Re: IDS is dead, etc

[Scott Wimer <scottw () cylant com>]

Bennett,

I think we are on the same page as to the utility of IDS systems.

Where we differ is in our estimation of the level of vulnerability of 
software that is "known" to be good and secure.  Over the course of 
the summer I've been given more insight into the gray and black hat 
world.  The number of systems that are backdoored -- today, and the 
number of non-public vulnerabilities and exploits is slightly disturbing.

Perhaps the most disturbing is that the bar is really only raised for 
the script kiddies; they never posed a substantial risk anyway.

I really like your description of NIDS as AV scanners for the network. 
 That's classic.  Although, some will argue that the more behavioral 
oriented NIDS have moved past that point.  *shrug*  A good NIDS is an 
invaluable tool for network managers.  But, a NIDS is not the security 
"solution" that they are marketed as.

Regards,
scottwimer

Bennett Todd wrote:
> 2003-08-08T12:37:24 Scott Wimer:
>
> > The assumption that human beings can design, write, and install 
> > software without error is WRONG.
>
>
> No disagreement there. I don't presume software without error.
>
> I do maintain, however, that by combining tight configuration
> control with complete abstinance from known-bad software, you can
> raise the barrier sufficiently high that the attacks that succeed
> will be so wildly new and out of left field that your IDS would be
> no more help than your firewall. IDSes detect known problems;
> they're the "anti-virus scanners" of the network.
>
> Given such a setting, an IDS is still a great idea, as an
> educational tool, but it's not helping to tighten your protections,
> because it won't alarm on anything that succeeds.
>
> -Bennett

--
Scott M. Wimer, CTO                      Cylant
www.cylant.com                           121 Sweet Ave.
v. (208) 883-4892                        Suite 123
c. (208) 301-0370                        Moscow, ID 83843
There is no Security without Control.


---------------------------------------------------------------------------
Captus Networks - Integrated Intrusion Prevention and Traffic Shaping  
- Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
- Automatically Control P2P, IM and Spam Traffic
- Ensure Reliable Performance of Mission Critical Applications
Precisely Define and Implement Network Security and Performance Policies
**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo
Visit us at: http://www.captusnetworks.com/ads/31.htm
---------------------------------------------------------------------------