|
How do you deploy an intrusion-detection system on a 24x7 enterprise network? Very carefully. While a HIDS deployment would have been educational, we ruled it out early on because the process would have been far too intrusive for DePaul University's systems-administration team. Thus we tested HIDS solutions in our Neohapsis labs and deployed the more passive NIDS products in the live environment. Working with DePaul's network team, we decided to tap into a perimeter switch and mirror a port off of it (see "Bruisernet Setup"). From there, we built the IDSnet (Bruisernet), a small, isolated LAN that saw all production traffic but had no direct connectivity to it.
After the mirrored IDSnet was built, we designed a VPN that would tunnel the management traffic from the sensors back to the consoles in our lab. Using the firewall/VPN feature sets in a pair of Cisco Systems routers, we built a VPN between the DePaul IDSnet and our lab at Neohapsis. We used a dual-NIC configuration for our sensors: One NIC was used for monitoring, the other for talking back to the management stations.
Our team took about 600 man-hours over four months to get the IDSes deployed, relatively stable, tuned and updated. Given, no sane person is going to deploy 10 different vendors on the same network, but project managers will learn from their pilot programs -- provided they take good notes! Global deployments are going to be quite an endeavor.
After the IDSnet was deployed, we began crafting a network of vulnerable Linux, Windows NT and Solaris machines. We then placed these machines deep in DePaul's network but kept them behind a firewall that passed only traffic from our attack network. Using attack tools and exploit code found on the Internet, we executed the attacks from remote locations and successfully compromised each of the platforms.
Because of the way we constructed the IDSnet, all NIDS devices were exposed to the same traffic at the same time. To remove any possibility of error, we used tcpdump to verify that the IDSnet "saw" all our attack traffic.
|
REPORTS
ANALYTICS
Follow 
