Management's priority appears to be to ensure that they can demonstrate that they have exercised a standard of due care in the event of any legal action. We believe that the vendor community is marketing to this condition through the product claims they make. It remains to be seen whether or not intrusion detection technology can live up to the promise of accurately identifying attacks. The current generation of commercial ID systems uses a limited set of techniques to detect attacks. Challenges to today's ID systems include increases in the types of intruder goals, intruder abilities, tool sophistication, and diversity, as well as the use of more complex, subtle, and new attack scenarios the use of encrypted messages to transport malicious information the need to interoperate and correlate data across infrastructure environments with diverse technologies and policies ever increasing network traffic the lack of widely accepted ID terminology and conceptual structures volatility in the ID marketplace which makes the purchase and maintenance of ID systems difficult risks inherent in taking inappropriate automated response actions attacks on the ID systems themselves unacceptably high levels of false positives and false negatives, making it difficult to determine true positives the lack of objective ID system evaluation and test information the fact that most computing infrastructures are not designed to operate securely limited network traffic visibility resulting from switched local area networks.
Faster networks preclude effective real-time analysis of all traffic on large pipes.
ID systems can provide useful, reliable results in specific situations and configurations. These include monitoring an organization's firewall policy to ensure it is implemented correctly, monitoring unpatched machines for specific vulnerabilities, and monitoring specific network services. The key deployment consideration is to focus the IDS sensing and analysis activities on the most critical subnets and hosts so that a trained analyst can interpret and act on the data these activities produce to safeguard the most important assets. This report presents recommendations for ID sponsors, users, vendors, and researchers. This includes selective deployment to monitor critical assets as well as signature tuning to prevent excessive false alarms.