Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

5 IDS mistakes that companies make

February 26, 2003 12:00 PM ET

Computerworld - Network intrusion-detection systems (IDS) are becoming a standard information security safeguard. Together with firewalls and vulnerability scanners, intrusion detection is one of the pillars of modern computer security.
In this article, I'll examine five mistakes that companies commonly make while planning and deploying their IDS systems. In addition to the obvious mistake of not evaluating the IDS technology at all, these mistakes will decrease or eliminate the added value that companies would derive from running an IDS.
While the IDS field is still in motion, several classes of products have formed. Most IDS products loosely fall into network IDS. Network IDS monitors the entire subnet for network attacks against machines connected to it, using a database of attack signatures or a set of algorithms to detect anomalies in network traffic. Alerts and attacks analysis would be handled by a different machine that collects the information from several sensors.

Anton Chuvakin
Signature-based network IDS is the most widely deployed type of intrusion detection. Simplified management and the availability of inexpensive network IDS appliances, together with the dominance of network-based attacks, are believed to be the primary reasons for that.
Now let's take a look at the top five mistakes and what can be done to avoid them.
1. Using an IDS without giving it an ability to see all the network traffic. In other words, deploying the network IDS without sufficient infrastructure planning. Network IDS should be deployed on the network choke point (such as right inside or outside the firewall), on the appropriate internal network segment or in the DMZ. For the shared Ethernet-based networks, IDS will see all the network traffic within the Ethernet collision domain or subnet and also destined to and from the subnet, but no more. For the switched networks, there are several IDS deployment scenarios that use special switch capabilities such as port mirroring or spanning.
2. The IDS is deployed appropriately, but nobody is looking at the alerts it generates. It's well known that IDS is a "detection" technology, and it never promised to be a "shoot-and-forget" means of thwarting attacks. While in some cases, the organization might get away with dropping the firewall in place and configuring the policy, such a deployment scenario never works for intrusion detection. If IDS alerts are reviewed only after a successful compromise, the


Jump to comments

Security

Additional Resources

Microsoft
Here are some of the key reasons why you would want to run Unified Access Gateway with DirectAccess.
Microsoft
Review how one energy firm tightened protection and simplified IT work using business-ready security solutions.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Death to PST Files
Download Now  

Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".

eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!  

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...


IT Jobs