do we need additional security measures?" I think that the highest and best purpose of network intrusion detection outside the firewall is to help assessment of the attacks directed against your organization and to ensure the internal hosts are hardened against these attacks. But before you have an IDS, how do you assess these threats? You want to examine the problem, the threats, and the vulnerabilities before you offer intrusion detection as the solution. Chapter 17's focus on risks gave the foundation you need to approach this section of the plan. Part two's elements are as follows:

∙Threat assessment and analysis

∙Asset identification

∙Valuation

∙Vulnerability analysis

∙Risk evaluation

Threat Assessment and Analysis

A risk assessment purist would say you need a dictionary that enumerates all possible threats, and then you need to analyze each threat. For a plan to support an intrusion-detection system that is designed to be readable by management, this is a bad idea.Your goal is not to show all possible threats, but rather a sampling of probable treats. Management and the intrusiondetection analyst would do well to focus on what is likely to happen to it and how it is going to happen. I cover these in reverse order. The following list is my take on how these attacks are going to arrive. The primary threat vectors are as follows:

∙Outsider attack from network

∙Outsider attack from telephone

∙Insider attack from local network

∙Insider attack from local system

∙Attack from malicious code

Threat Vectors

Let's just take a second to be sure of the term threat vector. If you go to the restroom of a restaurant, there is often a sign saying, "Employees Must Wash Their Hands Before Returning to Work." It has been well established that skipping this sanitary step is a disease vector. The dirty hands are the pathway, the conduit that allows the food poisoning.

A network-based intrusion-detection system might be able to detect outsider attack from the network, insider attack from the network, and possibly attack from malicious code (remember the Macro virus and PKZip examples from Chapter 17).

A host-based intrusion-detection system with an active agent might be able to detect all five