Re: Newbie question: autoblocking with IDS/IPS

[Mike Johnson <mike () enoch org>]

Daniel wrote:

> I'm thinking of buying one of that new CISCO IDS boxes which can be
> placed inline in the future.

Do you mean the 4240?  If so, we just received a couple of them and 
intend to put them through their paces in our lab.

> Is anybody of you using the automatic shunning (I guess it's called
> so) feature of the CISCO IDS? Does this make sense? (Which signatures
> should be autoblocked?)

We were told that the version of the software that handles blocking is 
not yet shipping.  If anyone knows any different, do tell.  We haven't 
quite figured out our policy on what gets blocked and what doesn't, but 
we'll take it on a signature by signature basis.

> Or are you just monitoring and then blocking manually?

We're not 100% convinced we'll put them in blocking mode at this point. 
 Ideally, it would be automagic, but false positives lead to blocking 
legitimate traffic by accident.

Mike

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------