Re: IDS evaluations procedures

[Richard Bejtlich <taosecurity () gmail com>]

On 7/18/05, Nathan Davidson <ndavidso () globix com> wrote:

> With the advent of ever more tightly policed application standards (see IPS,application firewalls, layer 7 proxies, 
> etc) I suspect that non-compliant browsers, tools and monitors will soon have to get their act together or be left 
> behind.

Hi Nathan,

That would be really helpful for security analysts, but it will not
happen.  Security is an afterthought or a "box to check" for most
businesses.  Anything that impedes profit will be turned off.  This is
part of the "surrender" that we security professionals delivered in
the mid-1990s to meet "business realities." [1]  In a world where
prevention fails, often all we have left is monitoring and response.

Sincerely,

Richard
http://www.taosecurity.com

[1] http://www.derkeiler.com/Mailing-Lists/Firewall-Wizards/2005-06/0032.html

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------