Registered: Aug 2000
Location: Los Dallos, TX
Posts: 1766

SNORT: The Future (as stated by Marty Roesch)
March 21st, 2006 by cvcrud

So today I attented a talk by the creator of Snort, Martin “Marty” Roesch at the University of Texas at Dallas. The talk was entitled “Snort: Past, Present, and Future”. It was a very interesting talk and dialog, given that the audience was in no way dumbed down, and the topic of the future of Snort was the first time any information was revealed to the public about what the future of Snort holds.

So what is the future of Snort? SNORT X

* Target Based Intrusion Detection
* Automatic “SMART” Tuning of Snort Rules and Configuration
* Dynamic Configuration
* Taking advantage of CPU Architecture

What is Target Based Intrusion Detection?

In a sense, its allowing Snort the advantage of knowing the specifics about the machine behind the IP. If Snort had the ability to know the architecture, os, protocols of, etc of the machine that was being targeted, it could effectivly know which rule sets to apply to which IP. Thus, taking quite a bit of load off the system. Plus optimizing the abilities of Snort to better catch and handle the attacks. Which also leads us to the solution of SMART Tuning. When Target Based IDS is introduced, you will no longer need to “tune” your Snort machine. Lots of people go about day to day, with a incorrectly configured Snort machine, falsly thinking they are ok due to their lack of knowledge of Snort. Target Based IDS, as designed by Marty Roesch will effectively take care of that.

Dynamic Configuration?

Who wants, or needs to take down their Snort system evertime they need to load a new ruleset? No one WANTS to, but currently you are FORCED to. This will be no more.

Taking Advantage of CPU Architecture?

Sure, why not? Why not take advantage of the various instructions contained within the various CPU’s? It couldnt possibly make things worse… or could it?


*** NOTE: I have scored an exclusive interview with Marty for my linux blog. Look for it in the near future on my blog.

Report this post to a moderator | IP: Logged

Registered: Jul 2001
Location: Norfolk, VA
Posts: 4735

I've had a coupla beers with Marty. Nice guy. Too bad Sourcefire isn't going anywhere. Navy chose McAffee over Sourcefire because, apparently, managing a few hundred snort boxes is not as easy as managing Intrushield boxes. I called shenanigans but apparently it's true.

Report this post to a moderator | IP: Logged

Registered: Aug 2000
Location: Los Dallos, TX
Posts: 1766

Just because Sourcefire lost one contract, does not mean they arent going anywhere. Actually a much larger company is about to aquire Sourcefire (leaving execs in place).

Report this post to a moderator | IP: Logged

Registered: Aug 2001
Location: Hilbert Space
Posts: 35776

Assuming that it doesn't just turn into an IP acquisition.

Report this post to a moderator | IP: Logged

Registered: Aug 2000
Location: Los Dallos, TX
Posts: 1766

Its actually a foreign capitolist company. Apparently the same group that brokered the Dubai ports deal, is the same group in charge of brokering the deal with sourcefire.

Report this post to a moderator | IP: Logged

Registered: Aug 2001
Location: Hilbert Space
Posts: 35776

That wouldn't particularly reassure me, in that it could still be the IP that they're after.

I wonder if there are export restrictions on Sourcefire products.

Report this post to a moderator | IP: Logged

Registered: Aug 2000
Location: Los Dallos, TX
Posts: 1766

I doubt it unless there is just xome highly advanced military used algorithym[?] in their product... but you never know, as alot of the encryption technology isnt supposed to exported. (Who the hell uses Blowfish anyway?)

Report this post to a moderator | IP: Logged

Registered: Aug 2001
Location: Hilbert Space
Posts: 35776

Not sure if general IT security-related technologies are covered by the export restrictions or not.

Report this post to a moderator | IP: Logged

Registered: Jul 2000
Location: A New England
Posts: 9187

They are.

Report this post to a moderator | IP: Logged

Registered: Jul 2001
Location: Norfolk, VA
Posts: 4735

Eh, it's not just that they lost one contract. They were unable to get a contract with any large government department, from what I understand (I could be wrong).

It seems as if he is having trouble selling his idea to Management, <i>even though</i> all the people actually doing IT security know that snort is a superior product to, say, Intrushield or NetRanger.

I don't think any export restrictions will hold up so long as snort remains OSS. It's not as if those dastardly Israelis can slip something in when anyone in the world can see the source.

Report this post to a moderator | IP: Logged

Registered: Feb 2004
Location: in colorado somewhere!
Posts: 26669

I bet he would dumb ME down.

__________________

[Ignore Sig]

FUCK YOU YOU FUCKING FUCK FUCKER EEEEEEEEEEE!!!

Report this post to a moderator | IP: Logged