Re: Checkpoint IPS

[Terry Baranski <terry.baranski.list () gmail com>]

On Thu, Feb 5, 2015 at 8:34 AM, Roland Dobbins <rdobbins () arbor net> wrote:

> I've never heard a plausible anecdote, much less seen meaningful
statistics,
> of these devices actually 'preventing' anything.

People tend to hear what they want to hear. Surely your claim can't be that
an IPS has never, in the history of Earth, prevented an attack or exploit.
So it's unclear to me what you're actually trying to say here.

> And the fact that well-known evasion techniques still work against these
> devices today, coupled with the undeniable proliferation of compromised
> hosts residing within networks supposedly 'protected' by these devices,
> militates against your proposition.

Your tendency of making blanket statements is somewhat baffling given the
multitude of intricacies, details, and varying circumstances involved in a
complex topic like this. To me, it's indicative of an overly-simplified
and/or biased way of looking at things.

In any case, go ahead and stick with your router ACLs and (stateful!)
proxies. Different strokes.

-Terry