O'Reilly logo

Managing Security with Snort & IDS Tools by Christopher Gerg, Kerry J. Cox

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Securing the Sensor Itself

It should be obvious that protecting the integrity of the systems responsible for monitoring and maintaining the security of your network is very important. You need to protect the integrity not just of your NIDS systems but of your syslog servers, authentication servers, monitoring, and management tools. One strategy that I employ is a management network . This network is behind its own firewall and access to the systems contained within the management network is closely controlled. The systems inside do not even participate in the same authentication domains as the systems on the inside of the network. The only openings in the firewall are those that are needed to get monitoring traffic to the systems that watch the environment.

Closely managing the Snort systems is important. The operating systems should be configured according to industry-accepted best practices and should be kept up-to-date with patches and updates. After all, a compromised IDS sensor would have access to all the traffic to and from your most sensitive systems—a dangerous situation, to say the least.

Choose an Operating System

I squirm uncomfortably when people ask me what operating system they should use for a particular function. I carefully try to avoid discussions about religion, politics, and operating systems—all for the same reason. They're too controversial. However, I will briefly put on my consultant hat and walk you through the process of deciding which operating system to ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required