IDS/IPS Solutions

If you have some time and care to share your opinions I would appreciate it. I am writing an article and looking for some input regarding IDS/IPS. Do you think that IDS is a necessity for companies or is it just marketing hype that is driving it? If you agree that companies should implement IDs or IPS on their networks what sort of justifications would you provide to get approval for the purchase?

What do you feel are key issues for companies to consider when choosing an IDS/IPS solution and things they need to keep in mind in setting it up?

Many devices seem to be Swiss-army knife solutions these days which incorporate firewalls, IDS, content filtering, IDS and more. Do all-in-one solutions make sense for companies with little to no budget? What sort of pitfalls or caveats do you think exist when looking at these solutions?

Lastly- what about outsourcing it? Do you feel that outsourcing IDS is a viable option for small to medium companies rather than investing the resources to deploy and manage their own solution?

Tony:

Some form of IDS is absolutely necessary. They are the admin's eyes and ears if they are properly set up and managed/updated.

Key Issues:

1. Proper placement of the sensors
2. Select a system that can centralize all the logs
3. Sufficient disk space available to be able to properly log events
4. An understanding of how the chosen IDS works and it's limitations.
5. A system that allows the construction of custom rules by staff members.
6. An understanding of the output and it's implications.
7. A separate system that confirms connections alerted on by the IDS.

Swiss army knives are average at a lot of things byut they aren't good at anything. Thus go such devices.

Budget is practically irrelevant. If you don't have the staff with a level of competence to be able to set up snort boxes, manage them and understand the output then the high priced fancy boxes will do nothing for the company except provide a false sense of security.

Outsourcing: See above.... and you are trusting someone else with your security.... Hope they don't disgruntle their employees 'cos it mught be your butt going on the line..... ;)

Quote:

---

Originally posted here by Tiger Shark


Budget is practically irrelevant. If you don't have the staff with a level of competence to be able to set up snort boxes, manage them and understand the output then the high priced fancy boxes will do nothing for the company except provide a false sense of security.

Outsourcing: See above.... and you are trusting someone else with your security.... Hope they don't disgruntle their employees 'cos it mught be your butt going on the line..... ;)

---

Budget is 100% relevant. Every entity shopping for a security solution will not all have the same
needs with respect to which configuration is correct. It is not an all or nothing proposition.
IS/IT risk management does not dictate this approach and I feel it is a UTOPIAN notion at best.

A small business can have properly configured systems and networking on a limited budget.
Nothing is ever 100% secure but you can limit risk and exposure.
I like to use the term "managed" instead of "outsourced".
Managed firewalls and IDS implementations are a fine choice for a small business and an
affordable/trustworthy management team can be found.

The risk of using a bonded security management company is not much different than trusting the heart of a company to a disgruntled internal IT team member.

Security is important now more than ever. Take for instance, Bagle.Ai is now pounding away at my ISP. While one cannot rely on IDS to fix there problems, it is a valuable tool that provides admins with a plethra of information which in turn can help make security tighter and intrusion harder for the average script kiddie. The only problem I have had with IDS is the illusion that it is smple to setup and maintain. There is a lot of work that goes into verifying false positives as well as examining which is a real attack, and what can be trusted. Definirtyl an asset worthy of the sys admins book of tricks, but not as easy as marketing lets you believe they are to operate effectivly.

WIth the open source options available, it doesn't take much of a budget to set up an effective solution. I believe the key is how much time your company will allow IT to spend dealing with Intrusion Detection. It's one of those things that unless you have an intrusion, the executives may not understand the need. The way I went about it was to explain to them what *could* happen. I used the FBI's annual report to show them what the cost of such an intrusion is likely to be. Fear is a mighty motivator. Especially fear of downtime, losing money/competitive advantage/etc.

I stand where tigershark does.

IDS is a wonderful thing to have, but in order for it to be effective, you must have it configured properly.


While some people make enjoy the though of outsourcing to people that get paid $2 a hour, I would rather have all my information/ security in one place where all the other equipment is.

I do agree that outsourcing could be cheaper than having to invest he money required to set up your system, but I still wouldn't truyst my data/security in someone elses hands half way across the globe.

SS2: I respectfully disagree on the following points:-

1.

Quote:

---

Budget is 100% relevant. Every entity shopping for a security solution will not all have the same needs with respect to which configuration is correct.

---

We are talking about IDS' not firewalls etc. IDS' _must_ be entirely configurable by the end user or they are useless. The end user must be able to write their own rules, send the resultant alerts to an appropriate place and be able to have a system to parse them. If it isn't utterly flexible then it is utterly useless in the real world because every network is different and requires different allow/deny's in policy and practice. If the admin isn't capable of creating his own IDS system from open source software then he isn't going to be able to properly interpret the results. That being the case the only budget item the beancounters need to worry about is the cost of the admin since the cost of the hardware is minimal.

Quote:

---

It is not an all or nothing proposition. IS/IT risk management does not dictate this approach and I feel it is a UTOPIAN notion at best.

---

Security is an "all or nothing proposition". You are either secure or you aren't.... period.

Having said that, you accurately point out later that nothing is secure.... and you are quite right. But there's a fine line between being insecure and knowing when something has occurred that "wasn't right". That's what your IDS is for. Unless you are dealing with a complete zero day that subsequently communicates with the compromised machine in such a way that it won't alert any IDS then you will get some warning. The IDS is there to provide you with the information.... Your subsequent interpretation and investigation will determine your level of "security".

Quote:

---

I like to use the term "managed" instead of "outsourced". Managed firewalls and IDS implementations are a fine choice for a small business and an affordable/trustworthy management team can be found.

---

Managed or outsourced..... Political correctness...... Yawn.... They mean the same thing.... It means you trust someone with your "Crown Jewels". That's fine if all you want is to not become a zombie in a virtual zombie army..... It's worthless if the disclosure of your "secrets" will bring the company down, (regardless of size). Take a deep look into the small print of that "managed" contract..... You'll find that they guarantee _nothing_.... Because they are as smart as you.... they realize that nothing can be truly secure...... Oooops.... They lose the contract..... Oh dear, they made all that nice money right up to the point you went out of business..... They, of course, have other customers still paying them and are still in business when you are looking for a new job..... Works for me..... ;)

Quote:

---

The risk of using a bonded security management company is not much different than trusting the heart of a company to a disgruntled internal IT team member

---

Oh, but it is different..... You know them intimately..... You know where they live and you know that they don't have a contract that exonerates them in case of a breach. If they are the bad boy then you know you can prosecute them... and they know it too.

Bottom line.... manage your own security if you have anything worth protecting.... Trust someone else and you can wave goodbye to security. If your risk assessment says you have risk then you need to appreciate that it costs..... So go out and "buy" an admin who can set you up a perfectly good IDS and general defense strategy that fits with the risk assessment. The money the hardware and software costs is irrelevant at that point..... You _will_ be paying more than $15/hour...... ;)

Tiger Shark:

You respectfully disagree yet you yawn. Interesting.
-
IDS and Firewalls can and often do interact with each other.
-
Making blanket statements without acknowledging that many small businesses need an Internet setup at the office that has a maximum degree protection that they can afford borders on pontification.

What would you have them do? Unplug for good?

Perhaps our perspectives are different but I don't think all or nothing is a reality.
At least not in my world. We work very hard to create a balance of risk and functionality for
small businesses. IDS is often part of that solution. Managed or Outsourced or whatever.
-
Knowing someone intimately? Where they live?
If someone wants to stick their dick in your rear, they will in an instant.
If you sign a crappy contract then you deserve what you get. There are honest contractors
out there and many are worthy of their fees.
-

I appreciate your points but I think there are many degrees of circumstance to consider.
While working toward a security ideal, I am confident there is a middle ground to live in.

IDS are only valuable if you have the staff resources to look after them.

I don't believe that any IDS, no matter how advanced (bear in mind I have no real exposure to commercial solutions), can be entirely maintenance-free.

An IDS is a high-maintenance system. Someone needs to read the alerts and make policy decisions based on them. That person (/ people) need to be sufficiently experienced, knowledgeable and/or resourceful to be able to find out more about alerts and act accordingly.

An incorrectly configured IDS will just swamp any useful intruder info in a sea of false alarms.

There is practically no value in detecting every intrusion attempt, when even a smallish installation sees many thousands of attacks per day, ALMOST ALL of which are a result of win32 worms running on compromised systems. There is no point in attempting to contact the owners of these compromised systems - even if you succeed, it will have minimal impact on the attacks and just waste everybody's time.

If you haven't the resources to keep tabs on them, even if it's only 1/2 day per month, don't bother. No matter what any sleasy salesman will tell you, I don't think there is a maintenance free IDS.

Mark

SS2:

Quote:

---

You respectfully disagree yet you yawn. Interesting.

---

Sorry, the "yawn" was directed at political correctness in general, not at you personally. I'm just getting a bit fed up of political correctness.... A spade is still a spade no matter what you call it.

Quote:

---

IDS and Firewalls can and often do interact with each other.

---

Undoubtledly, but screw it up and you will DoS yourself.... Been there.... :o

Quote:

---

Making blanket statements without acknowledging that many small businesses need an Internet setup at the office that has a maximum degree protection that they can afford borders on pontification.

---

Er.. The risk assessment should dictate the level of protection needed by a company and therefore it's cost. If we are talking about Joe's Bait Supply that has no "secrets" on the network, 4 workstations and no public services then an IDS is not warranted - A simple firewall blocking all external access is all that is really required along with automatic updating of patches immediately they come available and functional AV.

You seem to be treating IDS an an essential item, which it is not. However, if it is warranted then the vast majority of the cost goes towards an admin capable of implementing, managing and interpreting the system. Fail to have that admin and the IDS becomes a nice anchor.

Quote:

---

Knowing someone intimately? Where they live?
If someone wants to stick their dick in your rear, they will in an instant

---

That's a given. But our supervisors see our employees daily. They inform me if they have concerns about any given employee and they go on the "Watch List". I can't see your employees managing my IDS. I have no idea whether they are happy or not and I sure as hell can't monitor their activity..... Even though they have all the information they need to compromise my network. Sorry, but that contravenes the most basic rule of any kind of security - limit access and knowledge to _only_ those who require it. If you have secrets worth keeping then, from a security standpoint, you are better off hiring in a specialist than outsourcing and giving them the "keys".

Quote:

---

If you sign a crappy contract then you deserve what you get. There are honest contractors out there and many are worthy of their fees.

---

Even sending a technical contract to your lawyer does not guarantee that when they say "sign it" that they fully understood some of the technical implications held within it. Frankly, most people that outsource technical stuff do it on the basis of references rather than full comprehension of the contract they sign - and many simply do it on the word of the salesman. Most wouldn't think to have an independent risk assessment done and then act on the recommendations of that contractor. In fact most wouldn't know or understand a risk assessment if it jumped up and slapped them in the face.

Yes, there are honest contractors out there and it sounds like you are one of them. But let's not confuse honest contractors with security. You are in the business to make money. I'm sure if you scrutinized all the contracts you hold and the implementations you have in place you would admit that there are a good proportion of customers who have been "over-sold" your products.... Because you could....

In the final analysis you either have something worth protecting or you don't. If you do then a risk assessment must be carried out. The result of the risk assessment dictates the level of protection required and therefore the cost. If your secrets are of sufficient value to require the use of an IDS then you are better off, in the long run, employing an administrator that can implement, manage and interpret it for themselves.

Quote:

---

Originally posted here by Tiger Shark
[B]SS2:



Sorry, the "yawn" was directed at political correctness in general, not at you personally. I'm just getting a bit fed up of political correctness.... A spade is still a spade no matter what you call it.
Undoubtledly, but screw it up and you will DoS yourself.... Been there.... :o

---

Goes without saying really.
I'm about as far from PC as you can get. I'm afraid my point here was missed.

Quote:

---

Er.. The risk assessment should dictate the level of protection needed by a company and therefore it's cost. If we are talking about Joe's Bait Supply that has no "secrets" on the network, 4 workstations and no public services then an IDS is not warranted - A simple firewall blocking all external access is all that is really required along with automatic updating of patches immediately they come available and functional AV.

You seem to be treating IDS an an essential item, which it is not. However, if it is warranted then the vast majority of the cost goes towards an admin capable of implementing, managing and interpreting the system. Fail to have that admin and the IDS becomes a nice anchor.

---

Wait in your 1st post, you said
"Some form of IDS is absolutely necessary."
I don't remember saying saying anything was essential.

Quote:

---

That's a given. But our supervisors see our employees daily. They inform me if they have concerns about any given employee and they go on the "Watch List". I can't see your employees managing my IDS. I have no idea whether they are happy or not and I sure as hell can't monitor their activity..... Even though they have all the information they need to compromise my network. Sorry, but that contravenes the most basic rule of any kind of security - limit access and knowledge to _only_ those who require it. If you have secrets worth keeping then, from a security standpoint, you are better off hiring in a specialist than outsourcing and giving them the "keys".

---

Limited access can be properly afforded to a contractor.
EXAMPLE:
Northrop Grumman is a contractor I do business with.
They are a very large contractor doing businness with very large companies.
We do work up there in Battlecreek for DLA/DLIS via NG
Although you elude to ma and pa type of work, this is not my main point of reference.
We do however try not to forsake the little guy.
We will do honest business with whomever.

Quote:

---

You are in the business to make money.

---

Yes and if I didn't have to work, I would be in Belize fishing my life away.
While having to work, making money is a motivator. Guilty as charged.

Quote:

---

I'm sure if you scrutinized all the contracts you hold and the implementations you have in place you would admit that there are a good proportion of customers who have been "over-sold" your products.... Because you could....

---

Oh jeeeze, not another contractor cliche...:)
It's a mistake to presume you know me or how I do business.
You often use words like "most".
My turn.
Most government agencies use contracted work. Very few direct hires
Just becuase they are onsite does not mean they are not a contractor

Most large companies use a percentage of contracted IT and that percentage is growing
year to year.

I have a stack of RFPs defining companies dis-satisfaction with their current internal IT staff and are desperate learn of alternatives.
I am not saying and have never said contracting is better or worse, only that it's a reality of my life.

"God" boxes or all-in-one solutions, is the direction the industry is headed. Large acquisitions are being made because the feeling from the remaining vendors is that they can provide you with all of your needs in a "one stop shop" scenario. This personally peeves me but that's another story.

That said, you can easily find yourself in a situation where you have a God box that is really good at blocking connections but is completely terrible when it comes to VPN access. This is normally the result of an acquisition of a middle of the road small VPN company and quickly slapping a well recognized name on the product. I call this the Tommy Boy syndrome. Those who remember the movie will understand the reference. Anyway, it takes time to work out the bugs in the product but meanwhile your entire security solution is wrapped up in this expensive POS.

I do feel that IDS appliances (pure IDS appliances) have a place in the enterprise, but they should be structured to fit a tiered architecture. That is, they are one piece of your entire reporting solution. I like to mix vendors and I certainly don't mind the extra work if the solution is performing up to (or above) my expectations. Others will disagree, but hey, everyone has their preferred methodologies.

What works and what does not: My personal experiences.

IPS appliances that are set to run inline. To me, this is not exactly a nice way to structure an IPS. Most will fail open. Baaaaaaaaaad. Some will allow setting the default to fail closed. Baaaaaaad, if it is a choke point. You either expose yourself to attacks or your entire userbase is cut off from the outside world. Hmmmmm, which is worse? To combat this, we have found a way to protect the network using IPS technologies without disrupting normal processes. Though I can't disclose the details, those who are sharp know that failover and redundancy are certainly in the mix. Yes, we have more than one ISP here. :)

Are IDS/IPS devices hyped? Yes. Just like anything else you see advertised, these devices are pitched to you as the second coming of Christ. Like any reasonable person does when engaged in personal purchases, you learn quickly how to cut through the hype and get right down to the meat and potatoes. Yes, they will produce false positives (though some vendors claim they don't). Yes, they will require upkeep even if the vendor says they "run by themselves".

Bottom line: Network Security is a lot of work, if it weren't, none of us would be here/employed. Don't expect a free lunch because in this industry, the only thing that is free is the awful chochkies you find at trade shows :)

Quote:

---

Limited access can be properly afforded to a contractor.

---

It's not the access that is the issue it's the unfettered access to information about the network and it's resources. In order to do your job you need to see every bit of traffic passing through the network or you aren't doing your job. Just that level of knowledge regarding the architecture and resources on the network is more information than needed to begin to effect a network compromise.

Quote:

---

I would be in Belize fishing my life away

---

Ahh.... Belize.... That was a fun year..... ;)

Quote:

---

Most government agencies use contracted work.

---

And most Government agencies are completely "foxxed" up and have their heads up their ass.... Not a great example mate.... ;) I am also quite well experienced at being asked to fix networks that have been run by contractors for the last 5 years or more. They are utter crap. The contractors do just sufficient to enable the network to function but they also don't document a damned thing. So when you need to make a change to the router you find that the contractor doesn't even know the damned password because it was an employee that has been replaced 3 times that implemented the thing 4 years ago and didn't document it. I'm sorry I don't have a glowing picture of contractors - I have had too much experience with them - I even had the consulting firm that was hired to select me by my current employer fired because they weren't up to snuff..... (Ernst and Young no less..... :rolleyes: )

As far as I am concerned there are plenty of places where contracting is a viable and useful tool for some people. I _am_ saying that contracting security is a no-no if you actually want security. If you have something that needs protecting then you either have to pay for the protection and do it properly or risk losing your business. If you go and contract because it is cheaper, (the usual reason), then you aren't paying proper attention to your risk assessment and you aren't being as secure as you could be simply because you are bringing other entities into the picture. The more complicated you make the issue the less secure it is. Adding a contractor is complicating the issue - there's no way around that.

Quote:

---

Originally posted here by Tiger Shark


And most Government agencies are completely "foxxed" up and have their heads up their ass.... Not a great example mate.... ;)

---

Good points to be sure!!
In fact just today I am killing myself over EDS's joke of security in an image build for a military Intranet workstation....It's ugly.
When I see such folly, I turn it into opportunity.
I'll not give up just yet. I'm not sure the wife will let me...lol

Great debate...I enjoy your posts Tiger Shark

Just a quick injection I'll offer here:

Quote:

---

Undoubtledly, but screw it up and you will DoS yourself.... Been there....

---

As have I. Another important piont to make is that the IDS is useless if your IT staff doesn't master it. I'm speaking as one such IT person who hasn't mastered it, and am hoping to change that in the near future.

Another point: The necessity of having an IDS, or any specific level of security for that matter, is dependant on your situation -- what you have to protect and how important it is. Case in point: my previous employer, the Little Rock Downtown Partnership, was a nonprofit that simply worked as a collaborator between various community entities to facilitate city development. That being the case, they didn't have much of anything that was mission-critical on their network, so security was pretty low, and an IDS would be overkill. Of course, now that I'm gone, they don't even have anyone IT.

However, my current place of employment is one of the leading financial advising firms in this region of the country, so an IDS, I would think, should be of absolute importance (and we don't yet have one, something I'm going to work on). If our network was ever compromised, we would very much be in a heckuva lot of trouble.

So, my case to make in short: the level of security necessary is entirely dependant on the importance/sensitivity of what's being secured.

Ok...that wasn't quite so quick. :D

Quote:

---

So, my case to make in short: the level of security necessary is entirely dependant on the importance/sensitivity of what's being secured.

---

LOL. Also known as risk.

;)

Um...yeah...If you want to say it the "short" way. ;)

Ahhh.... There's Hoss complicating the issue with those big words again.... ;)

Whan you do a risk assessment you are really looking at your assets in terms of dollars. If you are a bank and you release your entire customer records to the world the potential dollar cost is equal to the entire worth of your bank insofar as when all your customers leave and take their money you have no bank. Thus the risk is equal to your entire company value. In this case you would need to spend sufficient money to ensure that the entire customer list doesn't "wander". Now obviously you don't want to spend all the shareholder's profits on securing the system but you do need to spend enough to ensure that your profit is protected, (not necessarily _all_ of it because some will be spent in protecting what's left but certainly enough to ensure that you continue to profit).

Yeah, you know me, I like to really stir up the pot... ;)

You have explained the commercial or capitalist risk model (nicely I might add). Non profit entities (such as Government) assesses risk based on potential damage to the entity or those it serves. Typically, money is replaced with legal liability or political exposure when calculating risk. Well, at least that's how it works in my world.

Hoss:

Yep, the way it works in the non-profit world is based upon the potential for loss of funding by funding sources or a loss of funding when the funding source either pays on a per "customer" basis or is the customers themselves are paying and no customers turn up because your reputation is so badly damaged.