RE: IDS/IPS Management devices

["Biswas, Proneet" <pbiswas () ipolicynetworks com>]

Thanks for all the feedback. I agree with Dave that Linux is definitely
a better platform. Agreed, it needs to be in a secure area but do I
expect my appliance provider to give me the patches for Linux
vulnerabilities which can potentially be exploited. I would expect as IT
administrator, the management platform is like any other device on the
network which needs to be maintained by the admin.

----------------------------------------------
To have known the best, and to have known it for the best, is success in
life. 

-----Original Message-----
From: David W. Goodrum [mailto:dgoodrum () nfr com] 
Sent: Thursday, March 24, 2005 2:03 PM
To: Biswas, Proneet
Cc: focus-ids () securityfocus com
Subject: Re: IDS/IPS Management devices

You should ask the vendors if they can run their management stations on 
other platforms, besides windows.  Potentially, they've just shipped you

Windows as a default, but potentially you could have requested a *nix 
platform.  We (NFR) always ship ours on Linux as default, but I know a 
lot of customers wish we packaged Windows  (there's always going to be 
somebody who complains no matter what you do).

Having said that, regardless of the OS the management platform runs on, 
it should always be in a secure area.  Some customers go so far as to 
have a completely out-of-band network for the management of their 
security devices.  Others simply stick the management server deep in the

network (i.e. behind several layers of security devices, as you have 
suggested).

-dave
(nfr)(security)
http://www.nfr.com

Biswas, Proneet wrote:

> One of the issues which we have seen with IDS/IPS vendors shipping
> Management stations to manage their devices is that customers start
> questioning how secure the management station is as it is mostly
windows
> based platforms and there are no Anti-Virus software etc. running on
> them. So is it safe to suggest that the management station  should be
> sitting behind one of the security devices which is managing it.
> Any thoughts ?
>
>
>
> -----------------------------------------------------------------------
---
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from 
> CORE IMPACT.
> Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> -----------------------------------------------------------------------
---
>  

-- 
David W. Goodrum
Senior Systems Engineer
NFR Security
703.731.3765


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------