Your private threat-detector

We all know that it is a good idea to place smoke detectors throughout our houses. In theory, though, we could also wait for the neighbors, or the community in general, to call the fire-department once they see flames coming out of our house. Or if there is a larger fire in our neighborhood, we could assume that the sound of the sirens will be enough to alert us.

But we don't think that way. While community action is good, and emergency broadcasts about approaching fires are certainly very necessary, we still also place our own smoke-detectors in our house. Why is that?

The reason of course is that our own smoke-detectors are best situated to detect a fire in the very early stages, right where it matters - in our house. At such an early stage, there is only very little smoke. No neighbor will see this, no fire sirens will sound, no fire-trucks will come rushing down our driveway. There is too little smoke for anyone else to see. Instead, we very much need to have our own personal alarm in our own, private space. Nobody else has the same insight that we have, nobody else can see or smell the air in our own house, and nobody else can detect this fire, our very own personal problem, as fast as we ourselves can.

This is quite obvious, and I am sure that nobody will really disagree with these statements.

Therefore, it is surprising to me that many network operators and corporations are placing the security of their network into the hands of the community, if you will, without allowing for the presence of their own smoke detectors. What I am referring to is the tendency of many organizations to feel safe and secure, once they have installed IPSs (Intrusion Prevention Systems) in their network, which receive updates and new signatures from the global data center of the IPS vendor. Let me ask you this:

What does the global data center know about localized anomalies and issues, that are specific to your own network?

If your network is targeted by a specific DDoS attack, or if there is a zero day worm spreading in your network, or if there is a traffic anomaly caused by equipment failure or misconfiguration, or if there are failing or misbehaving applications or users... how can some global data center, which does not see any of this be of help to you?

The answer, of course, is that it cannot help. To get back to the analogy of the smoke and fire, these data centers are great to inform you of fires in your community. They can sound the sirens to alert you to approaching storms, which also have affected others already. In some cases, they may even be able to prevent issues on your network, by uploading a signature for one of those global anomalies before your network is hit.

However, these global data centers are quite useless when it comes to detecting the first wisps of smoke, indicating something that is specific to your network alone.

So, to be truly protected, you see that you need your own smoke-detector for your network. These network smoke-detectors are called anomaly detection systems. Every mission critical network has to have one of those, since signature-based IPSs alone cannot help at all with any issue that is localized, and that is affecting your network, either by accident or by design.

The good thing is, though, that you don't need to throw away your investment in IPSs or deep-inspection firewalls. Quite the opposite. A good anomaly detection system will be able to produce fine-grained signatures out of the first traces of an anomaly, which can then be fed to the IPSs for filtering. See my articles here and here.

For fire-protection, we rely on a community effort along with local smoke detection. We intuitively know that this is best practice. The same holds true for our networks. Having IPSs, which can protect against known threats, is necessary. But at the same time, having an anomaly detection solution as the local smoke detector is equally necessary, and equally needs to be considered as best practice. Without it, our threat detection and management capabilities are simply not complete.

Juergen

Comments

[zxybzxxyiw]

texas mortgage refinance carisoprodol

[KVAustin]

http://mikardia.com/porno_pictures/big-pennis-6.jpg

My story is free downloadable porn on psp Г¤gypt porn cuba girls porn maid in manhattan porn clips asian clip free porn sample pthc gallery porn picture teen hermaphrodite porn asian junge porn also porn in the kitchen with sister brother amy reid mp4 porn free upload porn exclusive free gallery movie porn youporn babe inceste
And also vivid pornstars cordelia porn stream afrolicious porn hermaphroditen porn german amuter porn anmalsex free porn manilla porn turkish porn 3gp ladki ki ladki se sex also gay male porno ava devine free movie porn porn scatofile watch pakistan porn movies free online free multiple cream pies porn free porn sites for quicktime freaky porn erotik sex porno porn uppload
No one find nepali nude porn sex video femme espagnole porno new movies kyra cwh sexy porn kyra shade free porn pregnant porn family free porn hong kong massage sex also beauty porn tube jamaican only porn tube porn italian pornstar tube x hamster free porn
I get porn nun mom incest porn tube teen boat porn site also free gay porno sites watch online free arabic porn holland free porn pics porn festelle free porn lookalike
And finnaly free schoolgirl porn tonya cooley porn video download free gay porno gallery blowjob female orgasm also what's the difference between hard core porn and soft core? divx download free movie porn big cock porn tube hack porn sites realitykings porn rape in public free full movie porn

[moncler outlet]

Ok that's a good reason for not blogging. I am frreakiiiiing! michael and michael = heaven. Has the show been picked up? or are you guys doing the pilot? Shet we need more info about your show!!

[cheap north face]

http://www.northface4sale.org
The good thing is, though, that you don't need to throw away your investment in IPSs or deep-inspection firewalls. Quite the opposite

[Marc Jacobs bags]

This is a very popular brand of products accepted by the public and welcome!