IDS mailing list archives
Re: IDS requirement
From: Jimi Thompson <jimi.thompson () gmail com>
Date: Tue, 30 Nov 2004 22:34:52 -0600
I realize that I'm a bit late here, but it's been a holiday. We had a similar discussion on the SNORT mailing list recently and I'll distill it down for you. The general concensus is that IPS is mostly marketing hype. Unless you are doing something to identify an attack in progress in real time and actively doing something (i.e. modifying a firewall rule or routing table) to stop that attack, you are not an IPS, because you are not, by definition, preventing anything. IDS = intrusion detection system IPS = intrusion prevention system HTH, Jimi On Mon, 22 Nov 2004 15:28:28 -0600 (CST), skill2die4 () secguru com <skill2die4 () secguru com> wrote:
Can anyone email me a document on how IDS/IPS actually works.....with the terminology well explained.IMHO, articles of your interest would be : FAQ's ============ [FAQ] Sniffing (network wiretap, sniffer) [FAQ] IDS Terminology ============= [AndyCuff] Intrusion Detection Terminology [A.Cliff] Intrusion Detection Systems Terminology Basic Papers =============== [SecurityFocus] An Introduction to Intrusion Detection Systems [SecurityFocus] Network Intrusion Detection Signatures [SecurityFocus] Intrusion Detection: Filling in the Gaps [Cisco] Intrusion Detection Planning Guide links to all the above is availabe at, http://www.secguru.com/index.php/content/category/6/145/115/ [ www.secguru.com -> Network Devices -> IDS ] Also , visit Andy Cuff's site : http://www.networkintrusion.co.uk/ for much info ... :-) HTH, -=skillz=- .. -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
-- Thanks, Jimi -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- Re: IDS requirement Jimi Thompson (Dec 01)
- <Possible follow-ups>
- RE: IDS requirement Brito, Nelson (ISS Brazil) (Dec 02)
- Message not available
- RE: IDS requirement SecurIT Informatique Inc. (Dec 06)
- Message not available