Re: IDS evaluations procedures

On 7/22/05, Nathan Davidson <ndavidso@globix.com> wrote:
> I know that a lot of people are sceptical about marketure claims for IPS
> and Application firewalls (aka active traffic processing?) and would
> prefer to stick with the less risky approach of IDS (active/passive
> monitoring?) but I think despite the hype there is significant merit in
> this technology.

Hi Nathan,

Thanks for all of your thoughts.  

I don't see this as an either/or issue.  Good security requires
prevention AND detection.  An IDS (probably another misnamed device)
should be a policy failure detection system and a network transaction
logging system.  It should keep track of what's happening on the
network to identify when access controls fail, and provide evidence in
an incident response scenario.  That framework is what I call "Network
Security Monitoring."  NSM is completely separate from the
protection/prevention aspect of network security, although tight
controls simplify detecting suspicious and malicious activity.

Sincerely,

Richard
http://www.taosecurity.com

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------