Re: Intrusion Prevention Firewall

[Vern Paxson <vern () icir org>]

> But beware: as soon as you hook your IDS to an access control mechanism, 
> so that when the IDS detects something it closes off access, what you 
> have just done is build a flakey access control policy. If you thought 
> the costs of managing IDSs was high, wait until you try this :)

The counterpoint: this can be very powerful, depending on your IDS.  At LBL,
Bro drops various forms of hostile activity automatically, and we find that
it makes a *big* difference in lowering the break-in rate (which we know
because we see how the rate goes up when the reactive system is turned off).

                Vern
_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards