When discussing network security, many IT professionals associate security technologies with network access control mechanisms such as firewalls, proxy servers and router access control lists. They’re designed to restrict the flow of traffic into and out of corporate networks to reduce the risk of compromise by malicious individuals on the Internet. However, even the best filtering devices do very little to protect a network if Internet-accessible devices are vulnerable to attacks. Malicious individuals can use open communications channels (such as HTTP, e-mail and DNS) to compromise a system on a network remotely, and use that compromised system as a launching pad to attack and compromise other “trusted” systems on the network.

Many of today’s IT infrastructures have become so large, complex and geographically dispersed that IT managers may not learn about the defacement of their Web page in a foreign data center for several days. In the case of one organization, an IT manager learned of a system compromise after a user notified the corporate public relations office. Public relations notified a top corporate officer, who relayed the information to the manager. This isn’t how most of us would like to learn about such occurrences.

The good news is that intrusion detection systems (IDS) can fill such security gaps by providing a way to monitor networks for the presence of active exploits and misuse. This article provides a brief overview of network-based intrusion detection that can help you evaluate your current security infrastructure.

[ Read more ]

Related items

• Software: Snort
• Software: Samhain
• Software: MaraDNS
• Software: Aide
• Software: IDSA
• Article: Structural versus Operational Intrusion Detection (8 April 2002)
• Article: Interpreting Network Traffic: A Network Intrusion Detector's Look At Suspicious Events (4 April 2002)
• Article: Network Intrusion Detection of Third Party Effects (4 April 2002)
• Article: Information Warfare: When Intrusion Detection Isn't Enough (1 April 2002)
• Article: Traditional Intrusion Detection Model Outdated and Distracting (1 April 2002)