Snort mailing list archives
RE: Re: [Snort-devel] IDS vs IPS
From: "Bob Walder" <bwalder () spamcop net>
Date: Thu, 28 Aug 2003 11:15:25 +0200
One important distinction Firewalls are about policy enforcement - IDS and IPS are about detection (as of THIS moment in time) I still see the IPS as an evolution of the IDS and not the firewall. In my opinion, the firewall is itself gonna have to evolve pretty damn quickly to stop the IPS going the whole hog and taking over its job too. YES - the two technologies have similar aims and will undoubtedly converge. BUT, who do you see winning the race? In my opinion, the guys who already have the flashy hardware and solid IDS/IPS technology will have an easier time of it than the firewall vendors (i.e. the likes of Tippingpoint and Intruvert/NAI). By the way - why not ask NetScreen how hard it is to integrate IPS and firewall technology?! They already had a firewall appliance - if it is really that easy to converge these technologies (or if there really isn't a difference between them in the first place) then why have we not seen their IPS technology already fully integrated into their fancy firewall platform? Cisco is well placed to do this job too - it has the big switches which could take a flashy new IPS/IDS/firewall blade, and the in-house expertise with both firewall and IDS technologies. AND it understands how important it is for this stuff to be rock solid and scalable. Both Intruvert and Tippingpoint could probably also make a decent fist of it. But... It ain't easy! It will be a while before these things do converge, and until then I foresee a number of religious arguments over which technology is best, which technology is pure marketing hype, which technology came first, blah, blah, blah (i.e. a bit like this thread... ;o) Oh... And no way am I advocating that any one of these technologies can displace the others right now - they all have their place. On my network I have two firewalls at the perimeter for the policy enforcement stuff (i.e. that's where I say "allow HTTP to this server on my DMZ, don't allow Telnet to anything, allow FTP to that server on my DMZ, and so on...). Behind those I have an IPS - also at the perimeter - to catch the bad stuff that the firewall lets through (i.e. the firewall says let through HTTP traffic, but there is a lot of nasty stuff that could ride on the back of that). And finally, I have IDS systems on the DMZ and internal networks just so I can mop up anything that might get through owing to the fact I don't want my IPS to block absolutely everything ('cos it's just not ready for that yet!) I would LOVE to have just the one box for this.... But it's just not available...sorry Regards, Bob
-----Original Message----- From: Jason [mailto:security () brvenik com] Sent: 28 August 2003 05:17 To: Frank Knobbe Cc: bwalder () spamcop net; 'Mark Teicher'; 'Jeff Nathan'; Vkmobile () aol com; snort-devel () lists sourceforge net; snort-users () lists sourceforge net Subject: Re: [Snort-users] Re: [Snort-devel] IDS vs IPS Thanks, I think the matrix shows fairly well that the _new IPS_ is a natural evolution of the existing firewall. This is important to point out because there are existing investments in firewalls and these firewalls are rapidly closing the gap where needed. I know that CP has been moving in this direction for a while. It has also been my experience that they have been moving at an appropriate pace and the capabilities have been there when I've needed them. One final statement. You do not need the firewall to log content if you have an IDS that you can trust will not have a direct impact on the business should it be too critical of the data. You can also have confidence in your firewall because your IDS verifies what you told the firewall to do and covers your arse when you let something by because of business requirements or a human error. Frank Knobbe wrote:On Wed, 2003-08-27 at 18:36, Jason wrote:Bob Walder wrote:My 0.02 worth is that a Network IPS (NIPS) is a device with two interfaces that operates in-line to detect suspicious traffic and INSTANTLY discard the offending packet and the rest ofthe suspiciousflow.What we have here is a definition of an IPS that matches pretty closely what firewalls have been able to do for some time.Not quite. There are difference in the way firewalls and intrusion detection systems analyze data. For example, I have not seen a firewall that can identify a CodeRed attempt by name for example. Yeah, you can block HTTP methods and put limiters on URL'setc (youmentioned CP as an example which can do that with HTTPcontent stuff).But I have not come across a firewall with a 'signatureset' like IDS'have them......yet. It is true that most firewalls are under-utilized. However, an IPS (being based on an IDS) has capabilities beyond a firewall. Policy violations (or network flow anomalies) can be detected byfirewallsand cause some sort of reaction/enforcement (CP's SAM isone example).However, firewalls don't have statistical anomalydetection like someIDS' do. Let's draft a matrix of capabilities: Metric | Firewall | IDS | IPS ----------------------------------------------------------- Signature | Limited packet | Extensive | See IDS Analysis | inspection | signature sets | | due to lack of | allow wide | | rule set defin.| pattern match | ----------------------------------------------------------- Protocol | Mostly present | Present | Present validation | | | ----------------------------------------------------------- Traffic flow| Present, that's| Present | Present Anomaly Det.| what they do | | Present ----------------------------------------------------------- Statisitcal | Absent | Present | Absent (???) Anomaly Det.| | | (as of today) ----------------------------------------------------------- Packet Log | Logging mostly | capable of | See IDS | high level | logging content| ----------------------------------------------------------- Protocol | Present | Absent | Present normalizat | | | ion | | | =========================================================== Activity | Active | Mostly Passive | Active If someone wants to take this further, feel free. But asyou can see,IPS and firewalls are not quite alike (but neither are IPSand IDS! :)Regards, Frank
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Re: [Snort-devel] IDS vs IPS, (continued)
- Re: Re: [Snort-devel] IDS vs IPS Jeff (Aug 27)
- Re: Re: [Snort-devel] IDS vs IPS Mark Teicher (Aug 28)
- Re: Re: [Snort-devel] IDS vs IPS Mark Teicher (Aug 28)
- Re: Re: [Snort-devel] IDS vs IPS Jeff Nathan (Sep 01)
- Re: Re: [Snort-devel] IDS vs IPS Mark Teicher (Sep 02)
- Re: Re: [Snort-devel] IDS vs IPS Jeff Nathan (Aug 30)
- Re: Re: [Snort-devel] IDS vs IPS Gary Flynn (Sep 02)
- Re: Re: [Snort-devel] IDS vs IPS Mark Teicher (Sep 02)
- Re: Re: [Snort-devel] IDS vs IPS Frank Knobbe (Sep 02)
- RE: Re: [Snort-devel] IDS vs IPS Gordon Cunningham (Aug 28)
- Re: Re: [Snort-devel] IDS vs IPS Jason (Aug 28)
- RE: Re: [Snort-devel] IDS vs IPS Georges J. Jahchan, Eng. (Aug 29)
- Re: [Snort-devel] IDS vs IPS Jeff Nathan (Aug 30)