Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Focus-IDS
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: on NIDS/NIPS tuning

from [Ramon Kagan] Network Security [Permanent Link]
Subject: Re: on NIDS/NIPS tuning
Date: Fri, 10 Jun 2005 08:20:38 -0400 (EDT) 
HI,

We continually keep our NIDS and NIPS tuned, adding new rules, removing
bad ones (false positives or just too heavy to run), etc.  I don't quite
see how one can do otherwise.  I just don't see how anyone can consider
either a Plug 'n Play solution.  In fact it would become a Plug 'n Pray
solution.

Ramon Kagan, GCIA
York University, Computing and Network Services
Information Security  -  Senior Information Security Analyst
(416)736-2100 #20263
rkagan@yorku.ca

-----------------------------------   ------------------------------------
I have not failed.  I have just        I don't know the secret to success,
found 10,000 ways that don't work.     but the secret to failure is
                                       trying to please everybody.
        - Thomas Edison                         - Bill Cosby
-----------------------------------   ------------------------------------

On Thu, 9 Jun 2005, Anton A. Chuvakin wrote:


All,

I was thinking about some issues with IDS alerts (their volume, etc) and
realized I could use some help from the list. It might also be a  fun
discussion item.

So, here it is: how many folks who buy/download a NIDS/NIPS actually tune
it? Long time ago when I was asking this question the previous time, I was
scared to learn that lots of people do not tune their NIDSs. Is it any
better now?

Best,
--
Anton A. Chuvakin, Ph.D., GCIA, GCIH, GCFA
     http://www.info-secure.org
   http://www.securitywarrior.com


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------




--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: on NIDS/NIPS tuning, Drew Simonis
Next by Date:  RE: IDS\IPS that can handle one Gig, Andrew Plato
Previous by Thread:  on NIDS/NIPS tuning, Anton A. Chuvakin
Next by Thread:  Re: on NIDS/NIPS tuning, Bob Huber
Indexes:  [Date] [Thread] [Top] [All Lists]