Next-generation intrusion prevention: Defense before, during and after the attack

Over the past few years we've seen progress in the areas of network intrusion detection and prevention. For the most part this

    Requires Free Membership to View

has been based on increasing the scope of the associated traffic and event inspection capabilities. For example, most signature bases have expanded to account for protocol usage. Of course, this has also enabled a shift, albeit a relatively small one, toward implementing more real-time responses (i.e., prevention), as opposed to manually initiated, after-the-fact corrective measures. Yet, it is still difficult to imagine anyone arguing against the need for even greater levels of effectiveness.

A significant challenge for intrusion detection and prevention technologies is that they operate at a single point along the timeline that characterizes an attack. Understanding this timeline is important for several reasons. It can help organizations position the confusing array of self-proclaimed, all-encompassing, policy, compliance, configuration, patch, vulnerability, threat and XYZ management technologies and capabilities that currently flood the market. It can also help organizations establish an over-arching monitoring and response process. And, it is the key to next-generation intrusion prevention -- a system that integrate capabilities across the continuum and enables what can best be described as automated policy enforcement.

The timeline itself is a relatively straightforward concept. It is comprised of three primary parts: the pre-attack period, time zero and the post-attack period. Briefly, the pre-attack period concerns activities to minimize the exposure to exploits; the time-zero period concerns activities that deal with both onset and ongoing exploitation of a defensive weakness; and the post-attack period is concerned primarily with "extended detection" (i.e. ex post facto), and recovery and remediation.

Admittedly, the nature of some attacks causes some blurring between the lines. For example, it is arguable whether low-and-slow, multi-stage attacks have a discrete time zero associated with them. Rather, they can be viewed as consisting of multiple time-zero events that, if left unchecked, culminate in a more significant and recognizable attack. These nuances are addressed further in part two of this series. The key points for now are that different technologies and sub-processes are applicable during the different phases of the evolution of an attack and that achieving maximum effectiveness at thwarting intrusions depends on implementing a solution that addresses each of these time periods. Accordingly, it is also necessary to take a closer look at each of these time periods.


  A continuum of capabilities
  The pre-attack period
  Time zero (during the attack)
  The post-attack period
  The power of an integrated system

Martin Roesch founded Sourcefire in 2001 and serves as its Chief Technology Officer. A respected authority on intrusion detection technology and forensics, he is responsible for the technical direction and product development efforts. Martin, who has 17 years industry experience in network security and embedded systems engineering, is also the author and lead developer of the Snort Intrusion Detection System (www.snort.org) that forms the foundation for the Sourcefire 3D System.

This was first published in September 2005

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.