Smarter, Sneakier Systems Spot IntrudersSmarter, Sneakier Systems Spot Intruders

Administrators charged with protecting a network can't live without intrusion-detection systems, but they often find it's hard to live with them, too. Most systems plague IT staff with false alarms that take a serious toll on administrators' productivity. Two new products may dramatically reduce, if not eliminate, the problem.

Storageway Inc., a storage provider in Fremont, Calif., is beta testing OneSecure Inc.'s Intrusion Detection and Prevention system. William Turner, chief security officer at Storageway, says IDP's refined sleuthing capabilities have virtually eliminated false positives. For example, instead of merely conducting signature inspections, which sound alarms whenever the system notices that some activity on the network resembles a known hacking technique, IDP conducts "stateful inspections." These inspections take into account the context of the activity as well, to avoid generating alerts for activities that may look suspicious on the surface but are legitimate. The software also detects protocol and traffic anomalies.

Management is also simplified, Turner says. Any IT staff members who have managed a firewall will be familiar with managing IDP, he says. The appliance easily imports additional intrusion signatures, including those written for use with the popular open-source Snort intrusion-detection system.

ForeScout Technologies Inc. takes a novel--and sneaky--approach to reducing false alarms. After ActiveScout identifies what appears to be a hacker scanning for network vulnerabilities, it feeds the suspected attacker false data, such as user names and passwords. It's the digital equivalent of giving marked bills to a bank robber, says Pete Lindstrom, director of security strategies for Hurwitz Group. When hackers try to use that information to attack the network, ActiveScout recognizes the data and automatically blocks the attacker. "You won't get false positives because the software only reacts when a hacker actually makes his move to attack," Lindstrom says.

Both of the products are available this week. OneSecure's system is priced at $16,495, and ActiveScout prices start at $8,995.