tailieunhanh - Open Source Security Tools : Practical Guide to Security Applications part 23

Open Source Security Tools : Practical Guide to Security Applications part 23. Few frontline system administrators can afford to spend all day worrying about security. But in this age of widespread virus infections, worms, and digital attacks, no one can afford to neglect network defenses. Written with the harried IT manager in mind, Open Source Security Tools is a practical, hands-on introduction to open source security tools. | Page 199 Thursday June 24 2004 12 17 PM The Problem of NIDS False Positives 199 Common Causes of False Positives Network Monitoring System Activity Many companies use a Network Monitoring System NMS such as HP OpenView or WhatsUp Gold to keep track of the systems on their networks. They generate a lot of polling and discovery activity on your network. These systems usually use SNMP or some similar protocol to get the status but they may also use pings and other more intrusive tests. By default most detection systems see this activity as hostile or at least suspicious. An NMS on a large network can generate thousands of alerts per hour if the IDS is set to flag this kind of activity. You can avoid this by having your NIDS ignore activity to and from the IP of your NMS. You can also eliminate those NIDS alerts from the database if they are not something important for you to track. Network Vulnerability Scanning Port Scanners If you are doing network vulnerability testing or port scanning using programs like Nessus and Nmap then your NIDS is going to go nuts every time they run. These programs are designed to do exactly what hackers do. In fact there is probably an alert for most Nessus plug-ins. Once again you could disable reporting of the IP address of your Nessus or Nmap server within your NIDS. A better way to handle this is to shut down your IDS during your regularly scheduled scans. This way the scanner box is still protected from attack when it is not scanning and your alert database isn t skewed with a lot of data from your own scanning activity. User Activity Most network intrusion detection systems are set up to flag various dangerous user activities such as peer-to-peer file sharing instant messaging and so forth. However if you allow this kind of activity either by formal policy or simply by not enforcing existing policies then it will show up as alerts in your logs. This may make a good case for enforcing or creating policies against .