IDS mailing list archives
RE: IDS
From: "Alan Shimel" <ashimel () stillsecure com>
Date: Wed, 5 Jul 2006 16:46:25 -0400
The issue is using some of the methods you mention, they device is already on the network before you find out if they are running anything not allowed. VAM and/or IPS solutions are not the right tool for this job. Network Access control products are. A good mechanic is only as good as their tools! alan StillSecure Alan Shimel Chief Strategy Officer O 303.381.3815 C 516.857.7409 F 303.381.3881 email ashimel () stillsecure com blog http://ashimmy.typepad.com www.stillsecure.com The information transmitted is intended only for the person to whom it is addressed and may contain confidential material. Review or other use of this information by persons other than the intended recipient is prohibited. If you've received this in error, please contact the sender and delete from any computer. -----Original Message----- From: barcajax () gmail com [mailto:barcajax () gmail com] Sent: Tuesday, July 04, 2006 10:14 PM To: focus-ids () securityfocus com Subject: Re: IDS Based on your described requirement, you are looking in the wrong direction because IDSs do not provide you with a profile of the patch level of individual nodes. There are two ways (automated or manual) to tackle your need. The manual method involves either scanning the machine to identify missing patches (eg. Nessus or MBSA) or triggering an update on the machine itself (eg. Windows Update). The automated alternative involves deploying a patch management solution (eg. PatchLink, Citadel Hercules or SUS/SMS) or a quarantining solution that does not allow a machine with network access until a predefined patch level is met. ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------