 just detectingattacks was a huge undertaking, but as that discipline matured, it was clear that we needed to go beyond detection and prevent attacks in real time. The ISS RealSecure product had some features such as the rs-kill feature that would “kill” or stop traffic based on specific patterns. In 1998, SNORT, an open source libpcap-based packet sniffer and logger, which can be used as a lightweight NIDS and was developed by Marty Roesch, was made available and allowed many people to use and become familiar with intrusion detection. In 1999, Okena Systems created one of the first IPSs called StormWatch based on their INCORE architecture (Intercept Correlate Rules Engine), which intercepts file and network actions and correlates rules and application states to make real-time decisions based on application behavior. Okena was acquired by Cisco Systems in 2003. The development of intrusion prevention has just begun.
Libpcap is a system-independent interface for user-level packet capture, and it provides a portable framework for low-level network monitoring. Applications for libpcap include network statistics collection, security monitoring, network debugging, and so on.
IDSs and IPSs are important for many organizations, from small offices to large multinational corporations. IDSs and IPSs offer many benefits:
These are all very good reasons to implement these technologies, but there are three main reasons that justify the need more than the others:
IDSs and IPSs perform analyses, and it is important to understand the analysis process: what analysis does, what types of analysis are available, and what the advantages and disadvantages of different analysis schemes are.
Analysis, in the context of intrusion detection and prevention, is the organization of the constituent parts of data and their interrelationships to identify any anomalous activity of interest. Real-time analysis is analysis done on the fly as the data travels the path to the network or host. This is a bit of a misnomer, however, as analysis can only be performed after the fact in near-real-time.
Clinton Administration’s Policy on Critical Infrastructure Protection
It is important to be familiar with the following legislative issues: The Clinton Administration’s Policy on Critical Infrastructure Protection: Presidential Decision Directive 63, May 22, 1998, was designed to set forth a policy for protecting critical infrastructure in the United States.
The Public Law 104-191 Health Insurance Portability and Accountability Act of 1996 helps improve portability and continuity of health insurance coverage in the group and individual markets. Among other things, it is designed to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, and to simplify the administration of health insurance.
The Financial Modernization Act of 1999, also known as the Gramm-Leach-Bliley Act or GLBA, includes provisions to protect consumers’ personal financial information held by financial institutions.
The fundamental goal of intrusion-detection and intrusion-prevention analysis is to improve an information system’s security. This goal can be further broken down:
Figure 1-4 illustrates the general idea of analysis. An IDS or IPS system will help identify-those anomalous activities that fall outside the realm of what is considered normal baseline activity for the environment. This is considered the general goal, but there is still much debate over how much anomalous data falls outside the realm of normal baseline activity. Some believe the gap is large, while others see very little difference between the two.
Figure 1-4: The relationship between baseline and anomalous network activity
There are many possible data-analysis schemes for an analysis engine, and in order to understand them, the intrusion-analysis process can be broken down into four phases:
Preprocessing is a key function once data are collected from an IDS or IPS sensor. In this step, the data ar