The better question is how/where does it stop the spyware? You can have
companies stop spyware from communicating your information to external web
servers via http all day long with a strongly maintained web filter, but if
you don't stop it from installing on your systems, your chasing your tail!
I have yet to see a product that is able to stop it from actually being
installed, and yes, I'm aware of disabling ActiveX. But if a company uses
ActiveX in some of their web apps, what can they do? I see it as more of a
file search tool, which means it's still reactive and would be as
maintenance intensive as .dat/.nav file updates. Some companies boast that
their product can stop spyware, well I can't speak for Tipping Point, but if
they don't stop it from being installed, they haven't stopped it.
Jerry
-----Original Message-----
From: Maynor, David (ISS Atlanta) [mailto:dmaynor@iss.net]
Sent: Thursday, December 02, 2004 9:56 AM
To: Ron; focus-ids@securityfocus.com
Subject: RE: IPS Blocking Spyware?
Importance: Low
I could be wrong but if memory serves me correctly TippingPoint has
rules for 28 pieces of spyware. Double check with a sales rep, but that
number is stuck in my head for some reason.
-----Original Message-----
From: Ron [mailto:iago@valhallalegends.com]
Sent: Tuesday, November 30, 2004 11:36 AM
To: focus-ids@securityfocus.com
Subject: IPS Blocking Spyware?
I've recently heard that Tipping Point's IPS appliance now blocks
spyware programs. Has anybody else heard this / experimented with this?
Thanks!
------------------------------------------------------------------------
--
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
