Re: IDS users swamped with false alerts

[InfoSec News <isn () c4i org>]

Forwared from: Talisker <talisker () networkintrusion co uk>

I was also at BlackHat Amsterdam when the comments were made regarding
IDS during their "expert" panel discussion.  The experts were
predominantly from the offensive (pentesting) side of the fence and
had little knowledge of the current IDS products.  Yes, IDS do need a
lot of tender loving care to keep them in order, and they can be very
noisy, but the false positive problems are not insurmountable.

That's not to say that an IDS is a security panacea.  Just like a
firewall, it's just another weapon in the security professionals
arsenal that needs maintaining.  All to often security is a secondary
duty given to network administrators, unless it's given the attention
it deserves false positive rates will rise until you can no longer see
the signal for the noise. That's when the users of these tools start
to cry foul, expecting something for nothing.

Someone embarking into IDS should not only have sufficient resources
to manage their new acquisition but also ensure that the product they
choose is suited to their environment.

sorry if this seems like a rant but that's probably what it is.  It's
perhaps not the IDS that's at fault but that the users of them don't
care for them properly.

take care

-andy

http://www.networkintrusion.co.uk

----- Original Message -----
From: "InfoSec News" <isn () c4i org>
To: <isn () attrition org>
Sent: Monday, December 17, 2001 7:29 AM
Subject: [ISN] IDS users swamped with false alerts


> http://www.theregister.co.uk/content/55/23420.html
>
> By John Leyden
> Posted: 14/12/2001 at 18:09 GMT
>
> The number of redundant alarms and false positives generated by
> Intrusion Detection Systems (IDS) has come under fire from users
> attending an event designed to raise awareness about the
> technology.
>
> Users attending an 'ABCs of IDS' event at London's City University
> yesterday said more the 80 per cent of the alerts they received
> were false, with one citing 60 alerts he had received about
> non-existent problems that morning at 0300.
>
> IDS systems, which act as a kind of burglar alarm to for hacker
> attacks, provide "defence in depth" from hack attacks by providing
> alerts about suspicious activity via sensors on a network or host
> machine. The technology is reactive in nature, meaning human
> intervention is needed, because if an IDS system shut off traffic
> or stopped a service automatically this could cause more problems
> than it solves.
>
> Representation from Cisco Systems, Intrusion.com, NFR Security,
> Top Layer and managed services firm proseq at the event conceded
> false alerts and redundant alarms (such as Apache-targeted hacks
> on firm with no such servers) were a serious problem. However
> there was a marked absence of ideas of how about the technology
> could be fine-tuned to minimise the problem, with vendors
> emphasising the fact that systems need to be part of an overall
> security policy, which receives adequate resources.
>
> Part of the problem seems to be that business managers buy IDS
> systems (often on the advice of auditors or consultants) without
> committing to the people and resources needed to make the
> technology work, or having a managed services firm maintain an
> installation.
>
> The concern is that adopters of the technology will fail to
> maintain it or simply leave it to gather dust as overworked admins
> get bombarded with false alarms.
>
> In recent weeks we've spoken to two service providers, COLT
> Telecom and Data Return, who both told us customers request the
> installation of IDS systems in their datacentre but then
> subsequently fail to monitor the alerts generated.
>
> Speaking at a recent Black Hat conference, Nicolas Fischbach,
> senior IP and security engineer at COLT Telecom, said IDS systems
> if hosting environments generate "thousands of alerts but no one
> watches them."
>
> This can generate a false sense of security, he warned.
>
> Users at last night's conference echoed these concerns and one
> summed up the feelings of the meeting by saying "installation of
> IDS systems is only 10 per cent of the solution".
>
> Brian Milnes, general manager in Northern Europe of security tools
> firm Intrusion.com, said buying a IDS systems was like "buying a
> Christmas puppy" because both needed attention.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY
of the mail.