A Tool To Reduce False Security Alerts - InformationWeek
IoT
IoT
News
News
7/30/2003
01:22 PM
50%
50%
RELATED EVENTS
[Dark Reading Crash Course] Finding & Fixing Application Security Vulnerabilitie
Sep 14, 2017
Hear from a top applications security expert as he discusses key practices for scanning and securi ...Read More>>

A Tool To Reduce False Security Alerts

Software which works with the popular Snort intrusion detection system can slash false alarms up to 70%, Qualys says.

False security alarms--warnings about attacks that actually aren't attacks--are a burden for security administrators who attempt to use intrusion-detection systems to spot potentially malicious activity against their applications, systems, and networks.

Software vulnerability-assessment vendor Qualys Inc. Wednesday released a tool, Quidscor, that it says will reduce false alarms for users of the popular and free Snort intrusion-detection system. Quidscor can slash Snort's false positives by up to 70%, says Gerhard Eschelbeck, CTO and VP of engineering at Qualys.

Quidscor is an open-source correlation engine that merges vulnerability data from a customer's systems with Snort IDS attack information, Eschelbeck says. For example, if an attacker is attempting to attack a company's server with an attack technique that only works on Apache servers, but the company is running server software from Microsoft, the user won't get an alert because its systems aren't vulnerable to that specific attack.

The correlation engine also can help to prioritize the alerts that do get through so customers can focus on attacks that are most threatening to their systems, he says.

"This is a great start and hopefully a direction other vendors will move to help solve the false-alert problem with IDS systems," says Eric Ogren, senior analyst with the Yankee Group. "This can help reduce the complexity of managing IDS systems," he adds.

Quidscor is available for download at http://quidscor.sourceforge.net.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
2017 State of IT Report
In today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.
Video
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll