Re: IPS, alternative solutions

[Jason <security () brvenik com>]

I've heard of no medium+ sized business that is considering deploying 
inline technology on the internals of the network in a sufficiently 
pervasive manner that there would be any measurable benefit from the 
technology over patching and asset management.

I would be seriously interested in an ROI that can demonstrate savings.

The simple question is how is inline packet scrubbing easier and more 
cost effective than patching?

Scott Wimer wrote:

> Daniel,
>
> I agree with your assessment.  What I have encountered in the
> financial sector though is a desire to have the packets "scrubbed"
> before they reach the servers.  People _want_ to deploy network based
> IPS tools because it is easier and more cost effective.  That it
> doesn't seem to be possible yet is another story altogether.
>
> Regards, Scott Wimer
>
> On Tue, 2004-09-14 at 06:01, Daniel wrote:
>
> > So far there has been a load of talk discussing which is the better
> > technology. Personally i dont think IPS is ready for the big time.
> > Yeah its great for small mum and dad networks, but for large
> > financial networks with billions of pounds flowing across them,
> > would you trust a technology to think and block what it seems as
> > bad traffic?
> >
> > So what are the alternatives? I'd say more host based protection
> > such as:
> >
> > - Stack protection - Application level firewalls
> > (ModSecurity/SecureIIS) - Host based firewalls
> >
> > I'm interested to see what everyone else feels are alternatives to
> > IPS
> >
> >
> > --------------------------------------------------------------------------
> >  Test Your IDS
> >
> > Is your IDS deployed correctly? Find out quickly and easily by
> > testing it with real-world attacks from CORE IMPACT. Go to
> > http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> > to learn more. 
> > --------------------------------------------------------------------------


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------