What are Intrusion Detection Systems?

Intrusion Detection System (IDS) are a necessary part of any strategy for enterprise security. What are Intrusion Detection systems? CERIAS, The Center for Education and Research in Information Assurance and Security, defines it this way:

"The purpose of an intrusion detection system (or IDS) is to detect unauthorized access or misuse of a computer system. Intrusion detection systems are kind of like burglar alarms for computers. They sound alarms and sometimes even take corrective action when an intruder or abuser is detected. Many different intrusion detection systems have been developed but the detection schemes generally fall into one of two categories, anomaly detection or misuse detection. Anomaly detectors look for behavior that deviates from normal system use. Misuse detectors look for behavior that matches a known attack scenario. A great deal of time and effort has been invested in intrusion detection, and this list provides links to many sites that discuss some of these efforts"(http://www.cerias.purdue.edu/about/history/coast_resources/intrusion_detection/)

There is a sub-category of intrusion detection systems called network intrusion detection systems (NIDS). These systems monitors packets on the network wire and looks for suspicious activity. Network intrusion detection systems can monitor many computers at a time over a network, while other intrusion detection systems may monitor only one.

Who is breaking into your system?

One common misconception of software hackers is that it is usually people outside your network who break into your systems and cause mayhem. The reality, especially for corporate workers, is that insiders can and usually do cause the majority of security breaches. Insiders often impersonate people with more privileges then themselves to gain access to sensitive information.

How do intruders break into your system?

The simplest and easiest way to break in is to let someone have physical access to a system. Despite the best of efforts, it is often impossible to stop someone once they have physical access to a machine. Also, if someone has an account on a system already, at a low permission level, another way to break in is to use tricks of the trade to be granted higher-level privileges through holes in your system. Finally, there are many ways to gain access to systems even if one is working remotely. Remote intrusion techniques have become harder and more complex to fight.

How does one stop intrusions?

There are several Freeware/shareware Intrusion Detection Systems as well as commercial intrusion detection systems.

Open Source Intrusion Detection Systems

Below are a few of the open source intrusion detection systems:

AIDE (http://sourceforge.net/projects/aide) Self-described as "AIDE (Advanced Intrusion Detection Environment) is a free replacement for Tripwire. It does the same things as the semi-free Tripwire and more. There are other free replacements available so why build a new one? All the other replacements do not achieve the level of Tripwire. And I wanted a program that would exceed the limitations of Tripwire."

File System Saint (http://sourceforge.net/projects/fss) - Self-described as, "File System Saint is a lightweight host-based intrusion detection system with primary focus on speed and ease of use."

Snort (www.snort.org) Self-described as "Snort® is an open source network intrusion prevention and detection system utilizing a rule-driven language, which combines the benefits of signature, protocol and anomaly based inspection methods. With millions of downloads to date, Snort is the most widely deployed intrusion detection and prevention technology worldwide and has become the de facto standard for the industry."

Commercial Intrusion Detection Systems

If you are looking for Commercial Intrusion Detection Systems, here are a few of these as well:

Tripwire (http://www.tripwire.com)

Touch Technology Inc (POLYCENTER Security Intrusion Detector) (http://www.ttinet.com)

Internet Security Systems (Real Secure Server Sensor) (http://www.iss.net)

eEye Digital Security (SecureIIS Web Server Protection) (http://www.eeye.com)

Got Dial Up?

Forget Online Gaming

Computer games have come a long way since electronic checkers and the like. Today, we've got computer games that would put some 21st century movies to shame and interest in online gaming is catching on like some kind of crazy fever. Once dominated by males aged 25 and older, today's gaming generation includes mom, sis, aunt, even grandma and grandpa! If you think you've caught the online gaming bug, and you're thinking about becoming a participant, don't even think you can join in on this online fun using a dial up Internet connection!

Part of the fascination with online gaming lies in its speed. During play, online gaming becomes a virtual world and in order to project a sense of reality into the mix, its games are fast, its movements are smooth, and its sounds are as realistic as we hear them in the natural world. Sitting in front of an online game, and actively participating in one puts the player in another world - a world that's so different, so cool, and so real.

No, we're not talking about a super-fancy version of checkers or backgammon. We're not talking about a visually rich game of tic-tac-toe. We're talking about full-fledged networked or multiplayer gaming that allows anyone to entertain themselves and hoards of others across the world at the same time. Multiplayer games play over online but trust us when we say any old Internet connection won't do.

If you want to get in on this craze, you're going to have to ditch the old dial up connection that you might have and get into broad band. A broadband Internet connection will give you the ability to send and receive highly detailed and realistic imagery at an appropriate speed. It will give you the means to watch videos in real time, and it will allow you to experience speech as if each and every other player were speaking to you directly.

A dial up Internet connection just can't handle this kind of fun, but you can get a broad band connection just as easily. For the techies out there, broadband is a type of data transmission in which a single medium (wire) can carry several channels at once. 1 For the rest of us, broadband is an Internet connection that allows several people to send and receive data at the same time. A dial up connection doesn't do that. A dial up connection can either send or receive - but it certainly can't do both. Let's talk about Broadband ISDN for a minute.

ISDN stands for integrated services digital network and it can transmit transmitting voice, video and data over fiber optic telephone lines at about 64 Kbps (64,000 bits per second).
Most ISDN lines offered by telephone companies give you two lines at once, called B channels. You can use one line for voice and the other for data, or you can use both lines for data to give you data rates of 128 Kbps, three times the data rate provided by today's fastest modems.2

Broadband ISDN - a combination of regular broadband and ISDN can transmit voice, video and data over fiber optic telephone lines at about 1.5 million bits per second (bps). It's a much faster connection than either broadband or ISDN alone! If your ISP offers Broadband ISDN, ask for it - your online gaming adventure will be the better for it.