Security vendor Sourcefire Inc. is rolling out a security appliance that company executives say will make IDSes more efficient and valuable in enterprise networks. The Real-Time Network Awareness appliance combines vulnerability assessment and correlation with change management in an effort to reduce or even eliminate the false positives and negatives that plague intrusion detection systems.
The RNA box is meant to work in conjunction with Sourcefires Intrusion Management System, which is based on the open-source Snort IDS. The appliance starts by identifying all the assets on a network and assessing their current state. Then, it performs continuous monitoring of the network and alerts the administrator of any changes, such as new devices coming online or unusual services being used on a server.
Each change is then fingerprinted and analyzed to see if it could cause a vulnerability on the machine. That data is then sent to the Sourcefire Management Console and displayed in context with information coming from the IDS sensors to present a more complete picture of whats happening and whether its a cause for concern.
“IDS is resource-intensive and lacks any real context about what its protecting,” said Wayne Jackson, CEO of Sourcefire, based in Columbia, Md. “Our customers have told us that they expect to see a dramatic rise in the usability of their IDS infrastructure after installing [the RNA appliance].”
|
Analysts say the idea of surrounding network events with other important pieces of information is one of the next avenues for innovation in the security market.
“Context is in,” said Pete Lindstrom, an analyst at Spire Security LLC, a market researcher in Malvern, Pa. “Were still tackling the problem of false positives, and weve gotten to the point where theres not much more you can do except bring in more context to help you make a better decision. This will be a big trend in the next year and a half.”
Several other companies have introduced appliances with similar correlation capabilities, but Jackson said he believes Sourcefires implementation and technology are unique. The company has filed for six patents related to the RNA technology. Still, he said he expects other vendors to follow Sourcefires lead.
“If you have a completely unique idea, its probably not that good of an idea,” Jackson said.