Enterprise-grade Linux: Five network security FOSS apps

David M Williams
Wednesday, 23 January 2008 18:42

Opinion and Analysis

The old adage, you get what you pay for, doesn’t have to apply. In fact, for a small business the high price tag of “threat management” software can often mean a company will just go without to its detriment. Here’s some high quality free and open source software to help, at a price any CFO will love.

Sure, Symantec, MessageLabs, SonicWall, Cisco, Juniper and other big names appear to have the market sewn up. Yet most IT Managers are far too busy or strapped for cash to investigate all the options and demo a range of expensive options. Yet it is a sad situation for any company to expose its network and users to risk due to price – and network security isn’t an island; in this connected world any organisation’s lack of protection could well mean be the key to the next DDoS attack against your domain let alone the relentless flood of spam and viruses.

Open source software is an excellent choice; price is not an issue and, at worst, there’s no obligation to continue with an open source product if you find it does not in fact meet your needs; there’s nothing worse than continuing with an ineffectual product just because you feel committed due to the size of the cheque you wrote.

However, often businesses are dubious of the merits of free software and a sense of fear that such products will be abandoned or lacking in support. Yet there are many robust and stable free open source products available which are used extensively and that come with literally a worldwide community of fellow implementers. The most-used web server in the world, Apache, is a striking FOSS example.

Obviously, there is a lot of software out there. This makes it hard for a company to know where to begin, and how to separate what’s good from what’s not quite so good. We’d like to help: here are some excellent security applications which every business should put on their list to consider. Each one has a wide user base, a load of support and is proven and robust.

Snort
I’ve previously covered Snort, but it has to be mentioned again. Snort is an industry standard for both detecting and, importantly, preventing intrusions.

Where Snort has a lot of strength is its massive collection of signatures which help it understand just what the network traffic flying about really means. Snort will tell you not just which computer is communicating with who, but what it is doing – be it e-mail, FTP, web browsing, DNS requests, IRC or something more nefarious like any of a large number of known network nasties.

Snort is well entrenched and as a result there’s a large collective interest in developing new up-to-date signatures. It is a well-proven and future-proof system that should definitely be short-listed for network security.

ClamAV
It’s a sad truth that all organisations need an anti-virus solution. Now, let’s clarify one thing: yes, Microsoft Windows is far more predisposed to virus problems than other operating systems but this does not negate the need for Linux shops to scan also.

Read on ...

CONTINUED