As with the pre-attack period, it is helpful to sub-divide the post-attack period, although this time the basis is function/purpose as opposed to time sequence.
The first sub-division
The second sub-division is less technology centric and more process oriented. Overall it can be called incident response, which is intended to include forensic and remedial activities. Fundamentally, it is about dealing with a successful attack, and ideally it should also involve taking steps to prevent recurrence.
And with that, the attack timeline is fully defined. The final part in this series describes the vision of next-generation intrusion prevention, a system that integrates capabilities across this time continuum and aspires to provide a truly self-defending environment.
NEXT-GENERATION INTRUSION PREVENTION
A continuum of capabilities
The pre-attack period
Time zero (during the attack)
The post-attack period
The power of an integrated system
|Martin Roesch founded Sourcefire in 2001 and serves as its Chief Technology Officer. A respected authority on intrusion detection technology and forensics, he is responsible for the technical direction and product development efforts. Martin, who has 17 years industry experience in network security and embedded systems engineering, is also the author and lead developer of the Snort Intrusion Detection System (www.snort.org) that forms the foundation for the Sourcefire 3D System.|
This was first published in September 2005