Intrusion Detection and Prevention

S. Welch
IS315: IS Risk Management and Intrusion Detection
Course Project: Part II
Intrusion Detection and Prevention

Intrusion Detection and Prevention both can be classified as imperative for any organization or business network.   For the sake of business continuity, protecting the network components, its applications and accounts is the key to remaining in business and having integrity and trust.   To do so, a network must have a watchful eye embedded within the network itself.   Following are just a few options for network and host intrusion detection and prevention.
Commercial:
Dragon Squire - looks at system logs for evidence of malicious or suspicious application activity in real time. It also monitors key system files for evidence of tampering.   It monitors key system files for change, which includes access time, file size and an MD5 cryptographic checksum. The checksum is stored at the Dragon Server for off-line verification.   Also Dragon Squire has the ability to monitor log files from a diverse selection of open source or commercial firewalls. These logs may be read from a local syslog server or sent directly to Dragon Squire directly via SNMP.   Dragon Squire's signature library includes suspicious events from a wide variety of operating systems.

Tripwire Enterprise 7– The latest version supports multiple platforms including Windows, Linux, Solaris, etc.   It audits configuration change enterprise-wide and reduces risk by detecting unauthorized system changes.   It then corrects the problem automatically or alerts IT officials for intervention.   Tripwire offers thousands of pre-defined standardized report which have real-time views.   It also allows creation of custom reports capable of drilling down. Tripwire also reduces outages and SLA penalties.   Tripwire online support offers support requests submission, product downloads, knowledge base, support forums and documents.   In order to attain updates, you must have a valid support & service...