The number of redundant alarms and false positives generated by Intrusion Detection Systems (IDS) has come under fire from users attending an event designed to raise awareness about the technology.
Users attending an 'ABCs of IDS' event at London's City University yesterday said more the 80 per cent of the alerts they received were false, with one citing 60 alerts he had received about non-existent problems that morning at 0300.
IDS systems, which act as a kind of burglar alarm to for hacker attacks, provide "defence in depth" from hack attacks by providing alerts about suspicious activity via sensors on a network or host machine. The technology is reactive in nature, meaning human intervention is needed, because if an IDS system shut off traffic or stopped a service automatically this could cause more problems than it solves.
Representation from Cisco Systems, Intrusion.com, NFR Security, Top Layer and managed services firm proseq at the event conceded false alerts and redundant alarms (such as Apache-targeted hacks on firm with no such servers) were a serious problem. However there was a marked absence of ideas of how about the technology could be fine-tuned to minimise the problem, with vendors emphasising the fact that systems need to be part of an overall security policy, which receives adequate resources.
News source: The Register - IDS users swamped with false alerts
