Home page logo
/

basics logo Security Basics mailing list archives

RE: Is snort an overkill for desktop only environment ?
From: "Rivest, Philippe" <PRivest () transforce ca>
Date: Wed, 25 Nov 2009 11:07:00 -0500

I'M not sure we are tackling this the right way. The question that was ask
is "is it overkill for a desktop only environment".

Every time you want to implement a control, you need to evaluate if you need
it (cost-benefit). If theres no need for IDS (H-N) at all, don’t implement
them. But if you are the NSA and have (for what ever reason) a desktop only
environment in on of their branch/location, you MIGHT want to have these
controls. But at home, I really don’t care about a N/H-IDS.

So yes its overkill if your environment does not need that level of
protection and No its not overkill if you need it.

Risk management all the way.

 
Philippe Rivest - CEH, Network+, Server+, A+
TransForce Inc.
Internal auditor - Information security
Verificateur interne - Securite de l'information

8585 Trans-Canada Highway, Suite 300
Saint-Laurent (Quebec) H4S 1Z6
Tel.: 514-331-4417   
Fax: 514-856-7541

http://www.transforce.ca/



-----Message d'origine-----
De : listbounce () securityfocus com [mailto:listbounce () securityfocus com] De
la part de pleed
Envoyé : 24 novembre 2009 16:38
À : security-basics () securityfocus com
Objet : Re: Is snort an overkill for desktop only environment ?

Alexander Klimov wrote:
On Tue, 27 Oct 2009, [ISO-8859-1] Jos? Manuel Molina Pascual wrote:
  
If you have the HW and some time to do it.... Why not?
    

Because every new software package you install is a potential
source of exploitable flaws, even more so if it is always
working and getting its inputs from network.

  
In my opinion NIDS on the host itself does not make the box more secure.
When deploying snort, you normaly want to know if there already has been a
_successful_ attack, because when connecting to the internet you re
always being
attacked but mostly without any affect to your system. In your case if
your desktop
is attacked successfully, i wouldnt trust the NIDS output anyway.
In addition snort is just helpfull if someone is looking into the alerts
24/7.

I think you should spend your time with more productive stuff. But for
educational purpose
playing with it is never wasted time.

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL
certificate.  We look at how SSL works, how it benefits your company and how
your customers can tell if a site is secure. You will find out how to test,
purchase, install and use a thawte Digital Certificate on your Apache web
server. Throughout, best practices for set-up are highlighted to help you
ensure efficient ongoing management of your encryption keys and digital
certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727
d1
------------------------------------------------------------------------

Attachment: smime.p7s
Description:


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]