Smokey
September 13th, 2003, 06:08 PM
Intrusion-detection systems (IDS) are the subject of industry controversy after a Gartner Inc. report recommended that companies abandon these systems in favor of firewalls.
If organizations want to stop the constantly evolving types of attacks, they must continue to rely on multitiered defense strategies consisting of network security components layered at the perimeter and internal network machines and devices. Such network security components not only include network- and host-based IDSs, but antivirus software, patch management, firewalls, scanners and intrusion-prevention systems (IPS).
Admittedly, this approach has challenges: Systems are not adequately integrated, do not identify and share vulnerability information, and rely on numerous rules to identify new threats that in turn produce volumes of alerts – all of which are overwhelming the system and its operators.
The main culprits are IDS/IPS technologies that are generally able to spot attacks by common vulnerabilities and exposures, or CVE, identification that they see on a network. However, these same technologies generally don't have the ability to determine if the targeted machine is actually vulnerable to the attack.
For instance, if malicious code has been written as a Windows-based attack targeting a Windows vulnerability, is the destination IP actually running Windows or a Unix variant? And, if it is Windows, is it vulnerable to the attack or has it already been patched? An IDS doesn't have the intelligence to answer these questions and generates incident alerts indiscriminately. In addition, even if the targeted machine is vulnerable, an IDS doesn't have the capability to remediate it.
Furthermore, best practice and government compliance directives now require higher standards of network security and integrity to protect consumer privacy, and they must be documented with change-tracking and audit-trail reports.
Companies are finding it increasingly difficult and expensive, especially in an environment with rising security standards and policy compliance, to mitigate new threats and manage numerous systems. But relying solely on firewalls isn't the answer. Vendors must create ways to integrate systems, share information intelligently to better defend against blended threats, reduce management and cost requirements, and automate IDS/IPS configuration and tuning along with vulnerability identification and remediation functionalities.
A first and important step in this process is to improve IDS/IPS to minimize false positives that threaten productivity and result in rising costs. This can be accomplished by integrating client configuration data from client agents or a scanner, which will provide the system with data so it can determine if the targeted machines are vulnerable to the attacks, thereby reducing false positives.
The following functions are achieved through this integration:
- Cross-referencing of the threat's identifier with the target's configuration: The CVE ID or other identifier and the destination IP address are fed into the logic engine where it cross-references the threat with the machine's software and security configuration profiles. These profiles consist of the targeted machine's OS and applications by file versions, patches by hashes and security policy configurations.
- Elimination of nearly all false positives and negatives: The back end accurately determines in real time if the targeted machine is susceptible to the attack. If the machine isn't susceptible, it is filtered and reported back as an event and not an incident. No further data or alert is generated, and a management response isn't required.
- Remediation of the vulnerability remotely: When a machine is identified as vulnerable to an attack or incident, a remediation function is provided to the administrator to remotely deploy the appropriate update or configuration change to the machine or device, install it and document it with change-tracking and audit-trail reports.
There is no doubt that IDSs must continue to evolve to combat the ever-changing nature of malicious security attacks. The vendor community is responding to the drawbacks of traditional IDS technology to create next-generation systems that will serve as critical components to the multitiered approach to securing and managing networks. Antivulnerability technology is already proving that it can improve security and increase productivity while reducing costs.
Source: ComputerWorld
If organizations want to stop the constantly evolving types of attacks, they must continue to rely on multitiered defense strategies consisting of network security components layered at the perimeter and internal network machines and devices. Such network security components not only include network- and host-based IDSs, but antivirus software, patch management, firewalls, scanners and intrusion-prevention systems (IPS).
Admittedly, this approach has challenges: Systems are not adequately integrated, do not identify and share vulnerability information, and rely on numerous rules to identify new threats that in turn produce volumes of alerts – all of which are overwhelming the system and its operators.
The main culprits are IDS/IPS technologies that are generally able to spot attacks by common vulnerabilities and exposures, or CVE, identification that they see on a network. However, these same technologies generally don't have the ability to determine if the targeted machine is actually vulnerable to the attack.
For instance, if malicious code has been written as a Windows-based attack targeting a Windows vulnerability, is the destination IP actually running Windows or a Unix variant? And, if it is Windows, is it vulnerable to the attack or has it already been patched? An IDS doesn't have the intelligence to answer these questions and generates incident alerts indiscriminately. In addition, even if the targeted machine is vulnerable, an IDS doesn't have the capability to remediate it.
Furthermore, best practice and government compliance directives now require higher standards of network security and integrity to protect consumer privacy, and they must be documented with change-tracking and audit-trail reports.
Companies are finding it increasingly difficult and expensive, especially in an environment with rising security standards and policy compliance, to mitigate new threats and manage numerous systems. But relying solely on firewalls isn't the answer. Vendors must create ways to integrate systems, share information intelligently to better defend against blended threats, reduce management and cost requirements, and automate IDS/IPS configuration and tuning along with vulnerability identification and remediation functionalities.
A first and important step in this process is to improve IDS/IPS to minimize false positives that threaten productivity and result in rising costs. This can be accomplished by integrating client configuration data from client agents or a scanner, which will provide the system with data so it can determine if the targeted machines are vulnerable to the attacks, thereby reducing false positives.
The following functions are achieved through this integration:
- Cross-referencing of the threat's identifier with the target's configuration: The CVE ID or other identifier and the destination IP address are fed into the logic engine where it cross-references the threat with the machine's software and security configuration profiles. These profiles consist of the targeted machine's OS and applications by file versions, patches by hashes and security policy configurations.
- Elimination of nearly all false positives and negatives: The back end accurately determines in real time if the targeted machine is susceptible to the attack. If the machine isn't susceptible, it is filtered and reported back as an event and not an incident. No further data or alert is generated, and a management response isn't required.
- Remediation of the vulnerability remotely: When a machine is identified as vulnerable to an attack or incident, a remediation function is provided to the administrator to remotely deploy the appropriate update or configuration change to the machine or device, install it and document it with change-tracking and audit-trail reports.
There is no doubt that IDSs must continue to evolve to combat the ever-changing nature of malicious security attacks. The vendor community is responding to the drawbacks of traditional IDS technology to create next-generation systems that will serve as critical components to the multitiered approach to securing and managing networks. Antivulnerability technology is already proving that it can improve security and increase productivity while reducing costs.
Source: ComputerWorld