Link to home
Start Free TrialLog in
Avatar of matt_starkey31
matt_starkey31

asked on

intrusion detection systems question? IDS

Hey I have a scenario that maybe you could help with. Say you have 10 computers that connect to the internet via a broadband connections and your company wants you to set up an IDS. What are the steps to be performed before formulating an IDS policy?
Avatar of vasil_tonev
vasil_tonev

That depends on your network configuration.
Will you install IDS on your router, or on standalone IDS server?
Avatar of matt_starkey31

ASKER

Well in my opinion I would put it on the actual computers since the network is small. And not to mention you have a broadband connection to the internet provided by a telephone company, so I would imagine they would have most of that security coved.  But in your opinion that is what I am trying to figure out which is better for such a small network. And after I decide where I want it placed whether it be host based or network based, what are some of the things that I need to consider before implementing a policy.
SOLUTION
Avatar of vasil_tonev
vasil_tonev

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks for the help but what I am trying to accomplish here is some research on IDS, and one of the things I need to figure out is what needs to be considered before implementing a policy for an IDS whether it be host based or network based. Now the network that I am working with is small 10 computers that connect to the internet via a broadband connection, Now I would think that a host based IDS would be acceptable since it is a small network, but that is one of the things I am also trying to figure out since I have never setup an IDS.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
In this case which each PC connect via broadband, I think the best as you said- is the host based IDS.
Here I am wondering why you are worry about the policy before implementing? This is an IDS so, nothing will be blocked.
You need to tune the policy after implementation to decrease number of false positive alerts.





SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I believe the user was looking for the design and formulating policies for IDS's. It's quite hard to understand IDS and policies when you just start learning about it. We learn in theory but we never really implement a real world solution until we become some kind of consultant.

Building an IDS policy
You have to consider:
What do you want to monitor?
Malicious Activity
Suspicious Activity
Abnormal Activity
Inappropriate Activity
What aspects do you want to monitor?
External-facing network connections
DMZ's
Placement of IDS relative to location of the firewall
Choke Points
Hosts
Do you have an incident response method (SIRT)?
How are you going to clean up the mess that was made?

People are starting to learn how IDS's work will learn a bit better by reading the source gathered from IBM here:

http://www.ibm.com/developerworks/library/ar-intrudet/index.html
Consider the following scenario. You get an alert from the IDS telling you that somebody is trying to connect repeatedly to port 3389 of the computer at 192.168.2.124. While you are sitting at the computer, the mouse pointer starts moving by itself. Please evaluate this scenario and explain the correct response including the following:

Describe what your mental approach to these events should be.
Explain what you should do to isolate the affected computer.
After the computer is isolated, describe what should be investigated next.
List people who should be notified.
Describe what you could learn by a subsequent review of the firewall and IDS logs