IDS mailing list archives
RE: Definition of Zero Day Protection
From: "Teicher, Mark (Mark)" <teicher () avaya com>
Date: Mon, 9 Aug 2004 13:14:45 -0600
Drew, What host based products would fit this category based on the definition ?? Do they really work ?? -----Original Message----- From: Drew Simonis [mailto:simonis () myself com] Sent: Monday, August 09, 2004 01:07 PM To: Teicher, Mark (Mark); focus-ids () securityfocus com Cc: Seanor, Joseph (Joe) Subject: Re: Definition of Zero Day Protection ----- Original Message ----- From: "Teicher, Mark (Mark)" Date: Sun, 8 Aug 2004 19:47:48 -0600 Subject: Definition of Zero Day Protection
What is Zero Day Protection
It is, as you stated, another marketing blurb, but it isn't just that. Usually, this bit of jargon is applied to a detection/prevention system that uses things like heuristic detection techniques, behavior based detection, protocol anomoly or some other advanced methods. These allow the activity to be blocked or alerted on, as opposed to the specific event. So, for example, a worm can be characterized by certain activity. Say, opening connections to lots of remote hosts in a short period of time. This behavior can be blocked (e.g. the process can be killed) even without knowing that it was WormX. hth, -Ds -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- Re: Definition of Zero Day Protection, (continued)
- Re: Definition of Zero Day Protection Ali-Reza Anghaie (Aug 11)
- Re: Definition of Zero Day Protection David Maynor (Aug 11)
- Re: Definition of Zero Day Protection Stephen P. Berry (Aug 13)
- Re: Definition of Zero Day Protection Martin Roesch (Aug 11)
- RE: Definition of Zero Day Protection Carey, Steve T GARRISON (Aug 09)
- RE: Definition of Zero Day Protection Carey, Steve T GARRISON (Aug 09)
- Re: Definition of Zero Day Protection Drew Simonis (Aug 09)
- RE: Definition of Zero Day Protection Teicher, Mark (Mark) (Aug 09)
- RE: Definition of Zero Day Protection Michal Zalewski (Aug 10)
- Re: Definition of Zero Day Protection Ranjeet Shetye (Aug 10)
- RE: Definition of Zero Day Protection Teicher, Mark (Mark) (Aug 09)
- Re: Definition of Zero Day Protection Andy Cuff (Aug 11)
- RE: Definition of Zero Day Protection Drew Copley (Aug 09)
- Re: Definition of Zero Day Protection Devdas Bhagat (Aug 13)
- RE: Definition of Zero Day Protection Fulp, J.D. USA (Aug 09)
- RE: Definition of Zero Day Protection Joshua Berry (Aug 10)
- RE: Definition of Zero Day Protection Brian Smith (Aug 10)
- RE: Definition of Zero Day Protection Teicher, Mark (Mark) (Aug 10)
- RE: Definition of Zero Day Protection Brian Smith (Aug 10)
- RE: Definition of Zero Day Protection Drew Copley (Aug 10)
- A Network IPS Proposal (was Definition of Zero Day Protection) Shaiful (Aug 13)
(Thread continues...)