Expect to Hear "IDS Is Dead" (Again)
Do you remember when IDS was dead, and supposed to be replaced by "thought-leading firewalls" by 2005?
Well, that prediction died pretty quickly. However, I expect to hear it again after reading DIB cybersecurity pilot has stopped 'hundreds' of intrusions, says Lynn:
About 20 companies participate in the Defense Department's 90-day pilot for an active network defense capability for the defense industrial base analogous to the Homeland Security Department's Einstein 3 effort, said Deputy Defense Secretary William Lynn.
During an address to the 2011 DISA Customer and Industry Forum in Baltimore, Md., Lynn said the sharing of malicious code signatures gathered through intelligence efforts to pilot participants has already stopped "hundreds of intrusions."
Lynn also laid blame for intrusions into military and defense industrial base networks on "foreign intelligence services," stating that they have stolen military plans, weapons system designs, source code and other intellectual property.
"This kind of cyber exploitation does not have the dramatic impact of a conventional military attack," Lynn said. "But over the long term, it has a deeply corrosive effect. It blunts our edge in military technology and saps our competitiveness in the global economy."
Foreign intruders have extracted terabytes of data from defense companies, he added.
This sort of story is likely to lead to the same arguments I heard eight years ago regarding "Intrusion Detection Systems" vs "Intrusion Prevention Systems," namely:
If you can detect it, why can't you prevent it?
This is a broad topic, so rather than try to answer everything here and now, I'll likely work on it over the coming weeks in individual posts.
Tweet
Comments
May come up with good arguments.. indeed! :)
At any given time a box with ssh on will be under attack from at least 1 brute-force root attack every hour.
Almost any probing like portscan, Nikto scan, nessus scan, skipfish, SQL injection bots etc. can be considered an intrusion. I consider this to be simply annoying noise on the line.
I am interested in detecting the "real" intrusions.
Any suggestions for better naming?
How are they doing against the stuff they don't have signatures for?
Detection is not part of incident prevention - it is part of incident response. Detection's real value comes in when prevention fails. The bad guys are looking for the chinks in your armor - that's where detection comes in. That's the hacker mindset - tinkering with things in unforeseen and unpredictable ways. That's what infosec professionals do - we are looking for how those vulnerabilities can be used against us.
In monitoring events you are also validating the effectiveness of preventative countermeasures. You're not just looking for attacks, you're looking at your own performance too. Best case scenario, your detection validates that your preventative measures are working. Because if you aren't performing detection, how would you know? How do you know your firewall is dropping the right traffic? Do you validate that your tools are behaving as expected? Unexpected behavior is the cornerstone of exploitation.
The whole argument against detection is just whistling through the graveyard. If you want feel-good infosec, get a snuggie. There's no such thing as an information security blanket.
Yes, I invented it, in writing, in 2004. :)