El vie, 24 de 12 de 2004 a las 16:07, Andrey Todorov escribiC3:
Hi People,
I tried several times to subscribe myself to "Security Basics" mailing
list to ask my questions, but didn't succeed. Excuse me if my
questions
aren't adequate to "Focus IDS" mailing list!
I'll be very gratefull if you share your opinion with me for the
following situation. I have small network (5 PCs) behind one Linux box
(iptables firewall , Pentium I 166Mhz, 32MB RAM, 4GB HDD) and want to
increase security for this network.
1. Do I need IDS?
In this days I think *everyone* needs an IDS, obviously I'm
talking if they want to be aware of all the threats that comes
from the internet. It's not really something you need, but
probably something you want. And it can be as problematic as
you want. You can simply take a look at the data it logs to
be aware of the danger or you can do some more work and tune
it to log all the attacks to your network. Obviously that's
just my opinion.
The only matter I see with your configuration it's that the
machine you are using as a firewall it's not enough to run
snort in a confortable way, you need some more power, at least
more memory.
2. What do you think about Snort? Can I find easy maintainable
free/opensource IDS then Snort?
I bet the best Opensource IDS you can find it's snort, and with
more reasons now that it's being merged with the snort-inline
project. You can also try Portsentry, that it's a different
approach to the IDS field.
3. What IDS literature should I read?
You have plenty of it in the snort.org site.
Thank you in advance!
Andrey
Regards.
--
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÃA
The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
