Lessons Learned in the Implementation of a Multi-Location Network Based Real-Time Intrusion System

Nov 20, 1998

Abstract

This presentation will highlight IBM's Emergency Response Service's implementation of a multi-location real time intrusion detection system. After evaluating multiple technologies, IBM ERS settled on a network based intrusion detection system to monitor internet traffic. Although the technology of a network based intrusion system is relatively straightforward, the operational and response aspects of a multi-site implementation created a number of opportunities. Issues on scalability, categorization of attacks, signature updates, and general remote management of network based RTID sensors, and how IBM ERS overcame these obstacles will be discussed. Moreover, through various installations of this hardware, across multiple industries, IBM ERS has created a unique database containing the types and the quantities of attacks on internet hosts and firewalls within the United States. Finally, the presentation will discuss operational and financial issues surrounding the establishment of a 24x7 network security operations center.