10.Conclusions As with any security product designed to protect information systems and the
data they process, there are limitations. If the intrusion detection or prevention
system lacks rules clever enough to detect traffic of interest the system will neither
send alerts nor drop packets appropriately. Keeping your signatures updated and
maintaining other rules intended to find exactly what you want is an ongoing
endeavor.
Another limitation is related to remediation of issues found with a monitoring
system. This is a task very difficult to automate. If the organization does not have a
viable means of responding to incidents and remediation efforts, being alerted on
such events is useless. Often times being able to respond in a timely fashion will
make the difference between an entire network virus infection and limiting
compromises to the fewest amount of systems. Along those lines, ignorance is bliss.
Without response personnel to resolve findings the monitoring systems shed light
on, the organization becomes increasingly liable for knowing about a problem but
not acting on or resolving it. These systems are not magic, they do require
maintenance and will benefit the organization only when coupled with trusted
analysts and personnel to help with remediation efforts. This remediation may
require modification of system configuration or in-depth investigations into system
compromises.
Nicholas Pappas
30
@ 2021 SANS Institute
Author Retains Full Rights
