Next-generation intrusion prevention: The pre-attack period

Next-generation intrusion prevention: The pre-attack period

At a macro-level, configuration management is perhaps the best term to describe the activities associated with this phase – although the case could also be made for calling it vulnerability management.

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Regardless, for our purposes the pre-attack period can logically be divided into two separate timeframes.

Assessments are typically made relatively long before an attack (i.e., days, weeks) to establish proper configuration of the computing environment. This entails identifying discrepancies from established policies as well as vulnerabilities, both those that are the result of coding deficiencies and those that are the result of configuration "errors." Various scanning technologies are applicable and findings are subsequently addressed, typically by implementing patches, re-configuring affected devices or re-configuring upstream security devices.

Clearly these are all positive, preventive measures. Yet they describe a conventional approach. It is based on periodic snapshots and is therefore diminishing in value as the time between vulnerability discovery and the appearance of an associated exploit consistently shrinks. In contrast, a defining characteristic for next-generation intrusion prevention is the ability to significantly reduce the period between assessments, ideally offering some degree of always-on, passive scanning capability in conjunction with on-demand, highly-targeted active scanning.

The second part of the pre-attack period occurs immediately prior to a potential attack. This is the domain of conventional access control tools such as firewalls and routers with ACLs that can stop an imminent attack as a matter of routine enforcement of the rules that comprise their configuration. By no means a sufficient defense against attacks, these tools are still very effective in terms of making the problem space more manageable. As will be discussed in part three, there is also the potential to use them more dynamically to assist with attack mitigation.

In the next installments we'll take a closer look at the technologies and processes associated with the attack and post-attack periods.


NEXT-GENERATION INTRUSION PREVENTION

  A continuum of capabilities
  The pre-attack period
  Time zero (during the attack)
  The post-attack period
  The power of an integrated system

ABOUT THE AUTHOR:
Martin Roesch founded Sourcefire in 2001 and serves as its Chief Technology Officer. A respected authority on intrusion detection technology and forensics, he is responsible for the technical direction and product development efforts. Martin, who has 17 years industry experience in network security and embedded systems engineering, is also the author and lead developer of the Snort Intrusion Detection System (www.snort.org) that forms the foundation for the Sourcefire 3D System.

This was first published in September 2005

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

Back to top