Skip to main content

What are Intrusion Detection Systems?

 


Intrusion Detection System (IDS) are a necessary part of any strategy for enterprise security. What are Intrusion Detection systems? CERIAS, The Center for Education and Research in Information Assurance and Security, defines it this way:


"The purpose of an intrusion detection system (or IDS) is to detect unauthorized access or misuse of a computer system. Intrusion detection systems are kind of like burglar alarms for computers. They sound alarms and sometimes even take corrective action when an intruder or abuser is detected. Many different intrusion detection systems have been developed but the detection schemes generally fall into one of two categories, anomaly detection or misuse detection. Anomaly detectors look for behavior that deviates from normal system use. Misuse detectors look for behavior that matches a known attack scenario. A great deal of time and effort has been invested in intrusion detection, and this list provides links to many sites that discuss some of these efforts"(http://www.cerias.purdue.edu/about/history/coast_resources/intrusion_detection/)


There is a sub-category of intrusion detection systems called network intrusion detection systems (NIDS). These systems monitors packets on the network wire and looks for suspicious activity. Network intrusion detection systems can monitor many computers at a time over a network, while other intrusion detection systems may monitor only one.


Who is breaking into your system?


One common misconception of software hackers is that it is usually people outside your network who break into your systems and cause mayhem. The reality, especially for corporate workers, is that insiders can and usually do cause the majority of security breaches. Insiders often impersonate people with more privileges then themselves to gain access to sensitive information.


How do intruders break into your system?


The simplest and easiest way to break in is to let someone have physical access to a system. Despite the best of efforts, it is often impossible to stop someone once they have physical access to a machine. Also, if someone has an account on a system already, at a low permission level, another way to break in is to use tricks of the trade to be granted higher-level privileges through holes in your system. Finally, there are many ways to gain access to systems even if one is working remotely. Remote intrusion techniques have become harder and more complex to fight.



How does one stop intrusions?



There are several Freeware/shareware Intrusion Detection Systems as well as commercial intrusion detection systems.


Open Source Intrusion Detection Systems


Below are a few of the open source intrusion detection systems:


AIDE (http://sourceforge.net/projects/aide) Self-described as "AIDE (Advanced Intrusion Detection Environment) is a free replacement for Tripwire. It does the same things as the semi-free Tripwire and more. There are other free replacements available so why build a new one? All the other replacements do not achieve the level of Tripwire. And I wanted a program that would exceed the limitations of Tripwire."


File System Saint (http://sourceforge.net/projects/fss) - Self-described as, "File System Saint is a lightweight host-based intrusion detection system with primary focus on speed and ease of use."



Snort (www.snort.org) Self-described as "Snort® is an open source network intrusion prevention and detection system utilizing a rule-driven language, which combines the benefits of signature, protocol and anomaly based inspection methods. With millions of downloads to date, Snort is the most widely deployed intrusion detection and prevention technology worldwide and has become the de facto standard for the industry."


Commercial Intrusion Detection Systems


If you are looking for Commercial Intrusion Detection Systems, here are a few of these as well:


Tripwire

http://www.tripwire.com


Touch Technology Inc (POLYCENTER Security Intrusion Detector)

Http://www.ttinet.com


Internet Security Systems (Real Secure Server Sensor)

http://www.iss.net



eEye Digital Security (SecureIIS Web Server Protection)

http://www.eeye.com

Comments

Post a Comment

Popular posts from this blog

Website Security Rules of the Road

  In 2004, online consumer spending was at a record $65.1 billion. More and more people are attracted to the ease of online shopping and are spending higher amounts. Unfortunately, the chances of becoming a victim of Internet fraud are also increasing. The Internet National Fraud Center Watch reported that the average loss to fraud victims for just the first six months of 2005 was $2,579. This is compared to the $895 average for all of 2004. Complaints relating to general merchandise purchases (goods never received or misrepresented) accounted for 30% of Internet fraud complaints, and auction purchases (goods never received or misrepresented) topped the list at 44%. While many e-commerce Websites are reputable and have taken the necessary safety precautions to protect you, it never hurts to always proceed cautiously. If you are making an online purchase consider these easy steps: Use only one credit card, preferably with a low credit limit, when making online purc...
Post a Comment
Read more

Parental Peace of Mind

  The advent of the Internet, in some respects, made the job of parenting a little harder. We want our children to experience the vast wealth of knowledge available on the Internet and communicate with their friends online (frees up the telephone). Unfortunately, it also potential exposes our children to inappropriate material, obscene pop-up ads, and even sexual predators. In fact, research indicates that 1 in 5 children aged 10 to 17 have received a sexual solicitation over the Internet. This is definitely not something any parent wants to hear, but is forced to face. We need a little assurance that when our children access the web, they can do so safely. Internet filters are crucial to protect your children. One tool that can assist us in this goal is Internet Parental Control software. One of the top names in parental control software is ContentWatch, and if the Big Mouse himself recommends this product, then it has to be good. If Disney feels good enough to install th...
Post a Comment
Read more

What the Heck are Botnets?

  "A botnet is comparable to compulsory military service for windows boxes" - Stromberg (http://project.honeynet.org/papers/bots/) Botnets are networks of computers that hackers have infected and grouped together under their control to propagate viruses, send illegal spam, and carry out attacks that cause web sites to crash. What makes botnets exceedingly bad is the difficulty in tracing them back to their creators as well as the ever-increasing use of them in extortion schemes. How are they used in extortion schemes? Imagine someone sending you messages to either pay up or see your web site crash. This scenario is starting to replay itself over and over again. Botnets can consist of thousands of compromised machines. With such a large network, botnets can use Distributed denial-of-service (DDoS) as a method to cause mayhem and chaos. For example a small botnet with only 500 bots can bring corporate web sites to there knees by using the combined bandwidth of all t...
Post a Comment
Read more