Introduction

The principle of intrusion detection isn't new. Whether it's car alarms or closed-circuit televisions, motion detectors or log analyzers, many folks with assets to protect have a vested interest in knowing when unauthorized persons are probing their defenses, sizing up their assets, or running off with crucial data. In this book, we'll discuss how the principles of intrusion detection are implemented with respect to computer networks, and how using Snort can help overworked security administrators know when someone is running off with their digital assets.

All right, this might be a bit dramatic for a prelude to a discussion of intrusion detection, but most security administrators experience a moment of anxiety when a beeper goes off. Is this the big one? Did they get in? How many systems could have been compromised? What data was stored on or accessible by those systems? What sort of liability does this open us up to? Are more systems similarly vulnerable? Is the press going to have a field day with a data leak?

These and many other questions flood the mind of the well-prepared security administrator. On the other hand, the ill-prepared security administrator, being totally unaware of the intrusion, experiences Uttle anxiety. For him, the anxiety comes later.

Okay, so how can a security-minded administrator protect his network from intrusions? The answer to that question is quite simple. An intrusion detection system (IDS) can help to detect intrusions and intrusion attempts within your network, allowing a savvy admin to take appropriate...