Re: INtrusion Detection

[tqbf () secnet com]

Gary Crumrine Tue Feb 17 98

> I think we are becoming too closed minded these days. We need to root out 
> solutions, not attacking each other's ideas

I don't know that I agree with this. I think that computer security
technology improves largely because people attack it, find the flaws in
other ideas, and in doing so provide the motivation and basis for design
and implementation changes. 

If we were cryptographers (some of us may be), we'd be calling this "peer
review", and there'd be little question of the validity of "attacking"
other people's work. From what little I understand of crypto, we have
things like IDEA and Blowfish because of Biham and Shamir's Differential
Cryptanalysis work (for example) --- new attacks against crypto algorithms
inform us of important vulnerabilities, which allows us to design new
algorithms to address those problems.

Likewise, finding faults in other people's ideas for intrusion detection
doesn't kill ID, hurt the community, or prevent us from finding a
solution. Rather, it allows us to progress to more effective solutions
by informing us of the problems that the new designs must address. 

-----------------------------------------------------------------------------
Thomas H. Ptacek                                        Secure Networks, Inc.
-----------------------------------------------------------------------------
http://www.enteract.com/~tqbf                           "mmm... sacrilicious"