RSS |
 |
| F E A T U R E | |
| |
Intrusion Detection, Take Two November 15, 1999 Cisco Systems Cisco Secure Intrusion Detection System/NetRanger 
Cisco's NetRanger hasn't changed much since we last tested it. It is still relentless in its detection abilities. It is still one of the best performing intrusion-detection systems we've seen. It still catches just about everything that we could throw at it. And it's still painfully dependent on Hewlett-Packard Co.'s HP OpenView, and it's still obnoxiously overpriced. At more than $22,000 for one sensor appliance and the required Solaris-based "director" software (not including the cost of the SPARC workstation), NetRanger is more than twice the price of its nearest competitor.
What really sparked our interest was the inclusion of intrusion-detection technology in Cisco's family of routers. Although NetRanger has its shortcomings, Cisco is in a unique position that could turn the network-based IDS space on its head: The firewall builds of IOS (the OS that runs Cisco switches and routers) from 12.0.5T onward will have intrusion-detection technology built in. One of the largest problems with network-based IDS involves scalability. In a switched 100-Mbps or faster environment, most network-based intrusion-detection systems just can't keep up. If Cisco delivers on integrating intrusion-detection technology into its family of switches, it may be able to go where no IDS vendor has gone before--into the heart of fast networking. We tested a 2621 router with the firewall IOS build, and it worked without a problem. We configured the router to report directly into the NetRanger console, alarming right next to the NetRanger sensor unit. We were able to redirect the output to Unix syslog, which afforded us even greater flexibility. Although the IDS IOS build has only around 60 attack signatures, those 60 worked quite well.
Fortunately, Cisco has some solutions in the works. We were given a tour of Cisco's new security manager, which cleans up the interface fiasco and eliminates NetRanger's dependency on OpenView. HP has released a Windows NT version of NetRanger, possibly opening the door to non-Unix shops. The current IOS IDS builds represent an intriguing start down an interesting path. If Cisco delivers, the company's network-based intrusion-detection products may retake the spotlight. But until that happens, NetRanger will remain an overpriced network-based IDS, with no host-based modules in sight and many competitors closing in fast. Cisco Secure Intrusion Detection System/NetRanger, $12,500 for the Sensor, $9,500 for the Director, Cisco Systems, (800) 553-6387, (408) 526-4000; fax (408) 526-4100. www.cisco.com/netranger
| |
|
PAGE: 1 I 2 I 3 I 4 I 5 I 6 I 7 I 8 I 9 I 10 I 11 I 12 I 13 I NEXT PAGE |
|
Like RealSecure, NetRanger uses an engine/console model. The NetRanger appliance or "sensor" is a turnkey solution--a Pentium II PC in a rack-mountable case running Solaris x86. Cisco shipped us a sensor, a Solaris-based director (console) and a Cisco 2621 router with the new integrated IDS/firewall IOS (Internetwork Operating System) build (version 12.0.5T). During our tests, the NetRanger kept up with almost everything we had in our arsenal, except fragmented attacks. It set off alarms warning us that it had spotted fragments on the network, but could not determine what those fragments contained.
Unfortunately, the OpenView problems we faced in our earlier tests came back and bit us again. By executing an nmap FIN scan we unknowingly generated hundreds of scan warnings. OpenView was nice enough to shrink all the icons as it attempted to populate a single window with hundreds of alarms. The result was an indigestible collage of annoyingly small icons. Taking this to the next level, we figured we could probably run a visual denial-of-service attack and overwhelm the poor sap stuck clearing a seemingly endless array of alarms out of OpenView. Making matters worse, NetRanger is the most difficult product we've ever had to configure. Anyone thinking about reconfiguring these units should get his or her head examined first.Best of the Web
Data deduplication: Declawing the clones
Data deduplication is emerging as a critically important new arrow in the storage administrator's quiver to answer hard questions about the increasing problem in storage growth costs.
Compression, Encryption, Deduplication, and Replication: Strange Bedfellows
One of the great ironies of storage technology is the inverse relationship between efficiency and security: Adding performance or reducing storage requirements almost always results in reducing the confidentiality, integrity, or availability of a system.
WAN Optimization Whitelists and Blacklists
Optimization is a fantastic way of saving money and creating really happy customers at the same time, but it doesn't work flawlessly for all applications.
WAN Optimization as a Managed Service: It's Not About the Cost
This insight examines how organizations outsourcing their WAN optimization initiatives to a third-party go about achieving their goals for application performance, reducing operational costs, and streamlining enterprise infrastructure.
