Re: Cisco IDS

[Jason Haar <Jason.Haar () trimble co nz>]

Bamm Visscher wrote:

> I like what Marty and crew is doing with RNA too.  Check out pads [3]
> for a poor man's implementation.  Passive OS and application detection
> (pads calls it passive asset detection) can help put an alert into
> context.  Context is a huge piece of analysis, but often an
> afterthought and/or not included with most commercial implementations.
>
>  
So true! I gave a SANS@Night presentation at the SANS Network Security 
2004 on our company's rollout of Snort over our world-wide network. We 
mainly use it for monitoring our WAN links these days.

One of the main points I tried to make was that getting an alert that 
says "IP 192.168.3.4 appears to be exploiting the DCOM vuln on 1.6.4.5" 
doesn't mean much when:

a> the IS recipient doesn't know what COUNTRY 192.168.3.4 is in (Trimble 
has sites in in >20 countries, and IS staff don't know that sort of 
information off the tops of their heads)
b> the recipient doesn't know details about 192.168.3.4 (like it's 
hostname. Has anyone managed to get Active Directory DDNS working 
anywhere approaching reliably?)
c> the recipient doesn't know who owns that machine, or what business 
group/etc it's owned by

Technical solutions are great - but "a"  can only be answered by 
knowledge of the network infrastructure (i.e. the Networking Group), "b" 
by the Windows group  and "c" by Asset Tracking.

I've written our Alerting system to take the "raw" events out of snort 
(and other sources) and merge them with "a", "b" and "c" that I wrote 
hooks into, so that we now get alerts like "Windows host FRANKY 
(192.168.3.4) in the Paris office (owner: Franky Valley, Marketing) 
appears to be exploiting the DCOM vuln on MARGE". Much more useful :-)

Now I'm waiting for commercial products to offer the same: *integration* 
with existing databases. I don't want 
yet-another-copy-of-sixteen-databases-you'll-have-to-keep-in-sync-via-our-bl**dy-JAVA-app 
- I want *integration*.

</rant> :-)

--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users