Vulnerability & Exploit Signatures

[Jackson Yu <jackson.yu () earthlink net>]

Hi, I'm new to this list, so please bear with my question:

ASIC/FPGA/Software/detection techniques aside, I sense that a huge value of IPS 
vendors are the lab-type organizations that are constantly developing new filters
in response to new vulnerabilities and exploits.  However, there's no way that such
vendors can "hit the market" if you will with 2000+ filters out on day
one.

Do all these vendors license the same set of "base" filters from, say,
Sourcefire / Snort derived rule source in the back?  Is there a commonality there?  At the end of the day, can I say 
that "Gee, most vendors' base set of 1500 IPS signatures are the same, its just the 300 or so that the vendors have 
additionally developed on top of that 1500 that are different!"


Thanks

Jackson



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------