code has become a huge problem, however, and in some sense Trojans and informationgathering viruses can be thought of as insiders after they are in your systems. If insider attacks are a primary concern for your organization, additional measures to achieve a minimum capability are required, such as the following:

∙Use taps or spanning ports on network switches so that you are not blind on the inside.

∙Configure the filters on your DMZ sensor so that they do not ignore your internal systems.You must keep tabs on outgoing traffic as much as incoming. This is especially true because malicious code has become such a major problem.

∙Configure the filters on your border router or firewall to allow only outbound traffic if the addresses correspond to your assigned Internet addresses. This is called egress filtering and there is a how-to paper available at the Incidents.org web site

(http://www.incidents.org/defend/egress.php).

∙Deploy network-based sensors at high-value locations such as research and accounting.

∙Deploy honeypot systems at juicy locations with files that appear to be anything you think insider attackers might be trying to steal.

∙Place additional sensors from time to time on user networks as a random spot check.

∙At the very least, you should deploy host-based intrusion-detection code on all server systems as well as corporate officers and other key personnel. Many personal firewalls are available for less than $75 a station, and they are easy to deploy (Tiny, ZoneAlarm, BlackIce, and Symantec Internet Security, for example).

∙Establish a reward system for those who report on employees who misuse or steal from the organization.

Summary

Very often, the features that seem most desirable when searching for an intrusion-detection system don't prove to be all that important in actual use. The first one to go is usually the capability to send alerts to the analyst's pager.

For various reasons, intrusion-detection systems cannot even look at every possible event. Why? This chapter identified a few possible reasons: The event happened on another network. The IDS is dead. The IDS has no understanding of the protocol. Perhaps the IDS has reached its maximum bandwidth limit and dropped the packet. Further, the network-based IDS is limited to the capabilities of the spanning port on a switch, and encrypted packets prevent IDS