RE: Hi, I want to study IPS

["Runion Mark A FGA DOIM WEBMASTER(ctr)" <mark.runion () us army mil>]

Vaporwar-ish, or vapor-ware-ish?

IPS is a wonderful concept.  The few working incidents I've worked with are
much larger scale, and use a more structured network.  The concept discussed
here as "IPS" is terribly limited if only implemented as a standalone piece
of a network security wall.

Consider using IDS on lan segments comprising pieces of the inbound and
outbound traffic lanes in a network.  These system push gathered data to a
control center (distributed if you can afford it).  The control center
monitors and tracks applicant data across the entire network (imagen a telco
that might own the entire US data backbone).  The control center might have
various means of monitoring, tracking, and escalation for various in process
attacks.  The notion that a distributed Denial of Service cannot be stopped
is a bit out of date.  Many are, but it is always a credible legal issue.

Imagen Johhny the Scumbag, sitting in his apartment on 46th street.  Starts
his attack using <insert pathetic script here>, and sits back to see the
results.  10 seconds later his cable modem stops transmitting.  20 minutes
later, there is a knock on the front door; the Police would like to chat.
Okay, so the police actually getting there in 20 minutes is voyeuristic, but
it could happen, maybe...

-
Mark Runion

"Vapor trails are what novices try to follow, though never noticed by those
who do it."
 

-----Original Message-----
From: Raistlin [mailto:raistlin () gioco net] 
Sent: Saturday, May 22, 2004 1:49 PM
To: Greg Martin; focus-ids () securityfocus com
Subject: Re: Hi, I want to study IPS

Greg Martin wrote:
> Some vendors use a baseline of the network and take
> action if the baseline changes drasticly.  

Examples ?

> Some use a 'negative
> space' technique which allows only valid traffic and considers all
> other traffic as a dos and drops it completely.  

Again, examples ?

IMHO IPS are nothing more than an integration of a firewall and an IDS 
concept. As such, they are rather fuzzy and vaporwar-ish enough to be 
very marketable.

-- 
Stefano "Raistlin" Zanero
System Administrator Gioco.Net
public PGP key block at http://gioco.net/pgpkeys


---------------------------------------------------------------------------

---------------------------------------------------------------------------

---------------------------------------------------------------------------

---------------------------------------------------------------------------