Over the past few years we've seen progress in the areas of network intrusion detection and prevention. For the most part this has been based on increasing the scope of the associated traffic and event inspection capabilities. For example, most signature bases have expanded to account for protocol usage. Of course, this has also enabled a shift, albeit a relatively small one, toward implementing more real-time responses (i.e., prevention), as opposed to manually initiated, after-the-fact corrective measures. Yet, it is still difficult to imagine anyone arguing against the need for even greater levels of effectiveness.
A significant challenge for intrusion detection and prevention technologies is that they operate at a single point along the timeline that characterizes an attack. Understanding this timeline is important for several reasons. It can help organizations position the confusing array of self-proclaimed, all-encompassing, policy, compliance, configuration, patch, vulnerability, threat and XYZ management technologies and capabilities that currently flood the market. It can also help organizations establish an over-arching monitoring and response process. And, it is the key to next-generation intrusion prevention -- a system that integrate capabilities across the continuum and enables what can best be described as automated policy enforcement.
The timeline itself is a relatively straightforward concept. It is comprised of three primary parts: the pre-attack period, time zero and the post-attack period. Briefly, the pre-attack period concerns activities to minimize the exposure to exploits; the time-zero period concerns activities that deal with both onset and ongoing exploitation of a defensive weakness; and the post-attack period is concerned primarily with "extended detection" (i.e. ex post facto), and recovery and remediation.
Admittedly, the nature of some attacks causes some blurring between the lines. For example, it is arguable whether low-and-slow, multi-stage attacks have a discrete time zero associated with them. Rather, they can be viewed as consisting of multiple time-zero events that, if left unchecked, culminate in a more significant and recognizable attack. These nuances are addressed further in part two of this series. The key points for now are that different technologies and sub-processes are applicable during the different phases of the evolution of an attack and that achieving maximum effectiveness at thwarting intrusions depends on implementing a solution that addresses each of these time periods. Accordingly, it is also necessary to take a closer look at each of these time periods.
NEXT-GENERATION INTRUSION PREVENTION
A continuum of capabilities
The pre-attack period
Time zero (during the attack)
The post-attack period
The power of an integrated system
ABOUT THE AUTHOR:
|
Martin Roesch founded Sourcefire in 2001 and serves as its Chief Technology Officer. A respected authority on intrusion detection technology and forensics, he is responsible for the technical direction and product development efforts. Martin, who has 17 years industry experience in network security and embedded systems engineering, is also the author and lead developer of the Snort Intrusion Detection System (www.snort.org) that forms the foundation for the Sourcefire 3D System.
|
|
