.org.

Signature-based network IDS is the most widely deployed type of intrusion detection. Simplified management and the availability of inexpensive network IDS appliances, together with the dominance of network-based attacks, are believed to be the primary reasons for that.
Now let's take a look at the top five mistakes and what can be done to avoid them.
1. Using an IDS without giving it an ability to see all the network traffic. In other words, deploying the network IDS without sufficient infrastructure planning. Network IDS should be deployed on the network choke point (such as right inside or outside the firewall), on the appropriate internal network segment or in the DMZ. For the shared Ethernet-based networks, IDS will see all the network traffic within the Ethernet collision domain or subnet and also destined to and from the subnet, but no more. For the switched networks, there are several IDS deployment scenarios that use special switch capabilities such as port mirroring or spanning.
2. The IDS is deployed appropriately, but nobody is looking at the alerts it generates. It's well known that IDS is a "detection" technology, and it never promised to be a "shoot-and-forget" means of thwarting attacks. While in some cases, the organization might get away with dropping the firewall in place and configuring the policy, such a deployment scenario never works for intrusion detection. If IDS alerts are reviewed only after a successful compromise, the