RE: Intrushield vs. ISS once more...

["wnorth" <wnorth () verizon net>]

I've installed both, by far Intrushield captures more via inline or port
spanning, either way it seems to have quite a bit more capability to detect
and report anomalies than ISS has, however, I last worked with ISS about 1
year ago, and have been using Intrushield since. It has a very nice
interface, then again, ISS could be far better then what it was a year ago.
We had a major pen test performed against a site and ISS barely caught
anything. On the flip side we were running Windows based sensors and not an
appliance based sensor, which is what Intrushield uses. They both are good
products, but intrushield is better in my mind.

My 2 cents,

-Wes

-----Original Message-----
From: Dave Aitel [mailto:dave () immunitysec com] 
Sent: Monday, December 20, 2004 1:09 PM
To: Jacob Winston
Cc: focus-ids () securityfocus com
Subject: Re: Intrushield vs. ISS once more...

Assuming you have an evaluation copy of each, you could run the CRI against
it and see what that does for you...I know ISS passes, but I've not seen
anyone test Intrushield.

Dave Aitel
Immunity, Inc.

Jacob Winston wrote:



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------