Security vendor Sourcefire Inc. on Monday will announce a new security appliance that company executives say will make intrusion detection systems more efficient and valuable in enterprise networks. The Real-Time Network Awareness appliance combines vulnerability assessment and correlation with change management in an effort to reduce or even eliminate the false positives and negatives that plague IDS systems.
The RNA box is meant to work in conjunction with Sourcefires Intrusion Management System, which is based on the open-source Snort IDS. The appliance starts by identifying all of the assets on a network and assessing their current state. Then, it performs continuous monitoring of the network and alerts the administrator to any changes, such as new devices coming online or unusual services being used on a server.
Each change is then fingerprinted and analyzed to see if it could potentially cause a vulnerability on the machine. That data is sent to the Sourcefire Management Console and displayed in context with information coming from the IDS sensors to present a more complete picture of whats happening and whether its a cause for concern.
“IDS is resource-intensive and lacks any real context about what its protecting,” said Wayne Jackson, CEO of Sourcefire, based in Columbia, Md. “Our customers have told us that they expect to see a dramatic rise in the usability of their IDS infrastructure after installing [the RNA appliance].”
Analysts say that the idea of surrounding network events with other important pieces of information is one of the next avenues for innovation in the security market.
“Context is in,” said Pete Lindstrom, research director at Spire Security LLC, an analyst firm in Malvern, Pa. “Were still tackling the problem of false positives, and weve gotten to the point where theres not much more you can do except bring in more context to help you make a better decision. This will be a big trend in the next year and a half.”
Several other companies have introduced appliances with similar correlation capabilities, but Jackson believes that Sourcefires implementation and technology are unique. In fact, the company has filed for six patents related to the RNA technology. Still, he expects other vendors to follow Sourcefires lead.
“If you have a completely unique idea, its probably not that good of an idea,” he said.
Most Recent Security Stories:
Search for more stories by Dennis Fisher.
Find white papers on security.
For more security news, check out Ziff Davis Medias Security Supersite.
