Because of regulatory and compliance requirement from Act such as Sarbanes-Oxley, PCI, GLBA, FISMA, HIPAA, companies need to deploy Intrusion Detection and Prevention System, i.e., IDS/IPS or IDPS, and demonstrate to the Federal auditors that company data security is monitored and breaches are detected and acted. The importance of IDS and IPS has been highlighted after some well-known incidents, such as Wal-Mart 2005-2006 Intrusion and recently Comcast DNS highjacking, DDOS to Google, Twitter and Facebook.
Deployment and operation of IDPS is different from other enterprise security product such as firewall, in that it involves data analysis phase before and after the deployment, and the effectiveness of the IDPS or ROI highly depends on interactive alerts tuning and data analysis techniques.
To achieve the best ROI of deploying IDPS, following needs to be considered.
1. Choose between IDS and IPS.
IDS product typically operates in passive monitoring mode, and does not interfere with production traffic, though it requires manual action to analyze and stop an intrusion. IPS typically installs inline on the network throttle point, and can automatically detect and block intrusion. However due to the high false positive rate, caution needs to be taken for deploying IPS on critical networks. Some vendors such as Sourcefire, Tippingpoint offers appliance that can operate in both IDS and IPS mode.
2. Choose between NIDS and HIDS
Network Intrusion Detection System (NIDS) monitors network traffic by aggregating network traffic, versus Host Intrusion Detection System (HIDS) is installed on the individual host as part of the end-point-security. Best to deploy both to have visibility to both network data and host data for correlation. Needless to say, for large enterprise, deploying and support large number of HIDS is quite a challenge and costly, so it is recommended for deploying on just some critical hosts. Small companies can go with just HIDS.
3. Choose where to deploy NIDS
NIDS is important perimeter security device. One critical decision for NIDS deployment is to decide whether deploying it outside or inside of the firewall. This will not only affect the scope of intrusion data collected but also NIDS management. If deployed outside of the perimeter firewall, NIDS can monitor all the outside traffic but in the meantime potentially introduce more false positive events. It is like hanging an alarm outside of the door, and anyone walking by could potentially trigger the false alarm. Also, the management of the IDS will need rules configured on the firewall behind it. Deploying inside of the firewall has the benefit of only monitoring the traffic that passes by the firewall, potentially significantly cut down the noisy data for intrusion analysis. It also has the benefits of avoiding the hassle for firewall rules maintenance. Deploying inside of firewall focuses on catching who breaks the door, downside is that you will not always know who is knocking the door, if you care.
4. Implement effective data capture and analysis techniques
ROI of IDPS highly depends on the effective data capture and analysis. Most often, IDPS captures too much noisy data (false positive) with real Intrusion lost in the noise. Without effective data capture and analysis technique, analyst will waste time filtering false positive and potentially misses the true Intrusion, or not catch it in time. It is also boring for Analyst to eyeball massive IDS data. It is important to configure IDS signature to capture the data that are related to network environment and the important business traffic. OLTP Databases such as Oracle have good utilities that can be used to manage and mine those data sets to convert data into meaningful information. For critical intrusion events, it typically requires bottom-up analysis technique, but for general analysis of large data sets, top-down mining tool will be helpful.
In summary, deploying of IDPS should be part of the enterprise defense-in-depth strategy. Company’s internal and perimeter networks and external threats need to be evaluated to test/choose the right IDS/IPS vendor product (Enterasys, Sourcefire, TippingPoint, to name a few). Based on the company policy requirement, choose to deploy the IDPS inside or outside of perimeter firewalls. Based on the IDPS product features and nature of environment network traffic, implement effective signatures or baseline for data capture, Intrusion alerting, and data analysis. Data mining techniques and OLTP database tools are highly recommended to assist identifying true Intrusion pattern from massive network traffic data.
Tags: DDOS, Hacking, HIDS, IDS, Intrusion Analysis, Intrusion Detection, Intrusion Prevention, IPS, NIDS
I want to thank the blogger very much not only for this post but also for his all previous efforts. I found http://www.jameswanonline.com to be extremely interesting. I will be coming back to http://www.jameswanonline.com for more information.
Thanks for visiting, glad you find my posts interesting. Best wishes to your online business (http://www.paydaytown.com).
You have tested it and writing form your personal experience or you find some information online?
Gatorbait,
I wrote from my years of hands-on industrial experience specializing in this field, though my field shifted a little bit in recent years. I have experienced quite some hacking activity targetting from college lab computing systems to well defended corporate infrastructure, and have worked with some elite IDS specialists. I’m personally not interested in and against any malicious hacking of information systems to cause trouble or even financial loss to other people just for personal emotional or monetary purpose. Hacking just does not make sense to me. I think the money, the time, the people budgeted on IDPS could have been used for better purpose if there were no such need, but this world is complicated.
jWqm2T Excellent article, I will take note. Many thanks for the story!
Cialis, glad that you liked it.
Do you have copy writer for so good articles? If so please give me contacts, because this really rocks!
Thanks for the visiting. It would be nice if I had a copy writer, but this post is what I wanted to write about from my own experience in the field.
Interesting blog you got here but I can’t seem to find the RSS button.
Hi, Curtis, that’s definitely something that I would like to add in the near future (there appears a bug in the RSS plugin). Btw, I like your website (https://secure.diigo.com/user/smart01), which I think is a good concept.
My name is Piter Jankovich. oOnly want to tell, that your blog is really cool
And want to ask you: is this blog your hobby?
P.S. Sorry for my bad english
yes, this blog is my hobby. I just write when I feel an urge that I have something to write out. I wish I could write more often, but my work and baby keeps me busy most of the day and night. I really appreciate the supportive comments from readers like you. Thank you.
This is often a very smart browse on behalf of me, Should admit that you are one in every of the best bloggers I ever saw.Thanks for posting this informative article.
Great detailed information, I ll be visiting you more frequently, here is very interesting information.
i was starting to feel i might possibly end up being the sole human being who cared about this, at the least now i know i’m not loony
i will be sure to look at a handful of other posts soon after i get a bit of caffeine in me, it can be not easy to read without having my coffee, I was really late last night playing zynga poker and after polishing off a few brewskies i finished up melting away all my zynga poker chips cheers 
Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts.Any way Ill be subscribing to your feed and I hope you post again soon
Hi, Kenzie, thanks for your visiting. Your comment is really encourageous.
hello remarkable little blogging site ya have right here
I work with the same exact theme on my website yet somehow for whichever odd reasons it appears to load at a higher speed on this blog despite the fact that the one you have carries a good deal more content material. Are you implementing any plugins or widgets that will quicken it up? If you could possibly reveal the widgets so I would be able to use these in my own website so twilight eclipse users could watch twilight breaking dawn online trailers and clips quicker I would be happy – cheers ahead of time 
Your web site (http://squidoo.com/watch-twilight-eclipse) loads fast enough to me despite quite some images and videos. I did not use any particular plugin to speed up the loading. I would suggest fine tuning the “Setting” items in your WP admin page to see any difference. With my experience of supporting web servers and implementing web pages, the loading speed is more on the web server side. If you are using a hosting service, they may be able to help with investigating the performance issue, or even install web accelerator engine for you.
Hello, I found this by accident while doing some research on a different topic. As is the case for me. I found your posts informative which is highly refreshing. Keep up the great work.
I admit, I have not been on this webpage in a long time… however it was another joy to see It is such an important topic and ignored by so many, even professionals. I thank you to help making people more aware of possible issues.Great stuff as usual
Pretty impressive post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be coming back and I hope you post again soon.
Good post, I can’t say that I agree with everything that was said, but very good information overall:)
Brand New Finland VPN Accounts: https://www.intl-alliance.com/store/index.php?main_page=index&cPath=1_76
Hi, Gabrielle, I’m glad that you feel this blog out of my experience is informative to you. Thanks for you comment.
You make various correct points in your article and would most likely accept the majority of.
Thanks for taking the time to discuss this, I feel strongly about it and love learning more on this topic. If possible, as you gain expertise, would you mind updating your blog with more information? It is extremely helpful for me.
Thanks for the visiting. I will try to post some more blogs on this.
Very good site to learn from. Thanks for sharing.
I recently came accross your web site and have been reading along. I thought I would leave my very first comment. Nice blog. I will keep visiting this website very frequently.
Hi..I am reading your page for a few days now is there any way to subscribe by email
Hi, there! I do not have the email LIST yet, but will try to setup one in the future.
Yes, that is true, I agree with you, but I am not sure if there are no other options.
Great posts! I really like it.
When was the last time you were driving down the digital highway and felt like you were shot by words?
This is a nice web site. Good fresh interface and nice informative blogs. I will be coming back soon, thanks for the great blog.
Cool post.
Very informative post. Thanks for taking the time to share your view with us.
I just sent this post to a bunch of my friends as I agree with most of what you’re saying here and the way you’ve presented it is awesome.
Aw, this was a really quality post. In theory I’d like to write like this too – taking time and real effort to make a good article… but what can I say… I procrastinate alot and never seem to get something done. Great American rock music began in the 50s with Buddy Holly, Elvis Presley, and Chuck Berry.
…
Thanks! it’s helpful to me. Here you can always look the best Youth hockey teams！…
You certainly deserve a round of applause for your post and more specifically, your blog in general. Very high quality material
Awesome Post. I add this Blog to my bookmarks.
Thank you very much for so interesting article. Good job!
…
Extremely frequently I go to this blog site. It quite significantly is pleasant to me. Many thanks the author!…
hey i posted a remark quite some time back on the subject of just how to speed up my twilight eclipse site’s load time since we used the same theme during the time and somebody left a comment answering it on my website weeks ago – if that was you I simply wanted to say thanks, and if it wasn’t you then i am sorry to take the time you, but thanks anyways!
great site and your writing style is amazing. just found your site on yahoo. I¡¯ll come back later for sure
omg ok so here is how dumb I am, halfway through reading your post I dropped my mouse and shut down the internet explorer by accident and I could not locate your article again right up until 2 days later on to finish reading through where I left off because I forgot how I linked to your site in the first place haha anyway it was worth the wait..cheers
Hi, thanks for sharing your experience. It happens. Glad you found the link back.
I was looking for this the other day. i dont usually post in forums but i wanted to say thank you!
Hi,good article,thanks for your share! and I wonder if i can quote this post in my site if I put a link back to yours? Waiting for your answer!
Hi, please feel free to quote or link my posts. I’m glad that you find my blog helpful.
cool blog i enjoyed reading this.
This has been a really good read . been looking for this for since. thank you a lot.
…
Cheers for this content, guys, maintain up the wonderful function….
I really like the style of your writing. I found your blog on bing and decided to check out
This post makes a lot of sense !
shares utilize a excellent website decent Gives bless you for the efforts to help myself
I checked by on ur great blog. Nice Work dude.
You’re a Really Professional Blogger, You either have got quality knowledge of what your discussing or you did some great research. Thanks for this excellent post.
Hi there could I reference some of the information from this post if I reference you with a link back to your site?
Yes, and thanks.
…
Cheers for your info. Significantly appreciated….
Hmmm…very good to find out, there have been without a doubt a number of elements that I had not idea of before.
How did you make this template? I got a blog as well and my template looks kinda bad so people don’t stay on my blog very long.
I did not make this template. It is a theme that I got from my ISP. There are many other WordPress themes you can choose from. Your website looks nice to me.
Please tell me it worked right? I dont wish to sumit it once again if i do not have to! Either the blog glitced out or i am an idiot, the second selection doesnt surprise me lol. thanks in your very good blog!
PillSpot.org. Canadian Health&Care.Special Internet Prices.No prescription online pharmacy.PillSpot.org. Vitamins@buy.online” rel=”nofollow”>.…
Categories: Pain Relief.Mens Health.Stop SmokingVitamins/Herbal Supplements.Blood Pressure/Heart.Antidiabetic.Skin Care.Weight Loss.Eye Care.Anti-allergic/Asthma.Antiviral.Mental HealthWomens Health.Antibiotics.Anxiety/Sleep Aid.Stomach.Antidepres…
I just visited your website via Facebook… would you be thinking about becoming blog partners?
It will be my pleasure. Thanks for the invitation.
I’m interested in purchasing back link on this web site. Be advised e-mail us with the rates. Thanks a lot.
I can do this for free. You can send me the keywords for your links. I think your “download-music” web site is what I have been looking for my ipod touch, though I have not tried out the downloading yet.
Linkup…
Linked up with your blog….
I can see that you are an expert in this area. I am launching a website soon, and your information will be very useful for me.. Thanks for all your help and wishing you all the success in your business.
I can see that you have found a good niche. Good luck to your new website!
I love your website! did you create this yourself or did you outsource it? Im looking for a blog design thats similar so thats the only reason I’m asking. Either way keep up the nice work I was impressed with your content really..
I’m using WordPress theme “Default” 1.6 by Michael Heilemann, it is based on the famous Kubrick. The theme is free to me from my hosting ISP (btw, i like bluehost so far), but my content is original. You should be able to use other WordPess themes too, either free or pay for additional features. Thanks for the visiting.
I blog because I want to write myself, all the posts are original.
I love your website! did you create this yourself or did you outsource it? Im looking for a blog design thats similar so thats the only reason I’m asking. Either way keep up the nice work I was impressed with your content really..
This page is very helpful for me to choose the viable product.
Love is the ability and willingness to allow those that you care for to be what they choose for themselves without any insistence that they satisfy you.
You really make it seem so easy with your presentation but I find this topic to be really something which I think I would never understand. It seems too complicated and very broad for me. I am looking forward for your next post, I will try to get the hang of it!
Thanks for posting. Good to see that not everyone is using RSS feeds to build their blogs
I feel lucky to visit your site.
I always like to have a read about such things, my blog is related if you want to have a look round it please feel free. I have added yours to my bookmarks.
You built some beneficial details there. I did a look for within the matter and observed most folks will consent with your webpage.
Nice post take a look at my site it may not be immediately related but I hope you can get the same value out of it, I got here?
Nothing better than getting what you want from a post, kudos to you for this.
Good collection of work & excellent site!
I just wanted to comment and say that I really enjoyed reading your blog post here. It was very informative and I also digg the way you write! Keep it up and I’ll be back to read more in the future
hey friend… i think your site is very interisting for me….. your site give me some important information.. thanks a lot!
Keep posting stuff like this i really like it, Good job My friend
I Found your site on delicious today and really liked it.. i bookmarked it and will be back to check it out some more later:)
Wow so nice! I like this site.Keep it working every day
Heya! I correlated to your article content just I didn’t end up with a trackback. Should you reveal to me what is actually happening?
Your expert
Someone I work with visits your blog frequently and recommended it to me to read too. The writing style is great and the content is top-notch. Thanks for the insight you provide the readers!
Nice post! I want to subscribe this blog, but I don’t know how to do, can anybody give me a hand?
Hi, there is a RSS button on the bottom of the right side bar, clicking on the button will lead you to the feed subscribe page, where you can click on “Subscribe in Google Reader” or “Add to iGoogle”.
Noticed your Webblog bookmarked on Reddit.I appreciate your web blog and marketing and advertising tactic. Verify out my Farmville Guideline if you get yourself a moment.
Epic site I’m so glad I stumbled here through my friend’s blog, Going to need to add this one to the blogroll.
Buy:Synthroid.Arimidex.Valtrex.Petcam (Metacam) Oral Suspension.Nexium.Mega Hoodia.Prevacid.100% Pure Okinawan Coral Calcium.Zyban.Human Growth Hormone.Prednisolone.Accutane.Actos.Retin-A.Lumigan.Zovirax….
I feel you are too good to write Genius!Thanks for posting, maybe we can see more on this.
I just book marked your blog on Digg and StumbleUpon.I enjoy reading your commentaries.
Can I reproduction your article to my blog? Thank you.
Sure, no problem.
An associate of mine told me to check out your blog. This is just the kind of facts I was looking for. I wish I have come across your blog sooner.
Great article post.Much thanks again. Keep writing.
Great post! I started following your blog about a month ago and I like your honesty. Good example to emulate.
…
I thought that was extremeley fascinating. Thank you for your unusual details. I’ll continue to keep subsequent this….
Very informative post. Thanks for taking the time to share your view with us.
Good blog, where did you come up with the knowledge in this piece of content? I¡¯m glad I found it though, ill be checking back soon to see what other articles you have.
My years hands-on experience in the field is compressed in this blog, and I’m glad that you find it useful. I will try to post more as I get some spare time.
Great Post. I add this Post to my bookmarks.
I find myself coming to your blog more and more often to the point where my visits are almost daily now!
You certainly have some agreeable opinions and views. Your blog provides a fresh look at the subject.
There’s obviously a lot to know about this. I believe you created some great points in Features also.
Thanks for sharing information with us. it is very useful to me.
Awesome, that’s exactly what I was scanning for! You just spared me alot of work
…
What a wonderful resource!…
I’ve been visiting your blog for a while now and I always find a gem in your new posts. Thanks for sharing.
Wow!, this was a top quality post. In theory I’d like to write like this too – taking time and real effort to make a good article… but what can I say… I keep putting it off and never seem to get something done
I just sent this post to a bunch of my friends as I agree with most of what you’re saying here and the way you’ve presented it is awesome.
That was a awesome read,You discover something new every day.
Hey guys i want to share with you a peice of software that submits your articles (Blogs) and multiple websites very easyily and fast, making your site get LOADS more visitors. Just take a quick look at their website, if you own a website/want to make one and want to make alot of money then this is definatly something you should take a quick look at. Article Submitter Software
Really love all these stories.. have been reading them daily. Please add more if you have any… Thanks a lot again for this awesome work.
Hudrends of people will agree with this article whoever many other’s will not agree,but I appreciate your work here.
thanks for the illuminating post. I was initially glad when i read your piece and have made an important subscription with it. Make sure you revise this short article when you’re able to because I’d like more information.
Valuable info. Lucky me I found your site by accident, I bookmarked it.
Awesome to enjoy finally see this post. I responded to your previous page although I did not have a reaction.Is this template the standard design template or possibly perhaps you have hand crafted your blog post Many thanks.
I’m using standard design template. With some dollars, you should be able to get some more features from some other commercial templates.
The design for your site is a bit off in Epiphany. Nonetheless I like your web site. I may have to install a “normal” browser just to enjoy it.
Nice post. I have one question. If I was going to start a website what would be your best piece of advice for me? Your site seems like it does well. Do you have any advice for me?
Find a niche that you are interested in and have good experience.
…
good advice and discussing,I will get this wonderful for me .thanks!…
Hello, Thanks for the chance to submit because it surpasses phoning! I am incredibly astounded by the contribution various other blog writers are generating on your own web page and hope to make contributions in addition any time i can. I go along with the earlier poster and anticipate to return here and there.
gevalia http://tmaxellyekt7.BABYCLOTHESNUT.INFO/tag/gevalia+Carafe+Coffee/ : Carafe…
Carafe…