Re: IDS, IPS and encrypted traffic

[Brad Boeckmann <brad () b13 us>]

Daniel,

On October 21, SANS held a webcast for a commerical product that 
decrypted SSL traffic. Check their archieve at 
http://www.sans.org/webcasts/archive.php

Brad Boeckmann.

Daniel Hamburg wrote:

> Hello everybody,
>
> I’ve been looking around the net for a while, trying to find some 
> theoretical and practical approaches to solve the problem of analyzing 
> encrypted traffic.
>
> I know, that there is a need to decrypt the traffic before analyzing 
> it, but I haven’t found any concrete solutions neither for NIDS nor 
> for HIDS yet. Some HIDS vendors announced that their products are 
> capable of analyzing encrypted traffic, but I didn’t succeed to find 
> any details about that.
>
> Does anybody know some products or papers which deal with the problem 
> of analyzing encrypted traffic?
>
> Thanks in advance,
>  Daniel Hamburg
>
>
> -------------------------------------------------------------------------- 
>
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from 
> CORE IMPACT.
> Go to 
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to 
> learn more.
> -------------------------------------------------------------------------- 


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------