More Detection, more! - Part III

Beyond the high profile, stock market crazy IP perimeter scanning approaches to intrusion detection that fills the press wires there are plenty of other ways to significantly increase the sensitivity of your network protection.

System/Network Diagnostics Large networks utilize an assortment of network monitoring tools already; it's part of the administrative job. When a network gets overloaded, from either extra-heavy traffic or a malfunction that causes bottlenecks, a network monitor detects that event. The administrator can then respond in whatever manner is appropriate.

However, these types of events are generally viewed as network management functions, not security problems. We should invite network performance and diagnostic monitors to complement other security focused detection methods in gathering a more complete picture of the network. Then, when the monitor detects some abnormal behavior, the detection mechanism should drive the reaction channel, so that security can assist in determining whether the event was an operational anomaly or an attack.

Monitoring tools are effective at identifying software at nodes in the network and are often used for copyright/license compliance. However, the same mechanisms are applicable for identification of miscreant software at the user's workstation. Likely, you don't want users to have IP sniffing software, steganographic tools, their own encryption software tools or any of a range of hacker tools. By sweeping across your internal networks periodically you can identify those software components that violate your corporate policy.

Winn Schwartau is a security maven, writer and speaker. His recent book "Time Based Security," creates a new paradigm for measuring and quantifying security in any network. His hit books include "Information Warfare" in all three editions. He owns www.infowar.com, the worlds' biggest site for security and information warfare. His team provides extensive security consulting on three continents. In addition, he is a popular, inventive and exciting speaker a boon to any event. Winn can be reached at winn@infowar.com or (727) 393-6600.

RELATED LINKS