IDS mailing list archives
RE: How to choose an IDS/FW MSS provider
From: "Sergey V Soldatov" <SVSoldatov () tnk ru>
Date: Thu, 17 Mar 2005 13:20:45 +0300
Andrew, I can't completely agree with you. I can write Snort rules a well and at my point of view the power of open rules is that IDS admin can easily correct these rules or write filters which correspond to their LAN. This will help to mitigate false positives (FPs) and will clarify what's exactly going on in LAN. Yes, you're right that most of admis do not perform special tuning for their IDS - may be this is the reason for thinking that great amount FPs is big problem of IDSs - but vendor should not think in this way... Vendor should provide means to mitigate FPs and false negatives (FNs) and it's up to admin to do something or not. --- Best regards, Sergey V. Soldatov. Information security department. tel/fax +7 095 745 89 50 (1613) "Andrew Plato" <andrew.plato () anitian com To: "Joshua Berry" <jberry () PENSON COM> > cc: <focus-ids () securityfocus com> Subject: RE: How to choose an IDS/FW MSS provider 15.03.2005 19:06 1. I know ISS's language to some extent because I helped develop the engine inside their product (I worked at Network ICE before ISS bought them.) Some are simple pattern matches, many are not. 2. I am familiar with Snort's rules (although I do not profess to be an expert). I also know that Snort's rules, while very powerful and flexible, are WELL beyond the capability of 90% of the IT and network admins in the world. Most organizations don't take the time (nor do they have the time) to analyze signatures. They are more consumed with things like productivity and performance. I know this from my experience (10+ years) as an IT consultant. Thus my point - while seeing the details of a signature is fascinating to security geeks, it is not terribly important to the vast majority of IT admins. As such, I don't think the ability to see signature specs is an important measure of the value of an IPS/IDS product. It may be important to security nerds, but the general IT/network admin population doesn't care that much. And frankly, products that do show their signature details are rarely changed anyways. ___________________________________ Andrew Plato, CISSP President/Principal Consultant ANITIAN ENTERPRISE SECURITY 3800 SW Cedar Hills Blvd, Suite 280 Beaverton, OR 97005 503-644-5656 Office 503-214-8069 Fax 503-201-0821 Mobile www.anitian.com ___________________________________ GPG fingerprint: 16E6 C5B0 B6CB F287 776E E9A9 AF47 9914 3582 633D GPG public key available at: http://www.anitian.com/corp/keys.htm -----Original Message----- From: Joshua Berry [mailto:jberry () PENSON COM] Sent: Tuesday, March 15, 2005 6:50 AM To: Andrew Plato; Stephane; rick.brady () libertymutual com Cc: focus-ids () securityfocus com Subject: RE: How to choose an IDS/FW MSS provider Since you can't see the signature, how do you know they aren't doing simple string matching? Second, obviously you aren't very familiar with Snort's rule language, it isn't just simple string matching, there is a *ton* of other logic available to reduce false positives/negatives. Snort also has conveniently had support for PCRE matching for a long time now. -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. -------------------------------------------------------------------------- -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- Re: How to choose an IDS/FW MSS provider, (continued)
- Re: How to choose an IDS/FW MSS provider Andre Ludwig (Mar 19)
- Re: How to choose an IDS/FW MSS provider Prashant Khandelwal (Mar 24)
- Re: How to choose an IDS/FW MSS provider Andre Ludwig (Mar 19)
- Re: How to choose an IDS/FW MSS provider Adam Powers (Mar 19)
- RE: How to choose an IDS/FW MSS provider Chris Harrington (Mar 19)
- RE: How to choose an IDS/FW MSS provider KoƧ.net (Mar 19)
- Re: How to choose an IDS/FW MSS provider Mark Teicher (Mar 19)
- Re: How to choose an IDS/FW MSS provider Martin Roesch (Mar 19)
- Re: How to choose an IDS/FW MSS provider Mark Teicher (Mar 24)
- Re: How to choose an IDS/FW MSS provider Devdas Bhagat (Mar 28)
- Re: How to choose an IDS/FW MSS provider Martin Roesch (Mar 19)
- RE: How to choose an IDS/FW MSS provider Nigel Lewis (Mar 19)
- RE: How to choose an IDS/FW MSS provider Sergey V Soldatov (Mar 19)
- RE: How to choose an IDS/FW MSS provider Jason Baeder (Mar 19)
- Re: How to choose an IDS/FW MSS provider fuijdancer (Mar 23)
- Re: How to choose an IDS/FW MSS provider fuijdancer (Mar 23)
- Re: How to choose an IDS/FW MSS provider fuijdancer (Mar 24)