Intrusion Detection Needs a Dose of Prevention

摘要

After the nachi worm hit last year, Joe Granneman, manager of networks and PC services at Rockford Health System, knew it was time for a change. "It only took three infected machines to bring down our dual processor firewall," he marvels. "Without our Internet connection we couldn't process claims or do much of anything." Earlier that year a DoS attack disabled a VPN concentrator. A network IDS (intrusion detection system) detected the attack and sent an alert, but not before frustrated users barraged Granneman by phone calls, whom he calls his most reliable SNMP alert. Monitoring IDS alerts was also taking up more and more of Granneman's time. "I came in early before my meetings every day to check the IDS logs, spent my lunchtime inspecting IDS logs on my notebook from the cafeteria, and dialed in constantly over Christmas because of the terrorist threat. Those logs became my bible."