Intrusion detection is failing: enter intrusion management. (Security).

Intrusion detection systems (IDSs) are a hot topic these days for good reason. The sheer number of threats and intrusions to corporate ITsystems has grown phenomenally in the past few years--along with the sophistication of attacks that security managers are experiencing.

What is causing this growth in unlawful intrusions? In a large part the Internet has opened the door by increasing business connectivity. This includes exposure to external business and non-business entities. This exposure has been magnified by recent world events that have increased the threat from terrorists and industrial spies, not to mention electronic vandals and thieves. As a result, companies across the globe are experiencing security events such as attacks, intrusions, and policy violations on a scale never seen before. Businesses are scrambling to prevent attacks and intrusions wherever possible while they monitor, manage and attempt to respond to critical security events across the enterprise. Much of that effort has focused on purchasing and deploying network-based intrusion detection products, but with generally unsatisfactory results.

What's so wrong with current IDS technologies?

Security events, and other information from numerous point products such as network-based intrusion detection systems, firewalls, and anti- virus products are overwhelming security managers and intrusion analysts. These point products also often fall to highlight the relationship of different registered events emanating from the same attack or policy violation. This has caused information overload and a lack of business value from current intrusion detection systems, compounded by an overall shortage of qualified personnel to monitor and respond to events.

It seems that while there are many IDS products available, many implementations have failed because there is a belief that it is these products alone that can solve the problem. In struggling to properly monitor their security environments, companies are beginning to realise that there must be a better way, and this belief has evolved into a concept called "intrusion management".

What's so right about Intrusion Management?

Pinkesh Shah, at PentaSafe Security Technologies, says of the move away from traditional IDS to the new concept of intrusion management, IDS must evolve beyond its point product tradition and encompass a new level of management capabilities.

Companies have to focus on managing events, correlating them, and responding to them in real time.

To put it bluntly-to manage risk in real time requires intrusion management. Giga Information Group defines the intrusion management process as incorporating several key areas:

Vulnerability management -- The ability to understand to what an organisation is vulnerable and how these vulnerabilities would impact the business if they were exploited.

Intrusion detection -- The process of identifying security incidents at specific points (e.g., network, host, application) in the enterprise.

Security event management -- The ability to consolidate multiple sources of security incidents (e.g., firewall logs, host-based intrusion detection systems (XDS), network-based IDS, application logs, etc.) and relate security events together to identify the impact/scope of a security incident on business operations.

Incident response -- The process of successfully responding to an incident whether the objective is to solely recover or bring the perpetrators to prosecution. To get the most out of security technologies and effectively manage risk in real-time, businesses need to integrate distinct security processes and technologies in a way that has not been achieved before. An effective intrusion management solution combines security event detection, event management, incident response and other technologies and processes to achieve measurable and practical real-time risk management. A look at each of these key points in turn shows how they form a vital link in the intrusion management process.

Vulnerability Management

Many businesses have deployed security technologies without properly understanding their vulnerabilities. Establishing a vulnerability management process facilitates successful intrusion management by enabling organisations to prioritise their security monitoring and incident response. Knowledge of vulnerabilities such as software defects (i.e., bugs) and configuration flaws helps security professionals determine the attacks to which they should be most sensitive. This knowledge helps plan the deployment of a successful intrusion management solution by focusing on those areas that are most vulnerable.

Intrusion Detection

Security event detection technologies must start to identify more than just attacks and intrusions - the traditional domain of intrusion detection systems that often rely on specific signatures for detection. Security event detection technologies must also identify precursors of attacks such as port scans, network browsing, and web site crawling. They need to identify policy violations such as configuration changes that deviate from security standards and user breaches of acceptable use policies. Successful intrusion management must rely on the detection of more than just attacks and intrusions. While these are very important events, intrusion management technologies and processes have to begin making sense of large volumes of information and using this information to highlight only those events or combination of events that are relevant to the organisation's security posture.

Security Event Management

To effectively manage risks from intrusions the management of events must play a much larger role than in the past. Here are the policies and processes that, must be put in place for successful security event management:

Enterprise security event collection - The event management system must be able to collect events from numerous disparate technologies including security and network devices, business applications, infrastructure components and more.

Data normalisation - The event management system must also parse and normalise event data. That means certain pieces of information must be gleaned from each event and inserted into specific fields in an event database.

Event correlation - Security event correlation is the process of relating several distinct security events that emanate from the same attack and is vital to reducing the number of events that must be handled by an intrusion analyst.

Alerting and Automation - Security event management technologies must provide flexible alerting mechanisms and be able to automate responses to events.

Incident Response

intrusion management must include responding to attacks, intrusions, and policy violations. To accomplish this, an effective intrusion management solution must provide tools that enable an easy and effective response to critical events. Traditionally, event management systems have provided no ability to take action in response to an event. However, incident response capabilities are becoming more critical as quicker resolution of security events is needed. Only systems that provide integration of multiple tools for active incident response will be able to provide true intrusion management-

The evolution of intrusion detection

Intrusion management is a necessary next step in the evolution of intrusion detection technologies. Intrusion management solutions enable businesses to get more value from their current IDS investments and other security technologies. Most importantly, intrusion management turns intrusion detection into a management discipline that goes beyond detection and logging to allow security professionals to manage and respond to attacks, intrusions and policy violations more efficiently and effectively.

Intrusion management in the real world

While intrusion management is something that undoubtedly looks good on paper, is it actually something that can work in the real world? The answer is most definitely yes. The first intrusion management system has already been developed and is successfully working in businesses around the world. PentaSafels VigilEnt Intrusion Manager (VIM), is the first enterprise intrusion management solution on the market. True to the intrusion management principles, it manages security risk in real-time, enabling organisations to manage high-volume security events, analyse logs and respond to intrusions. www.pentasafe.com.