After the Nachi worm hit last year, Joe Granneman, manager of networks and PC services at Rockford Health System, knew it was time for a change. “It only took three infected machines to bring down our dual processor firewall,” he marvels. “Without our Internet connection we couldn’t process claims or do much of anything.”

Earlier that year a DoS attack disabled a VPN concentrator. A network IDS (intrusion detection system) detected the attack and sent an alert, but not before frustrated users -- whom Granneman calls his most reliable SNMP alert -- barraged him with phone calls. Monitoring IDS alerts was also taking up more and more of Granneman’s time. “I came in early before my meetings every day to check the IDS logs, spent my lunchtime inspecting IDS logs on my notebook from the cafeteria, and dialed in constantly over Christmas because of the terrorist threat. Those logs became my bible.”

By Leon Erlanger at Info World.

[ Read more ]

Related items

• Software: Snort
• Software: TCPDUMP
• Review: Intrusion Detection with SNORT: Advanced IDS Techniques Using SNORT, Apache, MySQL, PHP, and ACID (19 June 2003)
• Review: Network Intrusion Detection 3/e (24 January 2003)
• Article: Securing Linux (16 May 2002)
• Article: Tips on basic Linux server security (14 May 2002)