Re: Replacing antivirus soft with a real IDS/IPS

[Jason Thompson <securitux () gmail com>]

I don't think it's a good idea to knock out AV. A blended tool of AV
and HIPS / firewall would be great. Even most HIPS vendors will say
that they don't recommend getting rid of your current AV solution.

AV is not going to stop a targetted attack. If I put a trojan or some
other back door on your machine that doesn't match an AV signature...
and there are lots of them... I am free to do what I want, unchecked
pretty much. AV is very reactive and it counts on the fact that your
network is only affected by viruses / worms / trojans that already
exist in its database that is assumed to be updated; any of these even
slightly altered will bypass an AV signature and will be able to
infect your client PC. If its a 0-day attack, you're not well
protected and AV heuristics is poor at best. A combination of AV and
HIPS is the way to go. Make sure the HIPS is somewhat intelligent and
is capable of protocol / application anomaly detection and has a built
in firewall. ISS Desktop Protector does this, but I haven't had a
chance to put it through the paces yet. I will be soon, maybe over the
holidays when I have time.

Maybe see if your current AV provider has a HIPS product for desktop.
It would integrate better for sure, and would probably keep your
systems more stable as you won't have two separate software packages
contending to secure the desktop.

-J

On 12/6/05, carlopmart <carlopmart () gmail com> wrote:
> Hi all,
>
>   I am going to setup a testing lab with several windows XP virtual
> machines. My pourpose is to do some tests with HIDS/IPS software for
> windows and not to use antivirus software. Can you recommends me some
> HIDS software for windows ( free software if it is possible)?.
>
>   And another question, will windows survive to several attacks
> (virus, trojans, etc) without using antivirus software ??? Have anyone
> tryied this??
>
> Thank you very much and sorry for my bad english.
>
> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------