Ask the Expert

What is the cause of an 'intrusion attempt' message?

We have about 25 computers on our network. All have client antivirus security installed. Today, on several of them, I received a pop-up stating that an intrusion attempt has been blocked. This is the first time that I received this message. What could be some possible causes for this?

    Requires Free Membership to View

    Login

First, the good news. The message you received indicates that your endpoint security product is working properly. It detected and blocked the intrusion attempt, ensuring the security of that system.

There are three likely scenarios that could have caused this message to appear:

  • First, in the best case, it's a false alarm. Intrusion detection systems (IDSes) often generate false positive alerts. In order to determine if this is the case on your systems, you'll have to look at the details of the alerts and determine whether the packets triggering the alerts appear to be legitimate activity for your environment. What may be considered a legitimate packet on one network could be a rogue packet on another.
  • The second possibility is that the intrusion attempt came from an infected system on the local network. If this is the case, the alert should still provide you with valuable information: the address of the system causing the alert. You should check that system for any signs of malicious activity.
  • The final possibility is that your systems received the attack from outside your local network. In this case, you likely have a misconfiguration on your network firewall that allowed the traffic to reach the endpoint. Check your configuration and ensure that external traffic is not allowed into networks hosting endpoint systems without the use of a VPN.

Good luck tracking down the source of this attack!

More information:

  • A SearchSecurity.com reader asks Mike Chapple, "What are the differences between intrusion detection and intrusion prevention?"
  • Learn the best practices for creating an IDS and maintaining a signature database.

    • This was first published in January 2009

    Join the conversationComment

    Share
    Comments

      Results

      Contribute to the conversation

      All fields are required. Comments will appear at the bottom of the article.
      Back to top