// vendor response
You can use a SIM to correlate your IDS alarms with your VA scans in
real time to strip out alerts that don't matter (patched systems) while
retaining the ability to get warnings of rogue MSSQL systems (perhaps
embedded in 3rd party products installed by your users). There are
several products on the market, including my company's, OpenService.
Depending on the approach, you don't have to do a detailed inventory
first - SIMs can pick up the details from network traffic and the VA
scan, as well as metadata inputs from you.
Thank you,
Sincerely,
Phil Hollows
VP Marketing
OpenService, Inc.
110 Turnpike Road, Suite 308
Westborough, MA 01581
www.open.com
-----Original Message-----
From: Harper, Patrick [mailto:Patrick.Harper@phns.com]
Sent: Friday, December 31, 2004 4:32 PM
To: CraftedPacket@securitynerds.org; focus-ids@lists.securityfocus.com
Subject: RE: IDS event filtering
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Thresholding is a wonderful thing. And no, I personally do not want
to see alerts on tings I do not have. If I am an all apache shop
then I do not turn on any IIS rules. I also make sure, via scanning
and vulnerability analysis, that I do not in fact have any IIS (or
whatever) installed. You first need to have a good inventory of what
you have. And you need to keep that up to date so you always know
what you have. Then you trim all rules to that. Weather it be
ingress - egress firewall rules, IDS configs, or whatever. Figure
out what you have, learn how it flows (and make it work/flow the
secure way) then monitor it.
- -----Original Message-----
From: Billy Dodson [mailto:CraftedPacket@securitynerds.org]
Sent: Friday, December 31, 2004 9:37 AM
To: focus-ids@lists.securityfocus.com
Subject: IDS event filtering
I am wanting to get an idea of what you guys out there filter from
your
IDS sensors. Some of the sensors I monitor get TONS of events for
MSSQL
control overflows. If the customer is patched for slammer and does
not
have any SQL services on the internet, is it safe to filter out those
events? Do you still want to see that traffic even though you know
your
are not vulnerable? Thanks!
- ----------------------------------------------------------------------
- ----
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks
from
CORE IMPACT.
Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
- ----------------------------------------------------------------------
- ----
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBQdXFLpiWafDb7+B/EQLkZwCgxqFePWcqpCbc4/gTEuaUJYBY6iYAoOKi
xe1e6rLpQeTIU7O+zuW96Fj1
=SkUh
-----END PGP SIGNATURE-----
Disclaimer:
This electronic message, including any attachments, is confidential and
intended solely for use of the intended recipient(s). This message may
contain information that is privileged or otherwise protected from
disclosure by applicable law. Any unauthorized disclosure,
dissemination, use or reproduction is strictly prohibited. If you have
received this message in error, please delete it and notify the sender
immediately.
------------------------------------------------------------------------
--
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
