The issue is using some of the methods you mention, they device is already
on the network before you find out if they are running anything not allowed.
VAM and/or IPS solutions are not the right tool for this job. Network
Access control products are. A good mechanic is only as good as their
tools!
alan
StillSecure
Alan Shimel
Chief Strategy Officer
O 303.381.3815
C 516.857.7409
F 303.381.3881
email ashimel@stillsecure.com
blog http://ashimmy.typepad.com
www.stillsecure.com
The information transmitted is intended only for the person
to whom it is addressed and may contain confidential material.
Review or other use of this information by persons other than
the intended recipient is prohibited. If you've received
this in error, please contact the sender and delete
from any computer.
-----Original Message-----
From: barcajax@gmail.com [mailto:barcajax@gmail.com]
Sent: Tuesday, July 04, 2006 10:14 PM
To: focus-ids@securityfocus.com
Subject: Re: IDS
Based on your described requirement, you are looking in the wrong direction
because IDSs do not provide you with a profile of the patch level of
individual nodes.
There are two ways (automated or manual) to tackle your need. The manual
method involves either scanning the machine to identify missing patches (eg.
Nessus or MBSA) or triggering an update on the machine itself (eg. Windows
Update).
The automated alternative involves deploying a patch management solution
(eg. PatchLink, Citadel Hercules or SUS/SMS) or a quarantining solution that
does not allow a machine with network access until a predefined patch level
is met.
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
