RE: IDS alerts / second - Correlation - Virtualization

[Frank Knobbe <frank () knobbe us>]

On Sun, 2005-07-24 at 13:30 -0700, Swift, David wrote:
> Then the data is fed back into the IPS engine and Firewall to
> intelligently turn on signatures to block events that the protected
> network is vulnerable to, firewall unwanted ports, 

Why were the "unwanted ports" open in the first place? 

> and ideally to turn
> off alerting for events the protected network is not vulnerable to.

You meant to say "network is not *known* to be vulnerable to". The
knowing part is the tricky part. I'm not start with 0-day issues. Even
without those, the vulnerability landscape is in flux. What happens when
an not-vulnerable server  dies, and gets restored to a vulnerable
version? Your vulnerability scan engine would have to constantly run
scans.

Again, why not detect "compromises" instead of "assumed/confirmed
vulnerability states"?

Regards,
Frank
(replying without mentioning product/vendor names.... yay!)

Attachment: signature.asc
Description: This is a digitally signed message part