Printable View
Jason1977 I had this among the long list of my bookmarks it was written in 2001 I thought it would give you a head start on Ids's.
FAQ: Network Intrusion Detection Systems
I thought the more you read about it the easier it will be on you and other people when the Ids is implemented.Quote:
This FAQ answers simple questions related to detecting intruders who attack systems through the network, especially how such intrusions can be detected
http://www.robertgraham.com/pubs/net...detection.html
Jasom,
One of the best ways to prepare yourself is to run nessus or something similar against the network you are monitoring. Then you go through all of the available data that your existing systems capture and identify the reported activity associated with your own run. If you can't detect the actitivity, then you need to either identify or enable additional logging. Just make sure that you either have the authority, or specific permission to do this. You could ask your boss for an OK, he should at least appreciate your approach. And of course, make sure your making a run from OUTSIDE your network. ;)
Also, if you know, or if you can find out what tools the people performing the test will be using.... well you might be able to put yourself into pretty good shape. ;) If you know the company just check thier website, they may list the spcific tools and methodologies that they use when performing this service.
Good Luck!