nanog mailing list archives
Re: Checkpoint IPS
From: Terry Baranski <terry.baranski.list () gmail com>
Date: Thu, 5 Feb 2015 14:26:07 -0500
On 6 Feb 2015, at 11:46, Valdis Kletnieks wrote:
Count up the number of *actual* attacks they have stopped that wouldn't have been stopped otherwise
Many.
and contrast it to the number of times they've been used as the *basis* for an attack (DDoS via state exhaustion, for starters)
Zero, on my networks.
or their failure has caused operational issues.
Zero, on my networks. Unless "operation issues" means traffic fails over without a hitch.
Still think they're a good idea?
Yep. And thanks for asking. If you can't deploy IPS's in such a way that they don't make your network less secure via DDoS susceptibility, or reduce availability due to non-existent or subpar redundancy/survivability engineering, then you shouldn't deploy IPS's. -Terry On Thu, Feb 5, 2015 at 11:46 AM, <Valdis.Kletnieks () vt edu> wrote:
On Thu, 05 Feb 2015 09:31:49 -0500, Terry Baranski said:People tend to hear what they want to hear. Surely your claim can't bethatan IPS has never, in the history of Earth, prevented an attack orexploit.So it's unclear to me what you're actually trying to say here.Count up the number of *actual* attacks they have stopped that wouldn't have been stopped otherwise, and contrast it to the number of times they've been used as the *basis* for an attack (DDoS via state exhaustion, for starters) or their failure has caused operational issues. Remember that one of the three security pillars is "Availability". Still think they're a good idea?
Current thread:
- Re: Checkpoint IPS, (continued)
- Re: Checkpoint IPS Skeeve Stevens (Feb 05)
- RE: Checkpoint IPS Darden, Patrick (Feb 05)
- RE: Checkpoint IPS Terry Baranski (Feb 05)
- Re: Checkpoint IPS Michael Hallgren (Feb 05)
- Re: Checkpoint IPS jim deleskie (Feb 05)
- Re: Checkpoint IPS Michael Hallgren (Feb 05)
- Re: Checkpoint IPS Nick Hilliard (Feb 05)
- Re: Checkpoint IPS Roland Dobbins (Feb 05)
- Re: Checkpoint IPS Terry Baranski (Feb 05)
- Re: Checkpoint IPS Valdis . Kletnieks (Feb 05)
- Re: Checkpoint IPS Terry Baranski (Feb 05)
- Re: Checkpoint IPS Roland Dobbins (Feb 05)
- RE: Checkpoint IPS Terry Baranski (Feb 05)
- Re: Checkpoint IPS Roland Dobbins (Feb 05)
- Re: Checkpoint IPS Patrick Tracanelli (Feb 05)
- Re: Checkpoint IPS Ray Soucy (Feb 06)
- Re: Checkpoint IPS Roland Dobbins (Feb 06)
- Re: Checkpoint IPS Patrick Tracanelli (Feb 06)
- RE: Re: Checkpoint IPS Darden, Patrick (Feb 06)
- RE: Re: Checkpoint IPS Darden, Patrick (Feb 06)
- Re: Checkpoint IPS Roland Dobbins (Feb 06)