Keeping the Dream Alive?
While some IDSs do hint at what an alert means, and a few even make suggestions about how to check a system and see if the attack has been successful, that’s far from the ⌠dream■ IDS envisioned earlier in this column. But let’s stay with that dream for a minute and imagine what a Manhattan Project approach ($2 billion in 1945 dollars) could do to implement the ideal IDS. The ideal IDS would be a hybrid, with both host-based and network-based sensors. The host-based module would also permit operating system software and upgrading on monitored machines, and the ability to adjust file permissions/ownerships, registry keys/configuration, and operating system tuning parameters-all without rebooting. And this host-based IDS would consume few CPU cycles, so installing it even on heavily loaded servers wouldn’t be a problem. The NIDS sensors would be installed in switches (two vendors have already achieved this) so that all traffic could easily be monitored. The sensors wouldn’t just be passiv
