Front cover - IBM Redbooks

106 Lotus Security Handbook
Utilizing intrusion detection can not only detect an attempted attack in progress,
but it can also alert you to the fact there was a successful attack that breached
some area. While some breaches are obvious, like vandalizing your corporate
Web page, some attacks would easily go unnoticed.
A question we hear some clients ask, “Is [network] intrusion detection considered
wiretapping?” This brings up interesting ethical questions; however, the legal
concerns regarding the definition of wiretapping vary widely in different countries.
In most countries, it is permissible to monitor activity on your own equipment,
although there may be limitations on what content can and cannot be monitored.
It may also vary depending on whether the monitoring is for internal users
(employees) as opposed to external customers. In the U.S., there is legal
precedence that allows an employer to monitor the usage of company-owned
equipment by employees. However, we recommend that all internal monitoring of
employee activity be clearly spelled out in either an employment policy or a
security policy (or both).
There are four basic categories of IDS: network (NIDS), host integrity, activity
monitors, and content scanners. The latter is not always viewed as an “IDS,” but
since most people would agree that an e-mail virus is a type of attack, then a
virus scanner can be considered a specialized type of IDS. We discuss these
different types of IDS in 4.1.5, “Intrusion detection systems” on page 128.
A critical factor in the effectiveness of most intrusion detection is using current
signature files. New vulnerabilities are discovered constantly, and new methods
for attacking systems are also discovered all the time. Signature files provide the
IDS with the latest patterns that indicate a type of attack, such as a denial of
service attempt or a new virus, worm, and so forth. Note that the signature file
updates are not the same as updates to the IDS code itself. We discuss
application and OS code updates in “Apply security vulnerability updates” on
page 110.
3.2.2 Data integrity assurance
In this section, we describe the following methods for ensuring data integrity:
1. Ensure data remains unaltered in transit.
2. Provide integrity access controls for filtering updates and administration.
3. Support business continuity through redundancy and fail-over.
4. Utilize secure tools for maintenance activity to required subsystems.
5. Require infrastructure components to have all security vulnerability updates
applied in a timely manner.
6. Utilize operational procedures that include auditing and reporting.