IDS: RE: TippingPoint Releases Open Source Code for FirstIntrusionPrevention Test Tool, Tomahawk

["Rob Shein" <shoten () starpower net>]

Oh, I have to disagree with this, and for a one-word reason: "open".
Because it's an open-source tool, everyone can look into it and see how it
works.  For example, before I'd even started reading this thread, Martin
Roesch had chimed in with his own assessment of how it works.  So if it's
geared towards making any one vendor look better than all the others...well,
they'd get caught at it right off, and it would have the opposite effect.
(For example: the infamous Mier Labs testing of an Intrusion.com product
some years ago, using ridiculously unrealistic network traffic.)

And also worth pointing out is that unlike the RDBMS example listed below,
TippingPoint isn't even saying that their product is better with this tool.
For that matter, they aren't making any claims at all; their release could
just as easily have come from any researcher with no vendor ties, without
being any different.  They're only saying, "hey, this is a rapidly-growing
technology, and there aren't any really tools for non-vendors to  validate
products...here's something we've come up with to get the ball rolling in
that direction."  I have to applaud this, and wonder what motivates one of
their competitors to reflexively slam it for logically incorrect reasons.

> -----Original Message-----
> From: Mitchell Ashley [mailto:mitchell () stillsecure com] 
> Sent: Tuesday, November 02, 2004 12:57 PM
> To: focus-ids () securityfocus com
> Subject: RE: TippingPoint Releases Open Source Code for 
> FirstIntrusionPrevention Test Tool, Tomahawk
>
>
> Lets face it, any "open" IPS testing tool released by any IPS 
> vendor will have little industry or customer credibility. 
> This is reminiscent of the early RDMBS days when the vendors 
> created their own proprietary benchmarks. They had little 
> credibility until the benchmark tests we defined, specified 
> and improved by industry standards groups. 
>
> Caveat emptor.
>
> . . .
> Mitchell Ashley
> CTO
> StillSecure
>
> 303-881-9353 Mobile
> 303-381-3880 Fax
>
> www.stillsecure.com
> Reducing your risk has never been this easy.
> . . .
> The information transmitted is intended only for the person 
> to which it is addressed and may contain confidential 
> material. Review or other use of this information by persons 
> other than the intended recipient is prohibited. If you've 
> received this in error, please contact the sender and delete 
> from any computer. 
>
>
> -----Original Message-----
> From: Clemens, Dan [mailto:Dan.Clemens () healthsouth com] 
> Sent: Tuesday, November 02, 2004 8:17 AM
> To: Kyle Quest; focus-ids () securityfocus com
> Subject: RE: TippingPoint Releases Open Source Code for 
> FirstIntrusionPrevention Test Tool, Tomahawk
>
>
>  
>
>       >What we need... is Snort for IPS/IDS/Firewall 
>       >testing, which would be advanced by the security 
>       >community and not by a commerical company who's 
>       >business interests are in conflict with the purpose 
>       >of the tool. 
>
>
>       That's just my take on it... 
>
>
>       - Kyle, Don't forget the 'snort' folks have just as 
> much of a vendor presence as TippingPoint or any other IDS 
> vendor. TippingPoint _may_ be trying to encourage use of 
> their tool for IDS evolution as a whole  much like snort has 
> yet still has hopes they will get some benefit from their free tool.
>
>       Now do you have any pcaps to contribute to snort or the 
> rest of us packetninjas?
>
>       -Dan
>
>
> Confidentiality Notice: This e-mail communication and any 
> attachments may contain 
> confidential and privileged information for the use of the 
> designated recipients named above. If 
> you are not the intended recipient, you are hereby notified 
> that you have received this 
> communication in error and that any review, disclosure, 
> dissemination, distribution or 
> copying of it or its contents is prohibited. If you have 
> received this communication in 
> error, please notify me immediately by replying to this 
> message and deleting it from your 
> computer. Thank you.
>
>
> --------------------------------------------------------------
> ------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world 
> attacks from 
> CORE IMPACT.
> Go to 
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_04
0708 
to learn more.
--------------------------------------------------------------------------




--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------