Re: Network hardware IPS

[Gary Flynn <flynngn () jmu edu>]

david maynor wrote:

> I wouldn't like it but I can see it happening. It is more likely to come
> from security companies that fund alot of research into vulndev and they
> consider their sigs to be company secrets. Think about the last
> marketing pitch for IDSes you have been through, "we detect far more
> attacks than anybody else." 

Agreed and I understand their rationale for that. But I've also
seen claims of thousands of sigs that include a fair number of
pretty simplistic algorithms which are pretty useless on any
type of open network. How is the customer to know if they can't
see them? The situation is similar to firewall proxy capabilities
but with an order of magnitude more variables and a more fluid
state.

I'm not saying that a very well researched and tested signature
set that can't be seen could be very valuable in some environments,
particularly where traffic is well defined. Unfortunately, our
Internet connection doesn't fit that catagory. The ability to create
and alter signatures in reaction to new threats and incidents
has been invaluable.

Perhaps two classes of devices will develop. "Closed source" and
"open source" which will each have their strengths and weaknesses.

Or maybe we'll have devices where the bulk of signatures are
visible but some proprietary ones are not.

To me, the ability to see and modify the rulesets are a mandatory
feature right now, particularly if I'm contemplating blocking traffic
that matches a signature. Also, the same flexibility provides a valuable
troubleshooting, monitoring, and forensics tool above and beyond the
IDS/IDP capabilities.

--
Gary Flynn
Security Engineer - Technical Services
James Madison University

Please R.U.N.S.A.F.E.
http://www.jmu.edu/computing/runsafe


---------------------------------------------------------------------------
Captus Networks IPS 4000
Intrusion Prevention and Traffic Shaping Technology to: 
- Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
- Automatically Control P2P, IM and Spam Traffic
- Precisely Define and Implement Network Security & Performance Policies
FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo 
http://www.securityfocus.com/sponsor/CaptusNetworks_focus-ids_000101
---------------------------------------------------------------------------