Building a cheap, powerful intrusion-detection system

If your overall security system doesn't include network-based intrusion detection, now is an excellent time to consider implementing an IDS package

Network-based intrusion-detection systems (IDS) are an integral component of a layered IT security strategy. As October is National Cyber Awareness Month, if your overall security system doesn't include network-based intrusion detection, now is an excellent time to consider implementing an IDS package.

Commercial network-based IDS can often be quite expensive. On the other hand, there is the common perception that implementing an open-source IDS is complicated. Recently, I had the opportunity to install an open-source IDS and found the opposite to be true. You can easily build a powerful open source-based IDS in less than a day, as I did.

The object of this article isn't to provide a step-by-step instruction for installing and managing an open-source IDS, because there are plenty of resources available for that. Rather, it's intended to lay the foundation for such. If you have ever considered implementing an open-source IDS but felt lost when researching how to do so, this article is for you.

Snort and BASE

Two packages necessary for creating an effective open-source database are Snort and BASE (Basic Analysis Security Engine). Snort was originally created in 1998 by Martin Roesch as an open-source alternative to commercial IDS packages. BASE is built on the work of the defunct Analysis Console for Intrusion Databases (ACID) project.

As with many open-source applications, Snort is available as source code or as a binary install package for Linux or Windows. BASE, on the other hand, is operating system-independent. Therefore, both may be set up on either a Linux or Windows machine, with a similar amount of effort.

The goal of this article is to demonstrate the ease in creating an IDS using older computers and therefore focuses on building a Snort IDS on a Linux system, but the methods for installing on a Windows system are very similar. Because of how far Linux distributions have progressed, if you have installed Windows, you can install Snort on Linux with little difficulty.

Preparing the system

Deciding on placement of the IDS within the network is critical. The IDS machine must connect to a port that can see all traffic between the LAN and the Internet. This means either connecting to a mirrored switch port or a hub located between the Internet connection and the LAN. If a firewall and only one IDS sensor is used, the sensor should be placed between the firewall and the LAN, for reasons that will be discussed later.

Choosing the type of machine to use is dependent on the environment and the data desired. A Snort IDS setup can involve one or several independent machines, or many that report to a central database server. The faster the connection being monitored and the level of logging dictate the machine capabilities.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Greg Schaffer

Computerworld
Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Compare & Save

Deals powered by WhistleOut
WhistleOut

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?