RE: Is snort an overkill for desktop only environment ?

["Rivest, Philippe" <PRivest () transforce ca>]

I'M not sure we are tackling this the right way. The question that was ask
is "is it overkill for a desktop only environment".

Every time you want to implement a control, you need to evaluate if you need
it (cost-benefit). If theres no need for IDS (H-N) at all, don’t implement
them. But if you are the NSA and have (for what ever reason) a desktop only
environment in on of their branch/location, you MIGHT want to have these
controls. But at home, I really don’t care about a N/H-IDS.

So yes its overkill if your environment does not need that level of
protection and No its not overkill if you need it.

Risk management all the way.

 
Philippe Rivest - CEH, Network+, Server+, A+
TransForce Inc.
Internal auditor - Information security
Verificateur interne - Securite de l'information

8585 Trans-Canada Highway, Suite 300
Saint-Laurent (Quebec) H4S 1Z6
Tel.: 514-331-4417   
Fax: 514-856-7541

http://www.transforce.ca/



-----Message d'origine-----
De : listbounce () securityfocus com [mailto:listbounce () securityfocus com] De
la part de pleed
Envoyé : 24 novembre 2009 16:38
À : security-basics () securityfocus com
Objet : Re: Is snort an overkill for desktop only environment ?

Alexander Klimov wrote:
> On Tue, 27 Oct 2009, [ISO-8859-1] Jos? Manuel Molina Pascual wrote:
>   
> > If you have the HW and some time to do it.... Why not?
> >     
>
> Because every new software package you install is a potential
> source of exploitable flaws, even more so if it is always
> working and getting its inputs from network.
>
>   
In my opinion NIDS on the host itself does not make the box more secure.
When deploying snort, you normaly want to know if there already has been a
_successful_ attack, because when connecting to the internet you re
always being
attacked but mostly without any affect to your system. In your case if
your desktop
is attacked successfully, i wouldnt trust the NIDS output anyway.
In addition snort is just helpfull if someone is looking into the alerts
24/7.

I think you should spend your time with more productive stuff. But for
educational purpose
playing with it is never wasted time.

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL
certificate.  We look at how SSL works, how it benefits your company and how
your customers can tell if a site is secure. You will find out how to test,
purchase, install and use a thawte Digital Certificate on your Apache web
server. Throughout, best practices for set-up are highlighted to help you
ensure efficient ongoing management of your encryption keys and digital
certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727
d1
------------------------------------------------------------------------

Attachment: smime.p7s
Description: