What is a 'top-down' IPS sensor search?

You may be familiar with the "top-down" matching approach from the world of firewalls. When a firewall encounters new traffic, it starts at the top of its rule base and checks each rule to see if it matches the traffic. When the firewall finds a match, it performs the specified action and stops checking. Even if traffic matches more than one firewall rule, it will only be affected by the rule base's highest priority rule: the one that is first from the top.

IPS sensors typically use the same methodology: they process intrusion signatures beginning at the top of the list and then perform the action specified in the first matching rule. For this reason, it's important for every organization to sort its IPS signatures so that the most important rules are at the top. That way, when a packet matches multiple signatures, you'll be certain that the highest priority rule dictates the IPS response. Sorting your rules in this manner is a fairly simple process. In fact, the easiest way to approach this problem is to order them by the severity of the response: place all of your "reject" rules at the top of the list, followed by your "alert" rules, followed by your "allow" rules. This will ensure that the strongest applicable response takes priority.

Rate this Tip To rate tips, you must be a member of SearchMidmarketSecurity.com. Register now to start rating these tips. Log in if you are already a member. Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Detecting and preventing network intrusions Network-based integrity monitoring keeps website hacks in check Avoid security risks of Free Public WiFi wireless ad hocs Examining Conficker: When a worm becomes a botnet Stolen FTP credentials likely in latest website attacks PCI DSS requirement: Protect cardholder data Network security begins with device discovery and assessment Five steps to eliminate rogue wireless access Assess your security state in five steps Conficker flaw yields new tool for detection Quiz: Intrusion defense in the era of Windows Vista RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary intrusion detection  (SearchMidmarketSecurity.com) Snort  (SearchMidmarketSecurity.com) RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.