Slashdot Mirror
Snort up For Revamp, says Creator
A reader writes:"The creator of Snort, the open-source network-based Intrusion Detection System (IDS), says the software is up for an overhaul. Martin Roesch has told the AusCERT conference IDS has failed to impress the market, citing the inability of many to minimise the number of false alarms triggered by the monitoring devices. The next iteration will include "passive discovery" features."
I used snort on an IPCOP box. Worked ok for me.
not meant as a joke but i think it could also have to do with the psychological fact that Snort just sounds like something you want to distance yourself from. I wouldn't associate myself with a program called mucus-mouth no matter how good it was.
While this would be cool, the nature of TCP/IP says that it will be quickly defeated. There are already programs out there that will make your Linux box masquerade as another type of computer.
If a policy says, thou shalt not run P2P - then the P2P will be reached through proxy. If you use snort regular expression detection (one of the coolest features) then new protocols will be written to look like an innocuous service (P2P though ICMP/Ping).
The worst part, and my buddy Zero Hex could talk about this forever, is when ISPs start using this to enforce their will on users. Thou shalt not connect without Windows.
Basically, it's not likely to enforce policies among those who actively want to get around them. Instead, it will enforce policies that push an agenda.
Kinetic stupidity has a new brand leader: Allen Zadr.
http://cvs.openbsd.org/faq/pf/filter.html#osfp
vodka, straight up, thank you!
Too many features might really mean to many false alerts (logs or mysql tables can get pretty crowded). But in any case it's usable to detect default signatures of attacks pretty well.
Should be used? Yes, except some functions should be disabled
Should be remodeled? Yes
It has the same flaw as port scan attack detectors.
Signature Pro version 1.13.2-3 release 83.5 beta3try7 after-breakfast edition
the problem with IDS systems is encrypted traffic
if someone wants to attack your network, they can easily implement proxy which will encrypt all the traffic they transfer and thus disabling the IDS's ability to analyze the traffic
There are no atheists when recovering from tape backup.
Some of what Martin says regarding minimizing false positives by correlating an attack with the correct platform, etc. is already being done by the open source IDS correlation project QuidScore:
http://quidscor.sourceforge.net/
a way to improve this might be to take principles from the advanced diagnostics industry. There were a lot of false alarm rates with diagnostics for many years but now it is pretty well nailed down. They use some advanced methods to do diagnostics now. From the way monitors are used to the types of algorthyms.
I know I can't spell. That's why I am an engineer.
Evolution or ID?
I've heard these guys are very talkative, fidgety, and always have nose bleeds. I wouldn't trust any business with them.
That's dumb. If I encrpyt an IIS attack, it won't help me at all. Services aren't vulnerable to attacks they can't "understand".
"...If the new software detects an Apache server running on Linux, it will only look for attacks relevant to that configuration, instead of monitoring the device for an attack that would affect a Cisco router or Windows server..."
This have 2 serious drawbacks:
1. If someone is trying to brute-force attack your servers sending probes for every known exploit (aka. nessus), disabling alarms for software/services you don't run will not show the real size of the attack.
2. In case of an infection similar to code red you won't be able to know wich infected servers are "attacking" you, so there is no way to block them in the router, firewall or reporting the virus-generated traffic to their ISP.
It's fast, it's friendly, and it's fun!
Mirror Here.
8 of 13 people found this answer helpful. Did you?
The idea is to take a policy like 'thou shalt not run OS X on the network,' and then if someone with a Mac plugs into our network... it can tell the firewall to [block them]," he said.
If this Comes To Pass, all someone will have to do is fire-up snort on you network (custom knoppix cd anyone?) with a policy to not allow any MS products on the network, and *poof*! Instant, internally-generated DOS!
For the uninitiated, IPS stands for Intrusion Prevention System. What's the main difference?
#1) IDS doesn't block bad traffic. IPS does. #2) IPS handles anomaly variants, IDS doesn't.
IPS is a new technological way of filtering traffic over the simple brain-dead IDS method.
You need to visit many of Tippingpoint's white papers to get the grift. (registration req. Just fake your email... I know, this is not an official endorsement, but I used to write IPS filters for them and my working real world experience shows that this IPS filter is more effective than any of Snort's filter.)
I would love to write more IPS variant-resistant filters for SNORT but I'm afraid to tread on TPTI's handiwork (much less if I step on the same filter). Nonetheless, the defense industry picked me up. Go figure.
IDS is truly dead. Stop beating a dead horse. Get over it, bud. IPS is your savior.
I use Snort all the time. The only thing I really get false positives for in great numbers are portscans, but even that is easily tweakable in the config file. I'd rather see one too many security alerts than one too few.
this sig limit is too small to put anything good h
Roesch works within Sourcefire (which puts a lot of development into Snort) as their lead engineer. I've talked with him over a teleconference call and I got the feeling that he loves working with the technology and tries to avoid the sales side of business. Also discussed during the conference call was exactly what this article pertains to.
If Sourcefire's engineering puts out something like this and not their sales reps, then this is really close to being reality. Take a look at Sourcefire's website, you'll see something called RNA. RNA can do passive monitoring of a network and find what machines do what, and what they are running. I've worked with RNA on a production network - it does as advertised very well and even determines patch levels of some machines just by sniffing network traffic. It doesn't take a rocket scientist to put 2-and-2 together that Snort and RNA are on a collision course to work together considering they are from the same company. I would expect something before the end of the year.
RNA though isn't open source, so I'm curious to this announcement if the underlying engine to that product will eventually be opened up.
That's a poignant song. It's calamitous how much 21st Century Americans can learn from the mistakes of 20th Century Germans. But what does that have to do with snorting?
--
make install -not war
I don't agree with your but but I have a but of my own.
I don't think the features need to be removed. THey need a system to get them to work together. That is one way to reduce false alarms. If the overall system knows how everything interacts. The monitors that is and it makes the determinations. Then when a problem is found it takes the information, diagnoses the problem and lets you know. It's the level and way it is done.
I think it needs a revamp. But not in the same way many have thought of.
Evolution or ID?
But what does that have to do with snorting?
Clearly, he was on coke when he posted it.
"Why Subscribe?" Good question...
The OSS app known as Hank was pretty much written as a reponse to the short-comings of Snort.
It supports XML based network rules, and has really advanced things like an ACBM implementation
Sunny Dubey
If you knew anything about IDS you would realize that the "commercial equivalants" all use OSS ( tcpdump)as their base engine.
But then you would not be a slashdot regular if you knew anything!
Most IDS vendors focus on ever more accurate alerts, but once they trigger they wash their hands of the problem. The end user must decide if the alert is truly significant to their situation and priorities. It's like having an anti-virus product cry wolf but never give any reasons for its identification of malware or background on its findings.
An alternative to the "alert-centric" point of view is "Network Security Monitoring," which concentrates on giving analysts information to conduct at least rudimentary network-based investigation. Where most IDS care only about alerts, NSM-centric operations combine alert, session, full-content, and statistical data to give analysts a chance to identify and escalate incidents.
A tool which uses Snort to generate alert data, combined with session and full content data from other sources, is Sguil.
The April 2004 Sys Admin magazine features Sguil and a few other NSM tools.
A book due in July, The Tao of Network Security Monitoring (also at Amazon.com) is all about NSM.
Anything vendors can do, like Sourcefire's work with Snort, helps with more accurate identification. Just remember creating alerts is only the first step.
All of the IPS fans out there should remember that their "prevention" depends on correctly identifying intrusions. All IDS and IPS products can be bypassed, which drives the need for audit-centric tools (especially using session data) which are content neutral and don't care about triggers, encryption, and so on.
Helevius
Then again, maybe the government doesn't have enough money for the better-quality commercial IDS.
No lie they are making shirts that say this
"From the Guys that brought you snort now bring you speed"
Aren't passive IDS capabilities one of the things Ron Gula left Enterasys to explore on his own?
The poster of the story could have titled it something like "Time for Snort to revamp" or something, but did they have to say "Snort Up for Revamp"?
Oooh. Someone (prol'y from the IDS industry) has to be rather sore to hear the word "IDS is dead."
Cheap shot to modding me down.
Could this revamp be due to pressure from companies which have built commercial offerings on Snort? Guardent's SDA tool is basically a Snort box, x86 linux on commodity hardware. How many other money-making ventures out there depend on Snort, and what influence do they have over the Marty?
I want to delete my account but Slashdot doesn't allow it.
If you are interested, read more about how Swatch and syslog are used in a large production environment.
Hulk SMASH Celiac Disease
"The idea is to take a policy like 'thou shalt not run OS X on the network,' and then if someone with a Mac plugs into our network... it can tell the firewall to [block them],"
With the IDS technology lagging today, several IPS vendors stepped in with several technological enhancement toward IDS.
But the key issue confronting the IDS industry today is the lack of functional cohesion (or double-speak for functional capabilities working together).
Some of the basic building blocks of network-based inline IPS feature set that is needed to work together perfectly are:
1. Host-OS-based anomaly decision. Both passive and active scan are recommended to be default on.
2. Deep high-speed REGEX support. Some REGEX chip market didn't materialized as robustly as they should (SafeNet/Raqia)
3. Large-scale TCP connection tracking. This has to work at high-speed as well. Goes to protect against DoS, unwarranted connections and terminations of a pattern-hits' connection.
4. Anchored, unanchored and floating pattern match hardware-assist are needed to work together to cover the variety of algorithms set forth today. This would be a current "1000-watt" hardware issue.
5. Basic issue of quick sub-millisecond table update of content-search memory remains undauntedly elusive. Most H/W content-search engine requires intensive compilation of fancy tr[e|i]e algorithms floating around.
How about weaning yourself of SNORT and start coalescing these incoherent IDS functional cohesions into an IPS?
I fear that when attackers learn to make heavy use of triggering massive false positives, crypto & steanography, protocol-tunneling and start to build exploit-engines producing polymorphic code the days of pattern matching IDS are count. Maybe anomaly-detection (using statistics or neural networks) will help.
Just my 2ct. /graf0z
OK, you got your cheap shot at OSS in, please:
1. collect your bonus
2. get back to work, Microsoftie!
How does an XML-based network rule scheme fix anything? I see that as just complicating an already complicated situation.
Haha. I wonder if this whole thing has ANYTHING to do with this?
http://www.phrack.org/unoffical/p62/p62-0x0d.txt
Sad part is, I just got the call 5 minutes ago saying that I didn't get the job. :-(
* (Analysis Console for Intrusion Databases)
If I was the CTO of a company and I didn't want or was instruct to not let employees use IM programs. I would make very simply rules that blocked the traffic, which would take care of 99% of the non creative people. If I went to the next step of checking for IM content on port 80 I wouldn't block the traffic instead I would log it. After they talked to HR and understood that we didn't want IM on ANY port I imagine they would be uninstalling AIM. If not, I asure you the next time someone else would be doing it for them.
Unless our technology becomes more inteligent than humans there will always be a human aspect to security.
Nick Powers
Encryption: I may not agree with what you say, but I will defend your right to encrypt it...
I like the idea of Sourcefire's RNA product ("Realtime Network Awareness"). The idea is that it will use passive os fingerprinting to find out what's out there, and tap a database of vulnerabilities to see if there's a serious problem.
But I want the other alerts - the cmd.exe attempts on Apache servers, etc. - as correlation for the other alerts. I agree there's a huge value in separating the stuff that's merely for correlating with the serious alerts.
You can set an alert level = harmless just to get the packet recorded with a self-documenting tag. You can also pick action = "log", rather than "alert". Snort will store the packet, but won't put it in with the alerts. Sometimes lots of rules are required to give you what you want.
I'm toying with the idea of alerting on ftp control sessions, with a big "Harmless: ftp control session established" message. The idea is to have a flag that will explain those weird ephemeral port -> ephemeral port alerts that show up. Passive ftp should go client ephem port to server port 20, imho, but the RFC doesn't seem to require it and most implementations don't do it.
We ended up putting together a little access db that we could generate rules for snort based on critieria like port, os, etc. Eventually we turned this into the first Snort rules site snort.rapidnet.com which is now down. I would imagine that any problems someone might have with Snort (or other IDS) is the correct config for a given scenario or situation.
You have to give props to guys like Marty who make a really great, free product that the little guys can use to conduct homegrown (not homeland) security.
Great ideas often receive violent opposition from mediocre minds. - Albert Einstein
The real problem with Snort, and this is coming from someone that has administrated Snort systems in two major companies, is management's lack of understanding that it takes labor to maintain these systems. They want something that they can just pay for up front and will work with no additional tuning or labor costs.
This is the true failing of Snort and other IDS systems as well. They require labor to tune the ruleset and configuration to a network. They require constant updates and someone that can create signatures on the fly. They require someone that has a knowledge of TCP/IP protocols, routing, networking and the ability to analyze data and follow leads.
Working with Snort is kind of like being a detective. The alerts are clues and you have to dig through a lot of other logs, traceroutes, whois, calling people on the phone and find out what they are doing, etc. It's all labor intensive and no one in management wants to dedicate the resources necessary to make it really work.
I could spend all day working on Snort, but I have to monitor firewalls, email, viruses, go to meetings, train people and type on slashdot once in a while. And IPS is no different, it is not something you can just put in and leave forever and feel safe.
Management needs to realize they need people on site to deal with the New World Order of constant hacking attempts. IDS admins are jobs needing to be filled, that's why Snort is not living up to the "promise". Management somehow twisted the promise of Intrusion Detection into some automaticlly, always upgraded intrusion prevention system that requires no labor, no upkeep and you never have to spend any more on it. They continue to live in a fantasy world and one day will end up hacked even though they got a raise for cutting their security budgets by 25% for the year.
Why isn't IM hit by DCMA or some other US regulations ?
The apply different techniques to circumvent company firewalls, and whatever else is needed to no comply to company policies. And the suppliers does all they can to make it impossible to block. I.e. placing servers on different subnets where they also place other servers that people needs access to for other reasons.
I think something should be done to kill this plague.
Even the SANS GAIC GCIA (Intrusion Analyst) certification is try to evolve to meet this new IPS technology, but until TPTI releases the ability to let end-user customized filters, the certification would be essentially worthless. Just too many IPS technological-curves for the ordinary IA guys to keep up. Really!
It is tantamount to handing the wheel to a Formula 500 car over to a 15 1/2 year old testosterone-laden lad without supervision. This isn't your grandfather's car anymore. Its a whole new whole world of Intrusion Analysis out there.
Tee-hee.
Bammkkkk,
IDS and FW has already tied for 2004 Darwinism Award for not applying the Moore's Law consistently toward themselves. They simply fell off the chart and has not been able to hold a lighted candle toward IPS.
TPTI cooked and delivered IPS in 2001-2002. (You say IDS vendors gathered in just in 2003, sheesh... no wonder, its a response to the surprise evolutionary newcomer, IPS)
IDS and Layer 4-7 Firewall deftly merged together along with many more HW-based analysis algorithms to become a true inline IPS (or more correctly, NIPS).
Layer 4-7 firewall has its limitation with how many content filters such a firewall could do before it becomes CPU-bound. Small-scale HW-bound FW (i.e., Netscreen) tends to overheat (and thus may probably demand cooling fans, and maybe later cryogenic cooling?) when you start piling up memories to hold more than a couple hundred unanchored/floating content search patterns. (Hence, our "1000-watt" hardware problem.) TPTI handles at least an advertised 1800 working filters (but their signature database and hardware capacity is far much bigger and my TPTI employment NDA requires that this be left unstated).
One of many IDSes' limitation was with lack of multiple state tracking algorithms, particularly the multi-layer state tracking tables (i.e., cookie state over HTTP state over 5-tuple state). Try doing that at 5 Gigabits per seconds.
So, fork or no fork, no marketing angle was needed to tout IPS. It was evolutionary and natural.
As to your assertion that IPS failed? Recheck various conferences on this (RSA, MilCom...). IPS is off to a roaring start since 2001 and doubling each year.
Just an appropriate application and merger of new technologies justified such a new moniker: Prevention as in Intrusion Prevention System.
Let me rephase my first post's statement:
IDS/FW is truly dead. Stop beating a dead horse. Get over it, bud. IPS is your savior.
One CTO at a well-know Maryland-based HIDS company stated to me personally that it is impossible to attain 0% false-positives. I agreed totally on this point BUT...
Would the customer settled for something like one minus dot 9 nines? (0.0000001%)?
Bammkkkk said:
TPTI (and many other IPS and IDS) is restraining themselves from stating 0% false positives because it is tantamount to false advertising. But this would be purty darn good, wouldn't it?
Now, TPTI (IPS) customers aren't complaining on this issues at all, AFAICT. I wonder why IDS customers are still complaining?
I've got one possible answer... It must be a Trade Secret.
whinge, whinge,
* too many false positives, then tune your sensors - but then again _YOU_ will have to know and understand your network and its traffic.
* requires too much time/labor/knowledge to use/setup/maintain - since when did the security industry stay static, or more likely since when did the otherside put their feet up and say, "enough is enough", we have created enough virii/worms/ddos apps/exploits...
LOL, 'greyfeld' had it right in the last paragraph. Spend some money on Security you tight-fisted sods and stop bleating about how it hurts your budget so much - or your job will be on the line not mine; when the site is hacked and the customer databases are ripped, sales figures erased, and the backups failed (as they always do).
I use (daily) a few of the top commercial IDS/IPS apps depending on the customer, and snort is still a favorite for what it is.
So to get a feel on how ppl are comparing this to other IDS/IPS apps, a few questions;
Q1. So how much money was invested in the latest McAfee IPS, and how much was that compared to the latest version of Snort?
Q2. How many IDS/IPS style companies did snort.org take over in the last few months compared to Cisco.com?
Moh.
If you're not familiar with XML or XSLT then I guess the benefits might be hard to see.
Wow! Did you hear that? That's the sound of a million open source coders throwing down their keyboards in defeat in the face of your biting criticism.
:
Seriously, I'm wondering which of the following statements best describes your knowledge of IDSs and the security industry in general. Is it
a) I am well versed in the various IDS/IPS products on the market, both commercial and open source. I am aware that Snort is fairly well respected, that several commercial products are based on it and that none of the products on the market are anywhere fuckin' near perfect.
b) I know fuck all. I live with my parents surrounded by a pile of semi-functional, worm ridden Windows boxes running pirated Anti-Virus software (that expired 6 months ago). My main ambitions in life are to create the smuggest, whiniest post ever to appear on Slashdot and to learn how to suck my own dick. My greatest fear is that when I finally succeed in the above, I will choke to death on it and photos from my autopsy will spread through the binary newsgroups faster than the latest Windows worm, to mass hilarity.
So which is it Mumbles? Why don't you post the same shit in the next Apache story? It will be taken just as seriously.
The idea of IPS is to largely minimizing the Network Security Monitoring aspect and the bloated payrolls for those CISSP (and sorry, GAIC GCIA) guys.
Blocking would-be successful attack is the paramount goal of a basic first-generation IPS. An admin won't even get paged for these events (and along a whole lot of other false-alarm and much less false-positive events, but in the rare case that they are feeling idle, they can even turn that pager-feature on). Why bothered, IPS did its job.
TPTI does capture packets of events in libpcap v2.4 format. Pick it up the PCAP file with your web browser.
TPTI assertion is that when you drop positively-identified sessions, there is no need to fill up your alarm tables with worthless glaringly eye-candies on the monitoring screen (but they will log it nonetheless and the log table listings are mouse-click multi-key sortable at all/any table columns.)
Knock on the door? Who cares, ignore it. Paranoid of your rattling doorknobs? Subsequentially drop them from the specific source indefinitely. Port-scan? Want to block them? Go right ahead. Only for a couple of hours, sure. Ignores those ISS and BlackIce's AOL Instant Messaging's frequent false alarm of FTP port-scanning, yep.
My assertion is no one needs IDS and their full datacenter-sized staff monitoring anymore. Start dropping those attack sessions. Prevent it from ever happening in the first place.
No more support calls to your IDS. No more frequent IDS field support technician visiting your plants.
You should only get REAL ATTACK alert. Not the "I Dunno, Sir (IDS)" nor "I think this may or may not be an attack" alarm event.
No wonder, IDS industry are being transplanted by IPS.
The language is beneath the threshold. Some*** moderate this.
Do I really need to dig up stories on slashdot where some airforce computer has been hacked into to at least prove that the AF has no particular monopoly on security or smart tech decisions?
In the future, please refrain from beginning article titles with the words "snort up". Where I come from, they call that "the old bait & switch".
MSIE: The world's most standards-complaint web browser.
Snort up For Revamp, says Creator
Well shit. If GOD is telling us to do it, how can we possibly condone laws against it?
Snort up for revamp? Hell, I snort up for breakfast.
This sig is part of your complete breakfast.
There is Prevention, Monitoring and Response in that order. Each stage incurs a tremendous cost-fold as an event progresses each stage. Nip this at the bud where is should be and that is Prevention.
NIPS products are not easily bypassed compared to their heathen-breathen (IDS, NSM, FW) due to their in-line "bump-in-the-wire" characteristics. One IPS vendor's ability to detect encrypted sessions data are the envy of the IPS industry. Another tracks unidentified protocols (by the use of known-protocol filter). Government loves these features.
My take on false positive is stated earlier in this Slashdot post.
The real 1st-generation IPS goal is to reduce event-logging, absolute control of malicious traffic (i.e., trojan, DoS) and operational cost-saving across the board.
The 2nd-generation IPS will emcompass the viral checking of various payload as well as additional firmware-based algorithm for high-speed checking.
NSM is still riding the IPS coattail from afar. Go where the real technological and cost-saving lead is: Prevention as in IPS.
One leading IPS vendor, Tippingpoint.com, can actually catch a specific protocol across any ports, such as eDonkey, Gnutella, KaZaA, Sharaza.
University love these IPS products as a form of bandwidth saving measure.
The unit usually pays for it own cost in form of bandwidth reduction (or avoidance of shelling out $$$ for additional bandwidth) in less than a year (or two).
Oh, it also blocks those pesky HTTP tunneling proxy that student uses to defeat cheaper and less effective IDS vendors.
Not to mention blocking about-to-be-successful trojan sessions. And many protections against many software vulnerabilities (ie. Code Red, Sache, BugBear...)
... I've snorted up Mr Creator, where's my revamp? Let's do lunch!
Son, we live in a world that has walls, and those walls have to be guarded by men with software. Whose gonna do it? You? You, HR? I have more responsibility here than you could possibly fathom. You weep for payroll, and you curse the admins. You have that luxury. You have the luxury of not knowing what I know. That the cost of manpower, while costly, probably saved money. And that my existence, while grotesque and incomprehensible to you, saves money. I know deep down in places you dont talk about at parties, you don't want me on that wall, you need me on that wall.
Sorry, why didn't you say that this was an I_P_S (Instant Protection System)? Guaranteed to stop 100% of all attacks. I didn't realize that by putting an I_P_S on my network, that no longer would I need to patch any of my systems, audit them for vunlerabilities, etc. Long live service pack 1! Woooo hoooo! No more worrying about systems running legacy applications that can't be upgraded! Users getting trojan via instant messanging applications? Not a problem! I can't wait to tell the board. Risk? We have no risk! Not with our Instant Protection System in place. The threat is ZERO!! We CAN NOT be compromised!! Eat my dust you l33t hax0rs!!
Excuse me while I go back to the real world. With a real network. With real users. And real security problems. Prevention will NEVER be 100%. So you either suck it up and ingore the possibility of a compromise or you inuclude monitoring. I choose prevention+monitoring.
Bammkkkk
www.sguil.net
The Analyst Console for NSM
First off, my presentation was about making the case for Passive Network Discovery Systems (PNDS), a "new" technology that I created over at Sourcefire. The basic idea of a PNDS is to discover the composition and topology of your network via a mix of passive OS fingerprinting and passive application layer protocol discovery and the other information that you can infer from that data, such as network topology and asset vulnerabilities. I sought to show how that technology could improve a variety of network security technologies by using the example of how Snort (and other IDS) works today and how it could be improved by integrating the information that comes from a PNDS.
Sourcefire has developed a product called RNA that performs the PNDS functions that I outlined during my talk. Note that it is a proprietary technology that we developed commercially and it is a completely separate product from Snort or the Sourcefire IDS sensors. We are not going to be integrating the functionality of RNA into Snort, we're going to be modifying Snort to take advantage of the information that a system like RNA can generate. In the best case scenario, RNA has a very different deployment profile than an IDS.
I said that IDS has had trouble in the market because of its complexity and the requirement that users perform extensive tuning of IDSes in general in order to get maximum benefit from them. There are a lot of things that factor into this problem, but the root cause of almost all IDS problems today is that we don't have automated methods for provisioning them nor do we have effective methods of data reduction available that are automated, persistent and real-time. PNDS addresses that problem head on in a way that is appropriate for real-time processes like IDS in ways that traditional scanning technologies have a very tough time providing.
I then went on to say that we're planning on making changes to Snort to enable it to leverage the information that a system like RNA provides and make it into a true target-based IDS, redefining how IDS operates and hopefully revitalizing it as a technology. Snort will still be available for free and will still operate in "classic" mode where it doesn't leverage this info for people who don't have passive discovery technologies (or even active ones) so that they can still continue to use it.
Snort is not going to be doing the configuration policy enforcement (i.e. the "block OS X on my network" function), RNA is. RNA is capable of seeing devices on the network and discovering their attributes in real-time and communicating that data to our management console where it can be analyzed for policy compliance and where appropriate remediation responses can be executed. Not to get too deep into the marketing, but there are good engineering reasons for wanting to do this that include worm/virus containment, real-time IDS policy updates and some other really useful mechanisms for performing policy enforcement.
We're making mods to Snort because we believe that we can make a truly next-generation IDS capability that is easier to deploy, manage and get valuable information out of due to the effect of RNA. This approach directly addresses all the arguments of the "IDS is dead" crowd while at the same time making IDS a much more impactful technology while greatly reducing the overhead requirements on users.
I hope this clears things up for people!
Once again, with feeling:
IDS is a network monitoring technology
IPS is anaccess control technology
We use IDS to let us know what's happening on our networks, how our policy is being enforced by our access control mechanisms and when there are security failures.
We use IPS to "shoot down" attacks that are in flight before they can complete and affect the target.
Confusing the two is the name of the game for IPS vendors because the FW vendors have deep pockets and the IPS guys didn't want to rock the boat at first. In-line network IPS is only useful as long as you have time to provision new detection signatures before attacks/worms come out, they are deterministic and therefore have a very tough time dealing with the unknown (and yes, I know they have the ability to do rate-based blocking in some cases, that's deterministic too). The natural progression for IPS technology is as a feature on a firewall, not as a stand alone independent product, it's just an enhancement to access control technology after all. The natural progression of IDS will remain as a stand alone product or perhaps it will disappear into the infrastructure of the network itself (e.g. switches), but it is going to be a necessity as long as people need to have visibility into what's happening outside the purview of their access control technologies. In-line network IPS only watches/defends your peering points, NIDS monitors everything if deployed properly.
To claim that IDS is "dead" is to basically say that people should put on blinders and only watch the peering points, not a very realistic proposition in my opinion. IPS is not a replacement for IDS, those who say so either don't understand the role of IDS or they're selling something.
"snort up for revamp," says creator. What ever you say lord, I could do with a topup! =)
Why can I not mod a message to crap?!?
Bammkkkk,
Ok, ok... I'll suck it up. I, personally, wouldn't go without monitoring myself either.
So, I do agree with you wholely on all your points.
Could you at least agree that prevention is the forefront cornerstone of all defense mechanism?
After all, prevention is a frequent dictum in the "Arts of War."
Yes, I truly believe that IPSs/application FWs are the direction those assets belonging to the 'prevention' category need to go (see my previous post about prevention, monitoring, response).
I think there are some fundamental _business_ problems for the IPS guys.
Number one, some of those (IPS) products seem to be a lot like their IDS cousins and selling something that doesn't work as expected or isn't useful as implemented. Number two, IPS companys have to take on those huge goliaths of FW companys. I think that is the reason a very good technology (IPS) went after a market hindered by bad implentations (IDS) even though I don't see them as direct competitors. Blame it on the damn marketers.
Sorry for the late post, but I thought you deserved a response.
www.sguil.net
The Analyst Console for NSM