Software which works with the popular Snort intrusion detection system can slash false alarms up to 70%, Qualys says.
False security alarms--warnings about attacks that actually aren't attacks--are a burden for security administrators who attempt to use intrusion-detection systems to spot potentially malicious activity against their applications, systems, and networks.
Software vulnerability-assessment vendor Qualys Inc. Wednesday released a tool, Quidscor, that it says will reduce false alarms for users of the popular and free Snort intrusion-detection system. Quidscor can slash Snort's false positives by up to 70%, says Gerhard Eschelbeck, CTO and VP of engineering at Qualys.
Quidscor is an open-source correlation engine that merges vulnerability data from a customer's systems with Snort IDS attack information, Eschelbeck says. For example, if an attacker is attempting to attack a company's server with an attack technique that only works on Apache servers, but the company is running server software from Microsoft, the user won't get an alert because its systems aren't vulnerable to that specific attack.
The correlation engine also can help to prioritize the alerts that do get through so customers can focus on attacks that are most threatening to their systems, he says.
"This is a great start and hopefully a direction other vendors will move to help solve the false-alert problem with IDS systems," says Eric Ogren, senior analyst with the Yankee Group. "This can help reduce the complexity of managing IDS systems," he adds.
Quidscor is available for download at http://quidscor.sourceforge.net.
IT's Reputation: What the Data SaysInformationWeek's IT Perception Survey seeks to quantify how IT thinks it's doing versus how the business really views IT's performance in delivering services - and, more important, powering innovation. Our results suggest IT leaders should worry less about whether they're getting enough resources and more about the relationships they have with business unit peers.
What The Business Really Thinks Of IT: 3 Hard TruthsThey say perception is reality. If so, many in-house IT departments have reason to worry. InformationWeek's IT Perception Survey seeks to quantify how IT thinks it's doing versus how the business views IT's performance in delivering services - and, more important, powering innovation. The news isn't great.
InformationWeek Must Reads Oct. 21, 2014InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.