Intrusion Detection

Have you ever known an expensive, purebred guard dog that was well-trained, except someone forgot to teach it not to take goodies from strangers? Your average thief will get his ass bit, but a smart intruder bearing big, juicy steak could slide right past the pooch.

So it goes with the 10 IDSes we tested on our Bruisernet, at DePaul University in Chicago. Today's intrusion-detection products come at purebred prices and are all high-maintenance, requiring considerable manpower to maintain. For the most part, they will stop run-of-the-mill attacks, but experienced hackers will likely find a way in. That's the bad news. The good news is that the market has made strides, and IDS products are improving all the time.

In what may well be the most comprehensive test of IDSes ever, we deployed Cisco Systems' Secure IDS, Computer Associates International's eTrust, CyberSafe Corp.'s Centrax, Enterasys Networks' Dragon, Internet Security Systems' Black ICE (ISS acquired NetworkICE Corp. in April), ISS' RealSecure, Intrusion.com's SecureNet Pro, NFR Security's Intrusion Detection System (we also looked at Anzen Computing's FlightJacket, which was acquired by NFR in June), the open-source Snort and Symantec Corp.'s NetProwler (formerly Axent Technologies' NetProwler; Axent was acquired by Symantec in December 2000).

The test site was DePaul's network, which comprises more than 10,000 nodes with a mishmash of platforms and end users. The network averages about 38-Mbps Internet throughput, with traffic ranging between 5,000 and 7,000 packets per second. Sounds tame enough, but it chewed up and spit out many of the products within hours.

When all was said and done, we gave Dragon our Editor's Choice award. Simply stated, it did what it was supposed to do, it didn't blow up constantly, and it is suitable for large environments. Bottom line: These systems can be worthwhile; you just need to go into it with your eyes open, have realistic expectations and choose the solution that's the best fit for your environment.