Re: How to choose an IDS/FW MSS provider

[Peter Schawacker <peter () schawacker com>]

Safe enough for some, not safe enough others.  Depends
on what your priorities are, what your trying to
protect, etc.  You seem to have generally the right
idea about how we store keys.  I won't rehash the gory
details here, as they've already been covered on this
forum within the past year.  Also, there's a white
paper on the McAfee web site that covers IntruShield's
SSL decryption foo at a high level. 

Peter


--- Will Metcalf <william.metcalf () gmail com> wrote:
> Hmmmmm, been wanting to ask this for a while now.  I
> understand you
> guy's use public key encryption to encrypt the
> private key of the SSL
> certificates so that you may inspect SSL encrypted
> traffic sent to web
> servers you are trying to defend with the
> IntruShield product.  Are
> these keys decrypted and then stored in memory on
> your device?  If so,
> do you think that is safe?
>
> Regards,
>
> Will  
>
>
> On Sat, 12 Mar 2005 11:41:46 -0800 (PST), Peter
> Schawacker
> <peter () schawacker com> wrote:
> > Hi Kevin,
> >
> > You make some good points, but I wanted to clarify
> > something that you wrote.  McAfee's IntruShield
> NIPS
> > appliance does not run Linux.  Also, it is
> > ASIC/FPGA-based.  Each IntruShield appliance does
> > include a celeron processor, but that Intel chip
> is
> > used only for management.  All of the IDS/IPS work
> is
> > done using FPGA's, ASIC's and network processors.
> >
> > BTW, I work for McAfee.
> >
> > Peter
> >
> >
> > --- Kevin <kkadow () gmail com> wrote:
> > > On Thu, 10 Mar 2005 16:28:57 +0000, buineach
> > ...
> > > And there are products like Intrushield, which
> are
> > > known to
> > > use Linux/LGPL code and also boast about the
> high
> > > performance of "ASIC based appliance" IPS.
> > >
> > >
> > > > I think you will admit that the technology
> used
> > > by IDS vendors is
> > > > almost the same as the appliance IPS  they now
> > > promote.
> > ...
--------------------------------------------------------------------------
> > Test Your IDS
> >
> > Is your IDS deployed correctly?
> > Find out quickly and easily by testing it with
> real-world attacks from
> > CORE IMPACT.
> > Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> > to learn more.
--------------------------------------------------------------------------
> >

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------