Re: Firewalls (was Re: IDS evaluations procedures)

On Jul 26, 2005, at 2:51 AM, Sanjay Rawat wrote:

> Hi Richard
> I am agreed on the difficulty in defining an attack properly. in  
> fact recently i joined a company as a kind as intrusion analyst.  
> Before that i was in academic environment doing my PhD in IDS. what  
> i observed is that signatures are concentrating more on a  
> particular exploit code rather than the true exploit/vulnerability.  
> i am specifically talking about Snort signatures.

Check out the Snort rules that are being produced by the Sourcefire  
VRT, I think you will find them to be targeted at vulnerability  
detection and protocol analysis when possible.  Not all Snort rules  
are created the same.

    -Marty

--
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Network Defense for the Real World - http:// 
www.sourcefire.com
Snort: Open Source Intrusion Detection and Prevention - http:// 
www.snort.org




------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------