CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.1  Devices            9  3.1.9  IDS (Intrusion Detection System)

How Does an IDS Work? 1 Security Issues with IDS

In June 2003 the research group Gartner declared IDS a failure²⁹¹, notably due to the ‘false positive issue, as seen in a few paragraphs. As the number of TCP network intrusions has increased over the years, more and more IDS’s have been developed, both commercial and non-commercial. As with firewalls, commercial IDS packages can be pricey. Examples of commercial intrusion detection systems you might want to research include:

• RealSecure, by Internet Security Systems ²⁹²
  
  
• Dragon, by Enterasys ²⁹³
  
  
• NFR, by Network Flight Recorder ²⁹⁴ (also available in a free research version)

The most popular open source network IDS, and possibly the most popular one period, is Snort²⁹⁵. SANS Intrusion Detection wizard Stephen Northcutt calls it, “the most advanced intrusion detection system money cannot buy.”²⁹⁶ Additionally, a comprehensive list of public domain and shareware IDS software can be found at the COAST Intrusion Detection System Resources site²⁹⁷.

If you don’t require network-wide monitoring for suspicious activity, check out the following host-specific IDS options, which are only some of the packages in the growing category of freeware, sometimes-open source, IDS’s:

• Tripwire, by the Tripwire open source team²⁹⁸ (also available in a commercial version)
  
  
• Tcpwrappers, by Wietse Venema²⁹⁹
  
  
• PortSentry, by Psionic Technologies³⁰⁰
  
  
• AIDE (Advanced Intrusion Detection Environment)³⁰¹

The different IDSs have subtly different capabilities, strengths and weaknesses, so before committing to one, do your research! Make sure that the one you’ve selected does in fact detect the kinds of intrusions you care about, and that the system is able to respond with the types of actions you need. For example, if you need for the system to dial a pager, make sure that it can do these or at least that you can find a pager dialing program out on the net (they’re there…) and that the system can run it.

Be cautious in reading reviews. This industry is evolving rapidly, what with new “cracking” techniques constantly being developed, and new detection measures being created to identify them, so review comments true about the last version of a package may or may not still apply to the current version. When in doubt, check with the vendor.

How Does an IDS Work? 1 Security Issues with IDS