Re: Log checking?

[Bennett Todd <bet () rahul net>]

(sorry about the late reply, catching up after a week away)

2004-09-30T15:24:40 Paul D. Robertson:
> But, again- IDS is "known bad"- we don't get IDS signatures for
> "stuff we don't know is good."

I think both anomaly analysis ("stuff we don't know is good") and
IDS (stuff we know is bad) have value to add. Anomaly analysis is
the way to catch new or one-off attacks. It's expensive, though. IDS
is very cheap, catches consequences of config errors, user
stupidity, etc., and has the additional advantage that (at least
with signature-based network IDS, e.g. snort) it identifies the
attacks detected with links to descriptions.

-Bennett

Attachment: _bin
Description: