Best practices would dictate the management device is on a separate
segment with strong access control with only the necessary access to
manage the devices and receive logs. This is for both the prevention of
an attack on it and the compromise of any logging data it might contain.
That being said, from the Cisco side which I am most familiar with, the
CSA agent is installed on the VMS management console with a pretty
restrictive rule set and the management device is locked down pretty
tight. I still try to put it on a separate segment whenever I can.
M. Dante Mercurio, CISSP, CWNA, Security+
-----Original Message-----
From: Biswas, Proneet [mailto:pbiswas@ipolicynetworks.com]
Sent: Thursday, March 24, 2005 2:35 PM
To: focus-ids@securityfocus.com
Subject: IDS/IPS Management devices
One of the issues which we have seen with IDS/IPS vendors shipping
Management stations to manage their devices is that customers start
questioning how secure the management station is as it is mostly windows
based platforms and there are no Anti-Virus software etc. running on
them. So is it safe to suggest that the management station should be
sitting behind one of the security devices which is managing it. Any
thoughts ?
------------------------------------------------------------------------
--
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
