Conyac で依頼された翻訳結果を公開

INTRUSION DETECTION AND MONITORING

Maintaining Internet gateway security requires ongoing and comprehensive system operation, support and surveillance to oversee the prevention, detection, response and escalation of any irregular, abnormal or suspicious activities or incidents. This can be achieved by proper manual procedures such as reviewing and analysing log or statistics, and testing the incident handling procedures.

If possible, IDS/IPS tools should be installed and used at strategic locations to collect and examine information continuously for suspicious activity. Both network based and host based IDS/IPS tools could be used. The former type examines network packets in the network while the latter one monitors the system configuration and application activities on a single host system.

Improper configuration and use of these tools may disclose information to attackers and result in a false sense of security.

• IDS/IPS tools should be used to identify suspicious activities on both the network and the host machines, in particular the web server and the mail server.

• Automatic generation of notifications or alerts by electronic messages or mobile paging should be set up to warn system administrators when symptoms of attacks are detected.
• If applicable, systems or functions capable of reacting to suspicious network activity should be implemented to disconnect or block these connections in the first place and record them for subsequent analysis.

• These tools should be properly tested and verified before going operation.

• The use, administration and management of these tools should
be properly controlled and restricted.

• Firewall system should be properly configured to protect and hide such tools as far as possible.

• The attack signature files should be kept up-to-date.

• Proper operating, administrative and monitoring procedures should be established for using these tools.