Re: Britney and Kevin are Chaotic

[Steve Lord <steve () buyukada co uk>]

Rodney Thayer wrote:

> > Then again, the IDS industry is the deformed little brother of the 
> > information security industry.
>
>
> I think that's not entirely true.  I think IDS has a bad name because 
> someone found the proper style knee-pads to use with Gartner to get 
> them to declare it a problem, thus yet again inducing the GLE (Gartner 
> Lemming Effect.)

If IDS featured in Team America, it would be I.N.T.E.L.L.I.G.E.N.C.E. I 
can picture it now.

Spotsworth: What's happening on the LAN INTELLIGENCE?
Intelligence: You're being hit by a worm. You're being hit by a worm. 
Someone's using CANVAS. You're being hit by a...
Spotsworth: It's the terrorists, gary - why this could turn out to be 
9/11 times ten thousand!

The intrusion prevention stuff seems pretty good if you're interested in 
stopping the bulk of attacks rather than everything, but almost no 
organisation I've ever been into has the kind of infrastructure that IDS 
would be worth deploying in, at least IMHO. YMMV mind.

> I think IDS are like smoke detectors.  Everyone thinks they're lame 
> and irrelevant because they do nothing but warn you that your other 
> systems have failed.   Notice that with smoke detectors, when the 
> house down the street burns down and kills a small child, there's a 
> line out the door and around the corner at the local building supply 
> shop to buy new smoke detectors.

I think it's worse than a smoke detector. An IDS would be a smoke 
detector that informs you that your house has already been burnt to the 
ground, and needs rebuilding from scratch.

> Then again writing filters to filter on security tools is some sort of 
> semi-narcissistic self-indulgent waste of time that I'm not thrilled 
> any vendor would charge money to deliver.

You'd be surprised the things that vendors will do to make a fast buck ;)

Steve
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave