On June 11, 2003 the Gartner Group, a research and advisory firm, reported that intrusion-detection systems are a market failure, have failed to provide value relative to their costs, and will be obsolete by 2005. While this brought Gartner a lot of attention, the fact is that intrusion detection and prevention is here to stay, not as a silver bullet, but as part of a strong defense strategy. Many industry research groups and the thousands of companies that have deployed or are planning to deploy intrusion-detection and intrusion-prevention systems are a testament to the usefulness of this technology.
Intrusion detection has had its problems, such as false positives, operational issues in high-speed environments, and the difficulty of detecting unknown threats. In addition, intrusion prevention is still in its infancy. Most of the problems with intrusion detection are caused by improper implementation and misunderstanding of what the technology can and cannot do.
This book focuses on what intrusion detection and prevention can and cannot do. We will examine ways to get the most from this technology, and look at how it can be managed to benefit your organization.
This chapter will introduce intrusion-detection system (IDS) and intrusion-prevention system (IPS) technologies, explaining what they are, as well as pointing out their differences. We will examine why these systems may be important to your organization, and look at the general types of analysis processes used by both IDSs and IPSs. Finally, we will review the pros and cons of both IDS and IPS technologies and clear up some of the myths about them.
Any dictionary will provide a definition of intrusion, but its meaning in the computer security context has been debated. Many people consider intrusions to include unsuccessful attacks, while others see a distinct difference between attacks and intrusions. We’ll work with the definition that an intrusion is an active sequence of related events that deliberately try to cause harm, such as rendering a system unusable, accessing unauthorized information, or manipulating such information. This definition refers to both successful and unsuccessful attempts.
Security professionals may want to have IDS systems record information about both successful and unsuccessful attempts so that security professionals will have a more comprehensive understanding of the events on their networks. One way this can be done is by placing devices that examine network traffic, called sensors, both in front of the firewall (the unprotected area) and behind the firewall (the protected area) and comparing the information recorded by the two.
An intrusion-detection system (IDS) can be defined as the tools, methods, and resources to help identify, assess, and report unauthorized or unapproved network activity. The intrusion detection part of the name is a bit of a misnomer, as an IDS does not actually detect intrusions—it detects activity in traffic that may or may not be an intrusion. Intrusion detection is typically one part of an overall protection system that is installed around a system or device—it is not a stand-alone protection measure.
You can loosely compare firewalls to locked doors, intrusion detection to alarm systems, and intrusion prevention to guard dogs. Let’s say that you have a warehouse full of secret documents that you want to protect with a fence around the perimeter, an alarm system, locked doors, and security cameras. The locked doors will stop unauthorized individuals from entering the warehouse. By themselves, they do nothing to alert you of an intrusion, but they deter unauthorized access. The alarm system will warn you in case an intruder tries to get into the warehouse. By itself, it does nothing to prevent an intrusion, but it alerts you to the potential of an intrusion. The guard dog, in some instances, is able to prevent an intrusion by taking measures to thwart the attack from happening by biting intruders before they can enter the protected perimeter, thereby stopping the intrusion.
As you can see, the door locks, 