The Future of IDSs

Although the system audit function that represents the original vision of IDSs has been a formal discipline for almost fifty years, the IDS research field is still young, with most research dating to the 1980s and 1990s. Furthermore, the wide-scale commercial use of
IDSs did not start until the mid-1990s.
However, the Intrusion Detection and Vulnerability Assessment market has grown into a significant commercial presence. Technology market analysts predict continued growth in the demand for IDS and other network security products and services for the foreseeable
future (with IDS product sales projected to reach $978 million by 2003.)

Even while the IDS research field is maturing, commercial IDSs are still in their formative
years. Some commercial IDSs have received negative publicity due to their large number
of false alarms, awkward control and reporting interfaces, overwhelming numbers of attack
reports, lack of scalability, and lack of integration with enterprise network management
systems. However, the strong commercial demand for IDSs will increase the likelihood that
these problems will be successfully addressed in the near future.
We anticipate that the improvement over time in quality of performance of IDS products
will likely parallel that of anti-virus software. Early anti-virus software created false alarms
on many normal user actions and did not detect all known viruses. However, over the past
decade, anti-virus software has progressed to its current state, in which it is transparent to
users, yet so effective that few doubt its effectiveness.
Furthermore, it is very likely that certain IDS capabilities will become core capabilities of
network infrastructure (such as routers, bridges and switches) and operating systems. In this
case, the IDS product market will be able to better focus its attention on resolving some of
the pressing issues associated with the scalability and manageability of IDS products.
There are other trends in computing that we believe will affect the form and function of
IDS products including the move to appliance-based IDSs. It is also likely that certain IDS
pattern-matching capabilities will move to hardware in order to increase bandwidth.
Finally, the entry of insurance and other classic commercial risk management measures to
the network security arena will drive enhanced IDS requirements for investigative support
and features.

Conclusion
IDSs are here to stay, with billion dollar firms supporting the development of commercial
security products and driving hundreds of millions in annual sales. However, they remain
difficult to configure and operate and often can’t be effectively used by the very novice
security personnel who need to benefit from them most. Due to the nationwide shortage of
experienced security experts, many novices are assigned to deal with the IDSs that protect
our nation’s computer systems and networks. Our intention, in writing this document, is to
help those who would take on this task.
We hope that this publication, in providing actionable information and advice on the topics,
serves to acquaint novices with the world of IDSs and computer attacks. The information
provided in this bulletin is by no means complete and we recommend further reading and
formal training before one takes on the task of configuring and using an intrusion detection
system.

I'm reading: The Future of IDSs