Re: IDP/IDS products

[Joseph Clark <clarkjk () COFC EDU>]

1. Inline
2. Packet based
3. No false positives on the blocking side.
4. NitroSecurity. The decision was based on the openness of the rule set,
being able to see the packet data that tripped the block or alert, reporting
and ease of separation of management. We can allow other administrators to
manage the rules and reports for their IP range.
5. When we decided to turn on blocking with the Malware rules we had several
users experience problems with IE due to Funweb.


On 9/16/08 3:04 PM, "Robert Riley" <rriley3 () ND EDU> wrote:

> We are seeking peer feedback on the use of Intrusion Detection/Prevention
> systems.
>
> If your organization has deployed an enterprise IDP/IDS, are you:
>
> 1. Using the product inline or in bypass mode?
> 2. Are you using the product to shun hosts?
> 3. How are you managing false positives?
> 4. Which product do you use and what was your selection criteria?
> 5. Have you documented any known issues with the product?
>
> Please feel free to contact me offlist if you prefer.
>
> Thank you.
> --
> Robert Riley
> Information Security Professional
> University of Notre Dame