Don't let trends dictate your network security strategy

More on defense-in-depth This book chapter excerpt examines the future of intrusion prevention systems.

Unfortunately, this is not the first time I've heard people debate the worth of host-based intrusion prevention systems in the enterprise; in fact, I've also heard people remark that host-based intrusion prevention systems' aren't worth the trouble because they're difficult to manage and monitor. Let's examine why this and similar beliefs are false, how host-based intrusion prevention systems use can be beneficial and why moving away from host-based intrusion prevention systems may be risky.

However, before we start reviewing host-based intrusion prevention systems benefits, let's first take a look at host-based intrusion prevention system technology and its proper role in the enterprise. As many readers know, host-based intrusion prevention systems allow the protection of individual systems against attacks. When they detect a potential attack using either signature-based or anomaly-based algorithms, they can ignore the detection, alert administrators to the event or block the traffic altogether. Additionally, host-based intrusion prevention systems are beneficial because:

• Host-based intrusion prevention systems can detect attacks that network-based systems simply can't. Host-based systems have access to detailed data about system processes, resource utilization and device activity that network-based sensors lack. In some cases, analysis of this data may be the only clue that an attack is underway. Consider the case of an insider attack. If the attacker resides on the same local network as the target system, traffic between the two may never come under the scrutiny of a network-based intrusion prevention systems sensor.

• Believe it or not, there are attack vectors other than the network. The movie WarGames may be from 1983, but computers are still attached to telephone lines and the war-dialing technique made famous by Matthew Broderick can be just as dangerous as a network-based incursion. Similarly, an attacker can walk up to the console of your system and begin a brute-force password attack. Network-based intrusion prevention systems are useless in these scenarios.

• Anomaly-based detection techniques are often more effective at the host than on the network. Anyone who's experimented with anomaly-based intrusion detection knows that they can be finicky, at best. These systems rely upon a baseline of "normal" activity and then attempt to detect deviations from that norm. The problem is that, for many networks, there's no such thing as "normal" activity. Individual hosts, on the other hand, may have very clearly defined roles on the network, making network anomaly detection feasible.

And finally, for those who believe host-based intrusion prevention systems are difficult to manage and monitor, that's also largely untrue. Modern host-based intrusion prevention system implementations often use an agent/manager approach that allows centralized enterprise management of deployed systems.

Hopefully, I've convinced you that host-based intrusion prevention systems do indeed play an important role in the enterprise. More importantly, keep this general lesson in mind the next time you hear about a "trend" or "fad" in information security: Defense-in-depth means instituting layers of protection to safeguard your data and systems against many different types of attacks. After all, ivory tower security analysts who declare trends like "the perimeter is dead" often make those pronouncements from behind a strongly defended perimeter!

About the Author:
Mike Chapple, CISA, CISSP is an IT Security Professional with the University of Notre Dame. He previously served as an information security researcher with the National Security Agency and the U.S. Air Force. Mike is a frequent contributor to SearchSecurity, a technical editor for Information Security magazine and the author of several information security titles, including the CISSP Prep Guide and Information Security Illuminated.

Rate this Tip To rate tips, you must be a member of SearchSecurity.com. Register now to start rating these tips. Log in if you are already a member. BROWSE BY TAG Network Security Tactics,   Network Intrusion Detection and Analysis,   Enterprise Network Security,   Network Intrusion Prevention (IPS),   Network Intrusion Detection (IDS),   VIEW ALL TAGS Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Network Security Tactics Screencast: Find rogue wireless acess points with Vistumbler How to prepare for a secure network hardware upgrade Preventing SQL injection attacks: A network admin's perspective Screencast: How to launch an OpenVAS scan Wireless network guidelines for PCI DSS compliance Aligning network security with business priorities Scanning with N-Stalker offers basic Web application security assessment Lifecycle of a network security vulnerability Screencast: BackTrack 4 offers an arsenal of penetration testing tools Network access control technology: Over-hyped or underused? Network Intrusion Prevention (IPS) Aligning network security with business priorities Best Intrusion Prevention and Detection Products Port scan attack prevention best practices Lesson 4: How to use wireless IPS Lesson 1 quiz: Risky business Hacker attack techniques and tactics: Understanding hacking strategies SIMs tools and tactics for business intelligence IPS and IDS deployment strategies I'll be watching you: Wireless IPS Know when you need IDS, IPS or both Network Intrusion Prevention (IPS) Research Network Intrusion Detection (IDS) Preventing SQL injection attacks: A network admin's perspective Lifecycle of a network security vulnerability Best Intrusion Prevention and Detection Products Rogue AP containment methods SIMs tools and tactics for business intelligence IPS and IDS deployment strategies Know when you need IDS, IPS or both Trend Micro to acquire Third Brigade for virtualization, cloud security New product aims to control rogue applications that avoid firewalls How to perform a network forensic analysis and investigation Network Intrusion Detection (IDS) Research RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Diffie-Hellman key exchange  (SearchSecurity.com) intrusion prevention  (SearchSecurity.com) network behavior analysis  (SearchSecurity.com) RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.