The challenges of using an intrusion detection system

Abstract

An intrusion detection system (IDS) can be a key component of security incident response within organizations. Traditionally, intrusion detection research has focused on improving the accuracy of IDSs, but recent work has recognized the need to support the security practitioners who receive the IDS alarms and investigate suspected incidents. To examine the challenges associated with deploying and maintaining an IDS, we analyzed 9 interviews with IT security practitioners who have worked with IDSs and performed participatory observations in an organization deploying a network IDS. We had three main research questions: (1) What do security practitioners expect from an IDS?; (2) What difficulties do they encounter when installing and configuring an IDS?; and (3) How can the usability of an IDS be improved? Our analysis reveals both positive and negative perceptions that security practitioners have for IDSs, as well as several issues encountered during the initial stages of IDS deployment. In particular, practitioners found it difficult to decide where to place the IDS and how to best configure it for use within a distributed environment with multiple stakeholders. We provide recommendations for tool support to help mitigate these challenges and reduce the effort of introducing an IDS within an organization.

Examining the suitability of industrial safety management approaches for information security incident management

“…Coping with the existing tools and their lack of usability: Current technical tools suffer from a high number of false positives, the need for precise information that is rarely documented, and a lack of usability (Werlinger, 2010(Werlinger, , 2008Metzger et al, 2011).…”

Cyber Security and Information Protection in a Smart Grid Environment

“…Anomaly based IDS could detect unknown attacks that do not conform to the normal behaviour. However, an anomaly based IDS has a high level of false alarms due to uncertainty associated with their detection decisions [Werlinger 2008] [Gates 2006]. Therefore, a hybrid architecture for Home-IPS is proposed that combines both advantages of signature based and anomaly based IDSs.…”

Guidelines for designing IT security management tools

“…Make configuration manageable [3,20] Support rehearsal and planning [3,6,7,20,44] Make configuration easy to change [20,46] Provide meaningful errors [20,34,46] Specificity Figure 1: Framework of design guidelines for IT security management tools well supported by available tools [8,26]. As one of our participants illustrated: "So the vendors themselves are looking at things in isolation instead of looking at it as a whole thing that needs to be addressed" (P33).…”

“…To realize this, tools should provide commented configuration files and/or group related parameters together in high-level profiles [20], so that a change in the profile would change all related parameters automatically. Also, tools should provide a quick tuning option that allows batch configuration of parameters [46].…”