Welcome to ISAserver.org

Intrution Detected, is that a bad sign?

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 General ] >> General >> Intrution Detected, is that a bad sign?

Page: [1]

Message

<< Older Topic Newer Topic >>

Intrution Detected, is that a bad sign? - 6.Aug.2008 9:58:02 PM

xl@n3

Posts: 5
Joined: 5.Aug.2008
Status: offline

Hi everyone, I found a lot of intrution detected under Alerts on my isa2k4. The thing is, some of the ip's detected are sites that we do business with. It won't show up again when i block it on our DSL but the problem is, these sites needs to be access by our office...so i'm wondering what's causing these intrutions and how to solve it...does anyone have an idea?

thanks...

Post #: 1

Featured Links*

RE: Intrution Detected, is that a bad sign? - 7.Aug.2008 12:14:55 PM

Rotorblade

Posts: 963
Joined: 27.Feb.2007
Status: offline

Hi,

What�s causing the alerts? You have enable IDS in ISA and it�s alerting you that one of or all of the seven attack types has been detected and triggered. This article link below describes the ISA feature. http://www.redline-software.com/eng/support/docs/isaserver/CMT_IntrusionIntro.php . You can also set actions based on the trigger if necessary.

Stopping it, well you could be in for a tedious task. Port scans for instance are a common thing and I probably would not go to the trouble of termination of service if it occurs. Blocking as you are doing is probably not good either. False positives do occur and blocking is probably not called for. If and an alert is triggered and determined to be malicious, then blocking may be called for. Penetration testing is always a good way to determine if you at risk for compromise. ISA does a pretty good job in protecting your IT assets but it�s only as secure as the person who configured it or the applications you have published behind it!

HTH

RB

_____________________________

David Melvin
Ohio
MCSE: Security 2003, MCSA:Security 2003

(in reply to xl@n3)

Post #: 2

RE: Intrution Detected, is that a bad sign? - 7.Aug.2008 5:41:34 PM

xl@n3

Posts: 5
Joined: 5.Aug.2008
Status: offline

thanks for the infor david...the isa was already installed when i first started here.. i'm looking for ways to improve and strengthen our isa thru the help of this forum....and for sure does help.

thanks

(in reply to Rotorblade)

Post #: 3