Next-generation intrusion prevention: Defense before, during and after the attack

Over the past few years we've seen progress in the areas of network intrusion detection and prevention. For the most part this has been based on increasing the scope of the associated traffic and event inspection capabilities. For example, most signature bases have expanded to account for protocol usage. Of course, this has also enabled a shift, albeit a relatively small one, toward implementing more real-time responses (i.e., prevention), as opposed to manually initiated, after-the-fact corrective measures. Yet, it is still difficult to imagine anyone arguing against the need for even greater levels of effectiveness.

A significant challenge for intrusion detection and prevention technologies is that they operate at a single point along the timeline that characterizes an attack. Understanding this timeline is important for several reasons. It can help organizations position the confusing array of self-proclaimed, all-encompassing, policy, compliance, configuration, patch, vulnerability, threat and XYZ management technologies and capabilities that currently flood the market. It can also help organizations establish an over-arching monitoring and response process. And, it is the key to next-generation intrusion prevention -- a system that integrate capabilities across the continuum and enables what can best be described as autom

To read more you must become a member of SearchSecurity.com

The timeline itself is a relatively straightforward concept. It is comprised of three primary parts: the pre-attack period, time zero and the post-attack period. Briefly, the pre-attack period concerns activities to minimize the exposure to exploits; the time-zero period concerns activities that deal with both onset and ongoing exploitation of a defensive weakness; and the post-attack period is concerned primarily with "extended detection" (i.e. ex post facto), and recovery and remediation.

Admittedly, the nature of some attacks causes some blurring between the lines. For example, it is arguable whether low-and-slow, multi-stage attacks have a discrete time zero associated with them. Rather, they can be viewed as consisting of multiple time-zero events that, if left unchecked, culminate in a more significant and recognizable attack. These nuances are addressed further in part two of this series. The key points for now are that different technologies and sub-processes are applicable during the different phases of the evolution of an attack and that achieving maximum effectiveness at thwarting intrusions depends on implementing a solution that addresses each of these time periods. Accordingly, it is also necessary to take a closer look at each of these time periods.


	Home > Security Tips > Network Security Tactics > Next-generation intrusion prevention: Defense before, during and after the attack