IDS: Re: IDS requirement

[Jimi Thompson <jimi.thompson () gmail com>]

I realize that I'm a bit late here, but it's been a holiday.  We had a
similar discussion on the SNORT mailing list recently and I'll distill
it down for you.  The general concensus is that IPS is mostly
marketing hype.  Unless you are doing something to identify an attack
in progress in real time and actively doing something (i.e. modifying
a firewall rule or routing table) to stop that attack, you are not an
IPS, because you are not, by definition, preventing anything.

IDS = intrusion detection system

IPS = intrusion prevention system

HTH,

Jimi


On Mon, 22 Nov 2004 15:28:28 -0600 (CST), skill2die4 () secguru com
<skill2die4 () secguru com> wrote:
> > Can anyone email me a document on how IDS/IPS actually
> > works.....with the terminology well explained.
> IMHO, articles of your interest would be :
>
> FAQ's
> ============
> [FAQ] Sniffing (network wiretap, sniffer)
> [FAQ] IDS
>
> Terminology
> =============
> [AndyCuff] Intrusion Detection Terminology
> [A.Cliff] Intrusion Detection Systems Terminology
>
> Basic Papers
> ===============
> [SecurityFocus] An Introduction to Intrusion Detection Systems
> [SecurityFocus] Network Intrusion Detection Signatures
> [SecurityFocus] Intrusion Detection: Filling in the Gaps
> [Cisco] Intrusion Detection Planning Guide
>
> links to all the above is availabe at,
>
> http://www.secguru.com/index.php/content/category/6/145/115/
> [ www.secguru.com -> Network Devices -> IDS ]
>
> Also , visit Andy Cuff's site : http://www.networkintrusion.co.uk/
> for much info ... :-)
>
> HTH,
>
> -=skillz=-
>
> ..
>
>
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> --------------------------------------------------------------------------

-- 
Thanks,

Jimi

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------