Classifying and responding to network intrusions

Addressing security vulnerabilities and system intrusions can represent asignificant administrative overhead in current computer systems. Althoughtechnologies exist for both vulnerability scanning and for intrusion detection,the problems typically require some form of human intervention before theycan be rectified. Evidence suggests that, in many cases, this can lead toomissions or oversights in terms of protection, as administrators are forced toprioritise their attention to security amongst various other tasks (particularlywithin smaller organisations, where a dedicated security administrationfunction is unlikely to be foimd). As a result, mechanisms for automatedresponse to the issues are considered to be advantageous. The paper describesthe problems associated with vulnerability analysis and intriision response, andthen proceeds to consider how, at a conceptual level, the issues could beaddressed within the framework of a wider architecture for intrusionmonitoring. r 1 Ti 111 uTiiiaiiiiiiaianMaiiii 88Advances in Information Security Management & Small Systems Security