Re: IPS, alternative solutions

[Devdas Bhagat <devdas () dvb homelinux org>]

On 22/09/04 12:22 -0400, Mike Frantzen wrote:
> > The way I see it, an IPS can attempt to contain your infestation and 
> > help reduce your legal exposure from outbound attacks that would 
> > otherwise make it to your partners... This is a value I can quantify and 
> > the best use case I have seen for IPS. The problem I have with it is 
> > that a properly implemented firewall can most likely do the same and 
> > provide much better overall value.
>
> One of the spots where an IPS beats a firewall hands down is on the
> interior of a large organization.  I've seen too many large
> disfunctional companies that compartmentalize their departments by
> placing firewalls between each and every one.  Marketing and sales can't

Which is broken behaviour in the name of security. People who need
access to certain data for normal work related purposes must be given
such access. Those who don't need access should not be given such
access.
I believe that this type of issue is largely caused by people equating
firewalls with simple packet filters.

> access engineering project schedules and feature lists on the
> engineering web server.  Engineering can't access the support database
> to look for common issues and trends.  No one can access their
> department's machines from their laptop when in a conference room...
> etc etc

Actually, that is broken firewall design and/or implementation. If the 
requirements of the various customers are not met, then the firewall 
is just an impediment to work, or it lets too much traffic through.

In such cases, the company should be using proxies with proper
authentication and logging to regulate traffic flow (IMHO firewalls
should be a combination of packet filters and proxies anyway).

> We end up with an authoritarian system where the firewalls inhibit the
> communication inside the company.  An IPS can maintain the security
> compartmentalization and containment without impeding the free flow of
> information between departments.

No. an IPS is just an attempt at a proxy looking for bad things. In my
book, this is equivalent to filtering untrusted user input for bad stuff
instead of limiting it to known good stuff and removing the rest.

This should not be acceptable behaviour for security enforcement
management and/or personnel.

Devdas Bhagat

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------