Firewall Wizards: Re: Intrusion Detection

["Paul D. Robertson" <proberts () clark net>]

On Tue, 14 Apr 1998, Marcus J. Ranum wrote:

>       There are really only 2 good reasons I can think of for ID systems:
> 1) To develop a threat level model as to how often you are attacked
> 2) To detect clueless people inside your organization who are attacking
>       outside sites
3) To detect clueless people inside your organization, or with access to 
   your facilities who are attacking your own systmems.

4) To trend traffic to detect possible tunnels through allowed protocols 
   like HTTP or SSL.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts () clark net      which may have no basis whatsoever in fact."
                                                                     PSB#9280