5 IDS mistakes that companies make

By Anton Chuvakin

February 26, 2003 12:00 PM ET

Recommended

(6)

Digg

Twitter

Share/Email

Computerworld - Network intrusion-detection systems (IDS) are becoming a standard information security safeguard. Together with firewalls and vulnerability scanners, intrusion detection is one of the pillars of modern computer security.
In this article, I'll examine five mistakes that companies commonly make while planning and deploying their IDS systems. In addition to the obvious mistake of not evaluating the IDS technology at all, these mistakes will decrease or eliminate the added value that companies would derive from running an IDS.
While the IDS field is still in motion, several classes of products have formed. Most IDS products loosely fall into network IDS. Network IDS monitors the entire subnet for network attacks against machines connected to it, using a database of attack signatures or a set of algorithms to detect anomalies in network traffic. Alerts and attacks analysis would be handled by a different machine that collects the information from several sensors.


	Anton Chuvakin, Ph.D., GCIA, is a senior security analyst at a major information security company. His areas of expertise include intrusion detection, Unix security, forensics and honeypots. In his spare time, he maintains his security portal. www.info-secure.org.

Signature-based network IDS is the most widely deployed type of intrusion detection. Simplified management and the availability of inexpensive network IDS appliances, together with the dominance of network-based attacks, are believed to be the primary reasons for that.
Now let's take a look at the top five mistakes and what can be done to avoid them.
1. Using an IDS without giving it an ability to see all the network traffic. In other words, deploying the network IDS without sufficient infrastructure planning. Network IDS should be deployed on the network choke point (such as right inside or outside the firewall), on the appropriate internal network segment or in the DMZ. For the shared Ethernet-based networks, IDS will see all the network traffic within the Ethernet collision domain or subnet and also destined to and from the subnet, but no more. For the switched networks, there are several IDS deployment scenarios that use special switch capabilities such as port mirroring or spanning.
2. The IDS is deployed appropriately, but nobody is looking at the alerts it generates. It's well known that IDS is a "detection" technology, and it never promised to be a "shoot-and-forget" means of thwarting attacks. While in some cases, the organization might get away with dropping the firewall in place and configuring the policy, such a deployment scenario never works for intrusion detection. If IDS alerts are reviewed only after a successful compromise, the

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Jump to comments

Security

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Share our Strength
Download Now

Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!

Top 10 Things to Know about Data Protection
Download Now

Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!

Top 10 Actions a CIO Can Take to Prepare for a Hurricane
Download Now

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Ponemon Study: The Business Risk of a Lost Laptop
Download Now

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Airport Insecurity: The Case of Lost Laptops
Download Now

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

All White Papers | All Webcasts