RE: IDS/IPS Management devices

["Ofer Shezaf" <Ofer.Shezaf () breach com>]

My experience shows that while usually the management consoles of
perimeter firewalls and IDS/IPS sit on a dedicated segment, this is not
the case with consoles of internal security devices.

So when somebody decided to segment the HR department (or the Nuclear
reactor) with a firewall, the sys admin manages it from his desktop on
the general network (something unheard of for a gateway firewall),
making a standard, internet connected, windows desktop key so the
organization's security.

The situation is worse with routers. Routers where not usually born as
security devices, but organizations start to use them as such, utilizing
ACLs, encryption and recently 802.1x. And still many routers are managed
using unencrypted telnet with static passwords.

~ Ofer 


Ofer Shezaf
CTO, Breach Security

Tel: +972.9.956.0036 ext.212
Cell: +972.54.443.1119
ofers () breach com
http://www.breach.com 


> -----Original Message-----
> From: Biswas, Proneet [mailto:pbiswas () ipolicynetworks com]
> Sent: Thursday, March 24, 2005 9:35 PM
> To: focus-ids () securityfocus com
> Subject: IDS/IPS Management devices
>
> One of the issues which we have seen with IDS/IPS vendors shipping
> Management stations to manage their devices is that customers start
> questioning how secure the management station is as it is mostly
windows
> based platforms and there are no Anti-Virus software etc. running on
> them. So is it safe to suggest that the management station  should be
> sitting behind one of the security devices which is managing it.
> Any thoughts ?
------------------------------------------------------------------------
--
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
------------------------------------------------------------------------
--


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------