Re: How to choose an IDS/FW MSS provider

[buineach <securesolutions () gmail com>]

Stephane
My opinions here are based on testing I did against all these vendors
in the IPS space.
Netscreen IDP, Checkpoint (whatever) & ISS preventia are PC based
solution  like all PC based solutions it has a bad foundation to build
on.
The central PC based CPU appract of Netscreen IDP , Checkpoint  & ISS 
mean that you would be a brave man to depend on any of these solutions
to provide your requested 24x7x365 concept.
IIt is important to differenciate the Netscren firewalls from the IDP
which is 2 different architectures, The IDP coming from their
acquisition of Onesecure.

What happens when  the next worm outbreak occurs from someone bringing
in an infected PC and the IPS is deployed to quarantine bad traffic to
different segments.
Part of some of the attacks last year was to synflood  some unix and
windows vendors.
What is to stop the next worm sending out the same volume of garbage
fragmented traffic that any IPS which is in any way stateful  must
deal with to determine firstly the destination port and coaleace these
before having the traffic passed to the string search engine.
You can imagine that this type of device can quicly beome the
bottleneck in your network.

A quick test is to use isic  tool (tcpsic)  to send bad traffic
through the IPS at at least 20Mb/sec to simulate some compromised
systems and see what effect this has on legitimate sesiions and the
usability of the "appliance"

PIX is a FW and Cisco are plugging the IPS V5.0  which is as far as I
can tell putting their IDS 4xxx series inline.
I have no experience with this but there have been many comments
posted related to this.

My reccommendation is to put a test plan together and evaluate  some
of the more compitent solutions.

Happy hunting..
Mick



On Mon, 07 Mar 2005 11:41:31 +0100, Stephane <stephane.d () ecologie net> wrote:
> Dear All,
>
> How do I choose an IDS/IPS provider if I need a strong level of
> expertise 24x7x365 and a worldwide representaion? I need it on
> Netscreen, PIX, CheckPoint and ISS Realsecure and Proventia.
>
> Thank you,
>
> S.
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> --------------------------------------------------------------------------

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------