Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can be assured that the attack is most unlikely to be unsuccessful. But how do we determine if an attack is successful for events that are set to alert only?

In cases like these, I would look at the payload and PCAP to grab as much information as I can. However, most of the time, I still can't determine if the attack is successful.

For cases like these, how do we determine if an attack is successful?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

A successful attack by definition will not be detected by IPS or IDS.

What IPSs and IDSs are good for is weeding out script kiddies, worms and similar attackers.

If you want to have a relatively secure web application you need to use a web application firewall with a default deny rule set. Yes, it hurts to configure it this way and it will take a bit of time, on the other hand, it is really a "fire and forget" solution. The only time the rule set has to change is when the application changes (which you know about), not when attackers think about a new way around IPS or IDS (which you, or your IPS/IDS supplier, don't know about).

IPSs and IDSs "enumerate badness" and this just doesn't work any more: The Six Dumbest Ideas in Computer Security

share|improve this answer
add comment

It depends on the product. Some products have the ability to capture the response packet(s) as well as the attack packet(s). Some products, notable IBM Proventia, will annotate the original event with a success/failure notification, which you can see if you open up the details of the event. For example, all HTTP events in Proventia will include not only the URL of the attack, but also the response code (200, 404, 500, etc.).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.