|
Network anomaly detection has been around for a few years, and the concept of anomaly detection in network defense even longer. The following debunks a few myths surrounding NAD:
Myth
Automated profiling/modeling/training eliminates tuning.
Automated response capabilities to enable containment, like
pushing ACLs to network infrastructure, can protect against threats.
NAD catches hard-to-detect insider misuse that cannot be addressed by firewalls and IPS.
NAD detects zero-day exploits.
NAD is the last line of defense.
Reality
It doesn't eliminate it; it changes the nature of the tuning from which signatures should be enabled to which anomalies you choose to highlight and address.
Automated response features are present, but — as was the case with early adopters of IPS products — most operators are reluctant to turn on automated response because of the high potential for false positives. While NAD produces interesting intelligence, the collected data is better suited for investigative rather than automated responses.
Technically, yes, but it's subject to the limitations of determining which anomalies are really important. NAD doesn't substantially affect the difficulty of detecting and addressing malicious insiders.
NAD detects infections and helps organizations contain them before they spread, which could be argued as the only really effective way to deal with zero-day attacks. There's no magic that understands zero-day exploits any better than any other technology.
This may be true. As a decision-support system, NAD helps organizations address the impacts of various attacks and behaviors on their network.
|
