RE: Automated IDS response

["Kopf , Patrick E." <PEKopf () missi ncsc mil>]

Network Ice's BlackIce Defender IDS does this type of traffic blocking
(based on type of attack).  Defender only blocks traffic for attacks that
are 'non-spoofable'.  I don't know if they're the only IDS that does this or
not.

Pat Kopf

-----Original Message-----
From: Michael B. Rash [mailto:mbr () math umd edu]
Sent: Thursday, February 10, 2000 6:09 PM
To: firewall-wizards () nfr net
Subject: Automated IDS response



Having your IDS respond automatically to an IP that is generating
questionable traffic by dynamically managing your router ACLs (or other
similar action; tcpwrappers, ipchains, etc...) to deny all traffic from
the IP can be a risky thing to do from a DoS perspective; nmap's decoy
option comes to mind.

It would seem that any IDS should only block traffic from an IP
based on an attack signature that requires bi-directional communication,
like a CGI exploit over http/80 or something.  Are there guidelines for
deploying IDS response that discusses methods for minimizing false
positives?  Are there any *good* ways of doing this?

--Mike
http://www.math.umd.edu/~mbr