Part of a Larger Strategy

This book is focused on helping the analyst of a network-based intrusion-detection system. However, we have also talked about system security, risk, vulnerability scanners, unauthorized use, incident handling, and now, business issues. You need to always be ready to show how intrusion detection fits in as part of the organization's information-assurance program.

To be honest with you, when I was younger, I didn't get it. I thought my mission in life was to implement the best technology at the most affordable price possible to help the research lab that I worked for be "world class." Phrased that way, it even sounds like a laudable mission. I would approach my boss with a technology and its technical tradeoffs and he would say, "Yes, but show me the big picture." It used to drive me crazy. I was convinced he was a total idiot with a personal goal of being named Luddite of the year. Fifteen years later, I am just starting to really understand. You can't play a song on a harp with one string. Any technology, no matter how wonderful, is useless unless it complements the existing business processes of the organization. When you brief management on the spiffy IDS you want to buy, be sure to include the hooks to system security, risk, vulnerability scanners, unauthorized use, incident handling, and business issues in your plan. Please allow me to do a quick repeat from Chapter 17, "Organizational Issues" (see Listing 19.1)

Listing 19.1 The Seven Most Important Things to Do If Security Matters [1]

[1] Courtesy of Matt Bishop, Alan Paller, Hal Pomeranz, and Gene Schultz

Write the security policy (with business input).

Analyze risks, or identify industry practice for due care; analyze vulnerabilities. Set up a security infrastructure.

Design controls, and write standards for each technology.

Decide what resources are available, prioritize countermeasures, and implement toppriority countermeasures you can afford.

Conduct periodic reviews and possibly tests. Implement intrusion detection and incident response.

If your intrusion-detection proposal is written against a process like this, it will be obvious to management that it is part of a larger strategy. Senior management does not have the time to accept information piecemeal; it is responsible for broad business strategies. Take a bit of your time to make its job easier.

We have spent considerable time on the four issues that management needs to see in an intrusion-detection plan. If we do not cover these bases, their paradigms will not let them even consider the plan. Again, they are as follows:

●Bang for the buck.

●The expenditure is finite and predictable.

●The technology will not destabilize the organization.

●This is part of a larger, documented strategy.

Now we can move on to the technical stuff; this will be part two of your plan or proposal.

Part Two: Threats and Vulnerabilities

The second part of the plan is where you lay out the threats and compare them to your vulnerabilities and the value of your assets. The purpose of this is to answer the question, "Why