Effective Intrusion Detection (White paper).pub

The rapid growth in their use is largely based on the premise that any operational IT system is likely to be the subject of some form of attack, or reconnaissancetype activity, during its lifetime. Certainly, in the case of Internet-facing systems, many are likely to be probed, scanned and interrogated within the first few hours of being connected to a network. It’s important, also, to consider the decreasing lifespan of malicious attacks. A shrewd and determined attacker can easily scan a system for vulnerabilities, gain access to it, modify or remove information and then eradicate any trace of their actions in a matter of minutes. It really doesn’t take long.