By now, you've probably been hit up by every security vendor about their latest intrusion detection or intrusion prevention products that can do everything from stopping viruses to reconfiguring your firewalls. Unfortunately, most of the commercial systems will set you back a small fortune. What's a budget-minded security manager to do when some sort of alerting system is needed, especially when the next fiscal year is many months away? There are several free tools out there to get you on your way to being well-informed when hackers knock at your door.
First, you need to have a tool in place to analyze network traffic, most importantly near the Internet border of your network. Snort is, by far, the leading free IDS software available, although commercial versions of Snort are now available as well. Snort can be configured to watch any traffic. Typically, you'll want to replicate your Internet inbound traffic to one or more switch-ports [in Cisco terms, you'll span traffic to a port], where you'll have a Snort-equipped computer running. Your only cost is the computer itself, which can run on Linux or Windows. Often, a spare PC with a decent-sized hard drive will do fine. Snort can dump suspicious looking traffic to log files, after which you can setup any of several free alerting tools, to monitor the log files and e-mail or page you when such traffic occurs.
Second, you must have a way to analyze system security logs. Working your way in from the border of your network, make sure your border router is configured to send syslog messages to a server you can access from inside your network. Some firewalls can send syslog messages as well, which you can direct to the same internal server. Also make sure servers in your demilitarized zone [DMZ] are either accessible from the inside, or configure their event logs to point an internal server. Making these configuration changes to routers, firewalls and servers is not as difficult as you might think and usually takes just a few commands or mouse clicks. Once your log files are accessible, it's time to install free alerting tool or write your own.
If you're interested in writing your own alerting tool, Batch, Perl or other free scripting tools can be used to execute parsing commands, such as the Windows "find" command or the Unix "grep" command. This can help you find suspicious-looking activity in the log files from both Snort and your sever, router and firewall security logs. A free e-mail program, such as Blat, can then be used to send log entries to your pager, cell phone or e-mail.
This is definitely a crash course in developing a budget alerting system, but you'll be surprised at how well you can be alerted to things like port scans and failed login attempts at an extremely low cost.
About the author
Vernon Haberstetzer, president of security seminar and consulting company i.e.security, has seven years of in-the-trenches security experience in healthcare and retail environments.
