IDS Appliance Reduces False Positives
Sourcefire tool combines vulnerability assessment and correlation with change management in an effort to reduce or even eliminate the false positives and negatives that plague IDS systems.Security vendor Sourcefire Inc. on Monday will announce a new security appliance that company executives say will make intrusion detection systems more efficient and valuable in enterprise networks. The Real-Time Network Awareness appliance combines vulnerability assessment and correlation with change management in an effort to reduce or even eliminate the false positives and negatives that plague IDS systems. The RNA box is meant to work in conjunction with Sourcefires Intrusion Management System, which is based on the open-source Snort IDS. The appliance starts by identifying all of the assets on a network and assessing their current state. Then, it performs continuous monitoring of the network and alerts the administrator to any changes, such as new devices coming online or unusual services being used on a server. Each change is then fingerprinted and analyzed to see if it could potentially cause a vulnerability on the machine. That data is sent to the Sourcefire Management Console and displayed in context with information coming from the IDS sensors to present a more complete picture of whats happening and whether its a cause for concern.
"IDS is resource-intensive and lacks any real context about what its protecting," said Wayne Jackson, CEO of Sourcefire, based in Columbia, Md. "Our customers have told us that they expect to see a dramatic rise in the usability of their IDS infrastructure after installing [the RNA appliance]."
Find white papers on security.
For more security news, check out Ziff Davis Medias Security Supersite.