Is Network Intrusion Detection Software Being Used Correctly?
Contact:http://www.packetnexus.com Viewpoint Is Network Intrusion Detection Software Being Used Correctly? By Marcus J. Ranum ———————————————————————— ——– It’s early Sunday morning and the network manager is sleeping at home. A stealth hacker program is unfolding itself behind the company’s firewall, preparing to open a path into the network. Immediately, the network manager’s pager is activated: “Attack in progress!” Within minutes, the network manager has logged in over a secure link, accessed the company’s intrusion detection system, and obtained complete details of the origin and nature of the attack. After a few quick phone calls, the penetration is blocked, and law enforcement agents will soon be knocking on the hacker’s front door. Sounds great, doesn’t it? Unfortunately, the reality of network intrusion detection and response doesn’t even come close to this hypothetical scenario. For one thing, most intrusion detection system
