Next-generation intrusion prevention: The post-attack period

Next-generation intrusion prevention: The post-attack period

As with the pre-attack period, it is helpful to sub-divide the post-attack period, although this time the basis is function/purpose as opposed to time sequence.

The first sub-division

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

deals with the extension of detection efforts beyond the time-zero period and is largely about correlation. For example, network behavior anomaly detectors (NBADs) use statistical correlation to establish rate-based thresholds for various types of events. However, security event/security information management systems provide an even clearer example. These products afford the opportunity to correlate events gathered by a wide variety of networked devices, potentially leading to the discovery of attacks that are being coordinated across multiple paths or over a relatively long time period.

The second sub-division is less technology centric and more process oriented. Overall it can be called incident response, which is intended to include forensic and remedial activities. Fundamentally, it is about dealing with a successful attack, and ideally it should also involve taking steps to prevent recurrence.

And with that, the attack timeline is fully defined. The final part in this series describes the vision of next-generation intrusion prevention, a system that integrates capabilities across this time continuum and aspires to provide a truly self-defending environment.


NEXT-GENERATION INTRUSION PREVENTION

  A continuum of capabilities
  The pre-attack period
  Time zero (during the attack)
  The post-attack period
  The power of an integrated system

ABOUT THE AUTHOR:
Martin Roesch founded Sourcefire in 2001 and serves as its Chief Technology Officer. A respected authority on intrusion detection technology and forensics, he is responsible for the technical direction and product development efforts. Martin, who has 17 years industry experience in network security and embedded systems engineering, is also the author and lead developer of the Snort Intrusion Detection System (www.snort.org) that forms the foundation for the Sourcefire 3D System.

This was first published in September 2005

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

Back to top