Paul,
I wonder how many sales guys are going to e-mail you pretending to be
from a competitor ;)
Paul
-----Original Message-----
From: Paul Schmehl [mailto:pauls@utdallas.edu]
Sent: Tuesday, January 31, 2006 4:45 PM
To: focus-ids@securityfocus.com
Subject: Real world experience with HIDS
I have some questions for real world users (not vendors) of HIDS
products.
If you are using HIDS products *and* you're happy with the results,
please
respond to the following quesitons.
1) Ease of install - can it be done through GPO? SMS? Login scripts?
2) Usefulness of the information generated - have you detected any
exploits? How were you notified? Etc.,
3) Centralized management - is there any? If so, how easy is it to use?
Configurable at the host level? Or group of hosts level?
4) Access to data - is it possible to restrict access to the data so
that
an administrator on the server would *not* be able to see the output of
the
HIDS?
5) Interference with the server - does it consume lots of memory or CPU?
Is it proactive or passive?
6) Would you purchase again, if you had the option?
PLEASE NOTE: Any vendor on this list who emails me suggesting their
product will be automatically dropped from consideration, so be
forewarned.
You're welcome to respond on the list, if you like, but don't email me
or
you'll be eliminated from consideration.
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
