Home page logo

firewall-wizards logo Firewall Wizards mailing list archives

Re: FW appliance comparison - Seeking input for the forum
From: "R. DuFresne" <dufresne () sysinfo com>
Date: Sun, 29 Jan 2006 21:44:21 -0500 (EST)

Hash: SHA1

On Wed, 25 Jan 2006, Devdas Bhagat wrote:

On 23/01/06 18:30 -0500, Paul D. Robertson wrote:
On Sun, 22 Jan 2006, Devdas Bhagat wrote:

Isn't auditing against a policy exactly what an IDS is supposed to do?

Not that I've ever seen.  Everything I've seen says they look for
known-bad-stuff and produce alerts and false positives.


<chorus> BOO! </chorus>

It also verifies that your security policy has been implemented
correctly at the firewall(s).

As I said, in an ideal world, sure- however I've yet to see an IDS that
really and truly knows how to even express policy, let alone check against
it (unless your policy is "no bad stuff the IDS can find!")  Heck, I've
yet to see real policy<->firewall rule mapping done in an effective way
without a human.

I suspect that my terminology has gotten disconnected with the marketing
driven real world again.

To me an IDS is not necessarily something that listens on the network
only. Stuff that looks at the integrity of files on hosts, stuff that
monitors and analyzes logs is part of the IDS too. The IDS is not a
simple, single application, but a set of applications which work
together to show the differences between operational and ideal

A NIDS, or a HIDS is a part of the above, but is definitely not sufficient
by itself.

I've seen this offered asa more total solution, LURQH <sp?!> does this as core to their MSSP offering, but I have not seen any IDS/NIDS/HIDS that truly goes that far. You have pointers to products that provided log analysis as well as traffic monitoring for anomalies?


Ron DuFresne
- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629

...We waste time looking for the perfect lover
instead of creating the perfect love.

                -Tom Robbins <Still Life With Woodpecker>
Version: GnuPG v1.2.4 (GNU/Linux)

firewall-wizards mailing list
firewall-wizards () honor icsalabs com

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]