Hope for intrusion detection

Most security watchers agree that IDSs have yet to garner as many corporate users as the firewall. However, integration trends may break down some barriers to IDS use.

Firewalls not only have been more generally welcomed by enterprise users, but they also have been more eagerly folded into integrated solutions, says Jim Slaby, an analyst with Giga Information Group. "In general, everyone has been adding firewalls to what they are doing, so many stand-alone appliances and gateways do have a basic firewall capability," he says.

There is a much different story attached to IDS on the enterprise use and integration fronts. "IDS is pretty ignored by people, especially those with the impression that once your firewall is up, you are safe," says Chuck Horvat, director of network services at Divine, in Chicago.

The victim not only of this common but often false sense of security, IDS also has suffered extensive enterprise use because it goes a decided step further than firewalls in managing break-ins, says Joel Conover, an analyst with Current Analysis.

"It is one thing to find an intrusion, but another thing to shut off what might be an intrusion," he says. (See Technology Insider: Network-based intrusion-detection systems for related story.)

IDS also requires savvy engineering, Conover continues. "IDS is not a science, it is an art," he says.

Yet, despite these possible barriers to enterprise entry, IDS is indeed on the minds of many corporate IT buyers (see main story).

Hence, the trend toward integrated IDS could spur the technology's use, analysts and users agree.

"Since [IDS] has been around for a while and has gained some maturity, people are not instantly saying no" to solutions that integrate the functions, Conover says. "The challenge to these integration guys will be proving that they can add value and justify the additional cost of an integrated solution."

Technology Insider: Network-based intrusion-detection systems
Our monthlong test of eight products show that setting up IDSes requires a substantial time investment to ensure they'll flag only suspicious traffic and leave everything else alone.
Network World, 06/27/02.

Everything you need to know about IDSes
Network World, 04/08/02.

Put to the test New threats force intrusion-detection vendors to rearm.
Network World, 04/15/02.