Security

Ask something
Discussion Locked

Security Solutions: Intrusion detection

0 helpful
9 replies

by discussion

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

In this week's Security Solutions TechMail column, Mike Mullins introduces a new type of intrusion detection and prevention technology. Have you deployed intrusion detection sensors on your network? Are your sensors primarily meant to catch externalor internal hackers?

----
If you'd like to learn more about the Security Solutions TechMail, point to this link and click Security Solutions to see a sample. If you're interested, you can also sign up:
https://www.techrepublic.com/techmails.jhtml?repID=r001

9 replies

by w

Security Solutions: Intrusion detection
In this week's Security Solutions TechMail column, Mike Mullins introduces a new type of intrusion detection and prevention technology. Have you deployed intrusion detection sensors on your network? Are yoursensors primarily meant to catch external or internal hackers?

----
If you'd like to learn more about the Security Solutions TechMail, point to this link and click Security Solutions to see a sample. If you're interested, you can also sign up:
https://www.techrepublic.com/techmails.jhtml?repID=r001

From: discussion@techrepublic.com Date: 5/15/03

by chip

I am disappointed that the author only mentioned Okena. There are a number of vendors who have been in the behavior-based Intrusion Prevention marketplace for several years like Okena has. (Finjan, Entercept, Harris, to name a few) Was this articlesponsored by Cisco?

by mike mullins

This is the author, and no the article wasn't sponsored by cisco. The newsletter was about how Intrusion Detection devices have evolved to intrusion prevention. I used stormwatch as an example because it is one of the products we use (we use severaldifferent types from different vendors).

I'm not really hung up on product name. What I do care about, is functionality and the value it adds. As I mentioned in the last paragraph, there are several excellent vendors to choose from and perhaps it's time to re-evaluate this type of technology for use.

Thanks for your interest. Keep the questions coming.

Mike

by japhilipson

Nobody really asked me but...

For IIS, you could do the same thing for just about free. Use a free tool from MS, the IIS Lockdown Wizard to secure the base IIS install. Use UrlScan, which is part of the IIS Lockdown Wizard, to filter out illegal traffic such as cmd.exe requests.

Next, centralize logging by using EventSave from http://www.heysoft.de/ or a Syslog server. You can get either for free.

You can use Event Report from Heysoft to report any Event Log issues. Its not free - about $100 per NT Domain - not per server.

Make use of the things you should already have. Firewalls - make sure yours is stateful and logs activity. There's a million other criteria that might be important depending on your specific situation. Consider a Linux distro on old PC hardware if you want to save money. http://www.IPCop.org offers a good free firewall based on the 2.4 Linux kernel with support for IPTables (stateful).

IDS - use Snort from http:\\www.snort.org. It's free and will even run on Win32 platforms. If you use IPCop from above, Snort is built right in.

SysAdmins, please don't rush out and buy the latest and greatest security products before investigating the world of free tools that are available.

Explain how you will be building valuable knowledge about the network and its security in the process rather than depending on some magically security genie to make everything better.

By all means get a quote for the expensive software and show your boss how much $$$ you can save by doing it with freely available and highly (and publicly) tested software. I smell a bonus wafting your way.

Jim

by jblake

I've been in it for only 1 year and have found myself in a successful startup IT support co. but EVERYTHING about this program seems over my head.
I want to offer this kind of option to my clients but I can't unless I can offer it to them thru an outside sub-contractorbut, and that would raise new security problems. Are there some BASIC level intruder detection programs on the market that would provide enough protection to small business that I could justify their deployment to the company owners, and not be offering something over my head?
Thanks

This discussion is closed to new replies.