More Detection, more! - Part II

By Winn Schwartau
Network World on Security, 05/03/99

The emphasis the security industry has placed on Intrusion Detection/Reaction processes has pretty much concentrated on those detection methods that have already reached some degree of popularity, such as IP sniffing, perimeter penetration detection and host based audit analysis. And that is a good beginning.

Network protection, though, is about a lot more than just seeing if an acne-scarred, Jolt-drinking teenage punk is push-button hacking your front doors. It's a lot more than stopping an ex-KGB intelligence officer from stealing files. We cannot forget two other factors that are so often overlooked when building network security programs:

� The insider, the ex-employee, the disgruntled worker. Think about this for one terrible moment. Which of your staff do you provide the greatest physical access to your most sensitive areas, especially during low population off-hours? Who are the two lowest paid groups of people in your organization? The answers to both questions are the same: Cleaning staff and janitors. It is so much easier to launch attacks when one has both trust and access; technical acuity is not necessary.

� The network itself. Murphy's Law prevails at every turn. Equipment failures that affect network performance. Induced errors, internally or externally. Software glitches. Crash ... sis-boom-bah!

So how can we change our views of Intrusion Detection to accommodate a wider spectrum of reality than mere IP and Internet attacks? Can we look at networks in a different way to help with the insider problem that studies say account for greater than 60% of computer crime?

Read the next few issues and you will find out how much you really may know about your networks but aren't taking into consideration.

Winn Schwartau is a security maven, writer and speaker. His recent book "Time Based Security," creates a new paradigm for measuring and quantifying security in any network. His hit books include "Information Warfare" in all three editions. He owns www.infowar.com, the worlds' biggest site for security and information warfare. His team provides extensive security consulting on three continents. In addition, he is a popular, inventive and exciting speaker a boon to any event. Winn can be reached at winn@infowar.com or (727) 393-6600.