Re: on NIDS/NIPS tuning

[Jason Falciola <falciola () us ibm com>]

OnThursday, June 09, 2005 at 4:37 PM, "Anton A. Chuvakin"
<anton () chuvakin org> wrote:

] So, here it is: how many folks who buy/download a NIDS/NIPS actually tune
] it? Long time ago when I was asking this question the previous time, I
was
] scared to learn that lots of people do not tune their NIDSs. Is it any
] better now?

Hi Anton,

We certainly *do* tune our IDS devices (whether IDS/IPS of the network,
host, or wireless variety), and have been doing so since day one.  The
volume of false positives would make it impossible for us to operate
otherwise.

We make many modifications to the vendors' defaults (based on years of
research, experience, and testing) and also tune on a per client basis,
with a very high level of granularity in our filters.

One observation here that applies across the board, whether or not you're
operating as a MSSP:  communication with all teams involved and an intimate
understanding of the networks/hosts in question is critical to appropriate
IDS tuning.

Jason Falciola
Security Intelligence Analyst
IBM Managed Security Services
falciola () us ibm com


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------