Redstone's basic defense is to find attacks quickly in order to stop them as they happen, he said. Contract analysts from Intergraph Federal Systems serve with Carey on his defense team. Redstone needs all the help it can get, because its networks are peppered with attacks daily. That's 3,000 to 4,000 scans of the network. Hackers conduct scans to try to find out what hardware and software are present on a given network.
Scans can discover computers or even modems with open links to the Internet.
Unknown hackers who appeared to be from countries including Bulgaria, China, Hungary, Israel, Latvia, Lithuania, Macedonia, Poland, Portugal, Romania and Russia have scanned Redstone over the past three months. But because hackers can make it look as if they were on a computer in a different country, pinning them down geographically is an imperfect science. Once the reconnoitering is complete, hackers try to exploit vulnerabilities and gain access to private networks and the information stored there. Without intrusion detection systems and expertise, network staff may never know they've been hacked. In such incidents, intruders launch a flood of messages to a single server, overwhelming it.