Downloaded 54 times
![It’s where you put things….
Installation [Day 0]
1. Pre-install checklist
2. Where (inside/outside, core/perimeter)
3. Tap/span/port-mirror
4. How much traffic can you handle / ROI](https://image.slidesharecdn.com/ids-analyst-prezo-3-150317121304-conversion-gate01/85/IDS-for-Security-Analysts-How-to-Get-Actionable-Insights-from-your-IDS-5-320.jpg)
Uploaded byAlienVault
IDS for Security Analysts: How to Get Actionable Insights from your IDS
The document discusses best practices for intrusion detection systems (IDS). It recommends a three phase process: collection, evaluation, and tuning. In the collection phase, an IDS gathers baseline data for 2 weeks. In evaluation, valuable and actionable events are identified based on policy, risk, and environment. Trending helps eliminate normal activity. Tuning removes unnecessary events to reduce false positives and save time through threshold adjusting and awareness of network details. Updates may require periodic re-evaluation and tuning to account for changes.
More Related Content
Similar to IDS for Security Analysts: How to Get Actionable Insights from your IDS
IDS for Security Analysts: How to Get Actionable Insights from your IDS
- 2. “JTaG” Our Speakers Joe Schreiber AlienVault Directorof Solutions Architecture @pkt_inspector Tony Simone Castra Consulting Managing Partner castraconsulting.com Grant Leonard Castra Consulting Managing Partner castraconsulting.com
- 3. Before Day 1 Day0 Day 0 doesn’t exist….in this presentation
- 4.
- 5. It’s where youput things…. Installation [Day 0] 1. Pre-install checklist 2. Where (inside/outside, core/perimeter) 3. Tap/span/port-mirror 4. How much traffic can you handle / ROI
- 6.
- 7. They make events IntrusionDetection Systems Lots of Events • Placement - Where is it deployed? • Inspection - Traffic Inspected
- 8. Don’t other thingsgenerate events? What Makes IDS Different? Firewalls • Access Control Proxies • URLs IDS • Malware • Network Policy • Active Exploits • URLs (also) • Applications
- 9. I’m positively false…oram I? False Positives What is it? • Invalid? • Relevance? Signature Sets Environment CiiT International Journal of Artificial Intelligent Systems and Machine Learning , Vol 2, No 11, November 2010 Precision = TP (TP + FP)
- 10.
- 11. Phase I -Collection
- 12. Gather all thethings Acquisition Baselining Soak Period Maintenance Period
- 13. I want toinvestigate now! Why? You need data! • How long do I do this for? - 2 weeks? Patterns Sorting • Volume • IP
- 14. Phase II -Evaluation
- 15. What’s valuable? Evaluation What eventsare valuable and actionable? • Policy (Network) - Acceptable or Indifferent • Risk - Assets - Signatures by perceived risk • Environment - Servers - Users
- 16. What’s normal canbe eliminated Trending Historical Record from Phase I • ?Normal? Activity • Scheduled Activities (Backups, Cron Jobs…) Trending is in Flux..
- 17. Stakeholders Discuss Get Stakeholders Involved •The First Time Create Notification Paths Build Relationships Taxonomy can help for Future Events
- 18. Phase III –Tuning
- 19. What is it? Tuning Removalof Events • Avoid FP • Saves Time Threshold Adjusting • Volumes • Risk Scoring Network Awareness • Subnets • VLANs
- 20. Save time Filtering Granularity • Usethe closest match when tuning • Don’t blind yourself Documentation • Why did you tune this? • Time
- 21.
- 22. Things will happen Updates NewSignatures are released often • New Events to Evaluate and Tune Your network changes as servers are added / removed • Tuning re-evaluation
- 23.
- 24.
- 25. But remember you’respecial. You Are Not Alone Business Policies • Change Control • Clearance - Avoid These (Time Burglars) Passive Detection • Needs to Stay Up-to-Date
- 27. It’s all Unicornsand Rainbows! You’re gonna see crazy stuff Stick to the Process Document Tune Move On!
- 28. ASSET DISCOVERY • ActiveNetwork Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory VULNERABILITY ASSESSMENT • Continuous Vulnerability Monitoring • Authenticated / Unauthenticated Active Scanning BEHAVIORAL MONITORING • Log Collection • Netflow Analysis • Service Availability Monitoring SECURITY INTELLIGENCE/SIEM • SIEM Event Correlation • Incident Response THREAT DETECTION • Network IDS • Host IDS • File Integrity Monitoring USM Platform Integrated, Essential Security Controls
- 29. The world’s largestcrowd- sourced threat repository Provides access to real-time, detailed information about threats and incidents from over 8,000 collection points across 140 countries Enables security professionals to share threat data and benefit from data shared by others Open Threat Exchange (OTX)
- 30. Integrated Threat Intelligence ReducedNoise: Correlating IDS/IPS data with vulnerability & IP reputation reduces false positives Full Threat Context: See attack type, number of events, duration, source/destination IP addresses Threat Research: Weekly updates to IDS signatures & correlations rules from AlienVault Labs Threat Research Team Full Coverage: Inspect traffic between devices, not just at the edge Flexible: Integrate your existing IDS/IPS events, and/or use the built-in IDS
- 31. Questions? More on thistopic: IDS “Ask the Experts” Google Hangout 3/24 Free 30-Day Trial of AlienVault USM: www.alienvault.com/IDS Video: IDS Best Practices Blog Post: Open Source IDS Tools Follow @alienvault & @pkt_inspector