I realize that I'm a bit late here, but it's been a holiday. We had a
similar discussion on the SNORT mailing list recently and I'll distill
it down for you. The general concensus is that IPS is mostly
marketing hype. Unless you are doing something to identify an attack
in progress in real time and actively doing something (i.e. modifying
a firewall rule or routing table) to stop that attack, you are not an
IPS, because you are not, by definition, preventing anything.
IDS = intrusion detection system
IPS = intrusion prevention system
HTH,
Jimi
On Mon, 22 Nov 2004 15:28:28 -0600 (CST), skill2die4@secguru.com
<skill2die4@secguru.com> wrote:
Can anyone email me a document on how IDS/IPS actually
works.....with the terminology well explained.
IMHO, articles of your interest would be :
FAQ's
============
[FAQ] Sniffing (network wiretap, sniffer)
[FAQ] IDS
Terminology
=============
[AndyCuff] Intrusion Detection Terminology
[A.Cliff] Intrusion Detection Systems Terminology
Basic Papers
===============
[SecurityFocus] An Introduction to Intrusion Detection Systems
[SecurityFocus] Network Intrusion Detection Signatures
[SecurityFocus] Intrusion Detection: Filling in the Gaps
[Cisco] Intrusion Detection Planning Guide
links to all the above is availabe at,
http://www.secguru.com/index.php/content/category/6/145/115/
[ www.secguru.com -> Network Devices -> IDS ]
Also , visit Andy Cuff's site : http://www.networkintrusion.co.uk/
for much info ... :-)
HTH,
-=skillz=-
..
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
--
Thanks,
Jimi
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
