Re: The value of detecting neutralized threats. (was RE: IDS bla

[Dominique Brezinski <dom_brezinski () securecomputing com>]

At 08:19 PM 1/27/99 -0500, Vik Bajaj wrote:
> On 26-Jan-99 Dominique Brezinski wrote:
>
> > OK, here is a classic example of theory versus practicality.  I agree in
> > theory with John.  I personally want to know every time someone tries to do
> [snip]
> > And one knowledgeable person to run it will cost you $100,000+ per year,
> > not to mention all the legal research and effort necessary to come up with
> > the threat response plan and policies.
>
> It does not follow from the simple fact that a threat is known, perceived, or
> detected that a response should be mounted.  If we accept that assertion,
> than no IDS can ever be successful.  In fact, a persuasive argument can be
made

What assertion? That IDS involves more than just a RealSecure or NFR box?
That there is all sorts of work that goes into figuring out whether or not
a response should be mounted?





Dominique Brezinski CISSP                   (206) 898-8254
Secure Computing        http://www.securecomputing.com