Re: newbie quetsions

Scruggs Stephen D SSgt AFWA/SCHS wrote:
> Even if the
> device has the latest and greatest features and would increase our security
> policy tenfold if we used it, if there was the slightest chance it would
> drop data, we would throw it out immediately.

What you mean, here, is that you will never, ever use an IPS on your 
network, since dropping data is exactly what the thing is used for...

Or perhaps what you mean is that you don't want to lose non-attack data 
(so, you are looking for zero-false-positive tools). Or perhaps what you 
mean is that you don't want to lose packets due to full queues (so, you 
are looking for really fast algorithms). Or perhaps both.

In every case, there IS more than the "slightest chance" an IPS will 
drop data. It's a distinct possibility: it's what the device is used 
for. If the idea is "better not to drop attack packets, because letting 
through ALL legitimate packets is so important to us" then you should 
just look at other technologies.

Stefano

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------