Re: RE: IDS (was: FW appliance comparison)

["Patrick M. Hausen" <hausen () punkt de>]

Hi, all!

On Tue, Jan 24, 2006 at 11:38:52AM +0700, Ben Nagy wrote:

> What's your preferred method for noticing this stuff? (I'm certainly not
> being sarcastic here)

Your firewall doesn't trigger an alarm for every event that's
denied by policy?

That's the main reason why I don't like IDSs. A default deny
policy combined with "log everything" achieves just the same.

I concede there are nice UIs that let you do convenient analysis
and statistics - more often or better on IDS products than on
your common firewall. But it's the vendors that are to blame
here. Why not put the same effort into the firewall products?
Why bother if you can sell another box instead? Dunno.

Regards,
Patrick
-- 
punkt.de GmbH         Internet - Dienstleistungen - Beratung
Vorholzstr. 25        Tel. 0721 9109 -0 Fax: -100
76137 Karlsruhe       http://punkt.de
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards