There are a few issues that I would have with IDSMC auto-updating.
First, updates for IDSMC are released in two flavours; application updates and sensor (aka signature) updates. Given this, which one would you want IDSMC to perform "automagically" without any intervention? Assuming that it’s the sensor updates you want to automate, there's now an issue of defining just how "automatic" you want it be.
Sensor updates are distributed from the Cisco web site (http://www.cisco.com/cgi-bin/tablebuild.pl/idsmc-ids4-sigup) in ZIP format. Do you just want IDSMC to find a new sensor release and download it automatically or do you want IDSMC to deploy it to the sensors automatically as well?
Automating the deployment of Signature updates, in my mind anyway, is not a very good idea. This is primarily due to the fact that you’ll end up with a signature update in place with no prior opportunity to gauge its impact on your IDS, your alert monitoring solution (be it Secmon or a SIMS) or the personnel receiving these alarms. The manual process at least gives you an opportunity to consider the necessity of the signature deployment and let you decide if you really need it now or if it can wait until the next release. If necessary, you then can give a “heads up” to anyone impacted by the configuration change. If you’re in an environment where change management tracking and update testing are required prior to production deployment, automatic updates are useless.
As for IDSMC application updates, that too is something that I would want an opportunity to review and possibly test before I put it into production, but I digress.
Additionally, there’s the whole issue of the impact on your infrastructure should you allow auto-updates. There are bandwidth (first, the initial download of the signature and then its subsequent deployment to your IDS grid) and sensor availability considerations to keep in mind. Most organisations mandate major updates where bandwidth will be impacted take place off-peak. Also, the sensor isn’t monitoring when it’s being updated. The lack of coverage imposed by a sensor update is something that should be scheduled and signed-off on by the appropriate management to avoid problems (both operational and administrative).
In any case, the biggest negative I see is the additional overhead and potential performance impact on IDSMC itself should something like this be added to the code.
Of course, this is all just my 2 cents…
Alex Arndt
