IDS mailing list archives
RE: IDS/IPS Management devices
From: "Dante Mercurio" <Dante () webcti com>
Date: Mon, 28 Mar 2005 08:39:34 -0500
Best practices would dictate the management device is on a separate segment with strong access control with only the necessary access to manage the devices and receive logs. This is for both the prevention of an attack on it and the compromise of any logging data it might contain. That being said, from the Cisco side which I am most familiar with, the CSA agent is installed on the VMS management console with a pretty restrictive rule set and the management device is locked down pretty tight. I still try to put it on a separate segment whenever I can. M. Dante Mercurio, CISSP, CWNA, Security+ -----Original Message----- From: Biswas, Proneet [mailto:pbiswas () ipolicynetworks com] Sent: Thursday, March 24, 2005 2:35 PM To: focus-ids () securityfocus com Subject: IDS/IPS Management devices One of the issues which we have seen with IDS/IPS vendors shipping Management stations to manage their devices is that customers start questioning how secure the management station is as it is mostly windows based platforms and there are no Anti-Virus software etc. running on them. So is it safe to suggest that the management station should be sitting behind one of the security devices which is managing it. Any thoughts ? ------------------------------------------------------------------------ -- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ -- -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- IDS/IPS Management devices Biswas, Proneet (Mar 24)
- RE: IDS/IPS Management devices Gary Halleen (Mar 28)
- Re: IDS/IPS Management devices Andres Riancho (Mar 28)
- <Possible follow-ups>
- RE: IDS/IPS Management devices Prashant Khandelwal (Mar 28)
- RE: IDS/IPS Management devices Dante Mercurio (Mar 28)
- RE: IDS/IPS Management devices Ofer Shezaf (Mar 28)
- RE: IDS/IPS Management devices Biswas, Proneet (Mar 31)