Understanding intrusion

This tip, excerpted from Network Intrusion Detection: An Analyst's Handbook, by Stephen Northcutt and Judy Novak, published by New Riders, offers the first step in making your network secure from intrusion: Understanding the nature of the problem. You can read more on this topic at InformIT.

Intrusion-detection systems exist to help computer system managers deal with security problems. To understand where intrusion detection fits in the security world, you should understand the cause of system security problems. Several models address the etiology of security problems in computer systems. I find it helpful to group system security problems into three categories. Most security scenarios result from problems that fall into one or more of these areas.

--Problems in systems design and development: Problems resulting from errors and omissions occurring in the system design and development process.

--Problems in systems management: Problems resulting from mismanagement of systems after they are placed in operational use. This area includes making mistakes in system configuration; disabling security mechanisms on systems (or never enabling them!); or failing to establish security management policies, procedures and practices.

--Problems in allocating trust appropriately: Problems resulting from a failure to accurately assess trust. This area encompasses situations in which there is an assumption of trustworthiness when no compelling evidence supports that assumption. This area includes problems in network protocols (Transmission Control Protocol/Internet Protocol, or TCP/IP, features many notorious examples), cryptographic protocols and policy.