RE: Intrusion Prevention requirements document -Apology

["Talisker" <lists () securitywizardry com>]

Sorry, my last email managed to escape from my draft folder before I'd
finished, it was a long day!

My suggestion would be a compromise (no pun intended), test products on a
dev network and whittle down the contenders you will find showstoppers for
certain
Products that would eliminate them from further testing. I'd be cautious
about testing on a live network, however, I would suggest most strongly that
you do NOT purchase without having tried the product on a live network.  As
mentioned by others you can reduce the risk by deploying a passive policy.
Check out the false positive rate ensure that it is tolerable, but give the
product a fair chance and devote a great deal of time to tuning, a major
requirement is to be able to tune the IPS in an extremely granular fashion,
minimizing the reduction in sensitivity that tuning brings.

Hope this helps

Andy cuff 

> VT,
>
> Andy Cuff
> Chief Technology Officer
> Computer Network Defence Ltd
> http://www.securitywizardry.com
>
> 07010 709014
>
>
> > -----Original Message-----
> > From: vendortrebuchet () comcast net [mailto:vendortrebuchet () comcast net]
> > Sent: 29 October 2005 20:40
> > To: focus-ids () securityfocus com
> > Subject: Re: Intrusion Prevention requirements document
> >
> > Another question for everyone,
> > When you brought in each vendor for evaluation, did you configure a test
> > network for them or did you use your production network?  My 1st concern
> > is  keeping my job :o)  If I test in production, I could impact
> production
> > traffic.  If I don't test in production, how can I best ensure that I
> > won't have problems with custom applications, older IP stacks which
could
> > be an issue if RFC compliance checks are done, etc.
> > The vendor answer is always, "don't turn on blocking and just monitor."
> > Is that a reality?   I'd like some testimonials to this and some real
> life
> > instances of what has been done from unbiased sources.
> >
> > Thanks,
> >
> > VT
> >
> >
> > > All,
> > >
> > > I work on a team that manages signature and behavioral based intrusion
> > detection
> > > systems today.  We have been tasked with reviewing IPS (or whatever
> > vendor name
> > > acronym you prefer) in '06.  Our normal process is to put together a
> > base
> > > requirements document to weed out vendors in the first round through a
> > paper
> > > exercise and then bring in the best we can identify.  My question is,
> > has
> > > anyone developed a matrix that identifies key qualifiers in an IPS
> > solution
> > > (e.g. in-line, fails open/closed, reporting features, etc.).  If so,
> > could you
> > > provide links or the documents?
> > >
> > > If not, what categories are most significant to consider in your
> expert
> > > opinions?  What reasons did you choose the solution you have?  What
> > would you
> > > consider if you had to choose over again, etc?
> > >
> > > Thanks in advance for your responses.
> > >
> > > VT
> > >
> > > ----------------------------------------------------------------------
> --
> > > Test Your IDS
> > >
> > > Is your IDS deployed correctly?
> > > Find out quickly and easily by testing it
> > > with real-world attacks from CORE IMPACT.
> > > Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-
> ids_040708
> > > to learn more.
> > > ----------------------------------------------------------------------
> --
> > >
> >
> > ------------------------------------------------------------------------
> > Test Your IDS
> >
> > Is your IDS deployed correctly?
> > Find out quickly and easily by testing it
> > with real-world attacks from CORE IMPACT.
> > Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> > to learn more.
> > ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------