Intrusion Detection Systems: Re: Ramping up for another review

[Talisker () networkintrusion co uk (Talisker)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
Misha

CA have bought out 2 products the first ETrust audit is a host based IDS, I
have signed a non disclosure agreement therefore I cannot pass my adverse
comments on this product. (biting hard on tongue)
The second is Etrust IDS better known as Sessionwall 3, I first evaluated
this product over 2 years ago, it has been greatly improved since then and
has an easy to use front end, I have looked at it as a net nanny and an
email content monitor.  However an IDS hmmm (bites tongue again).

Andy
                    '''
                 (0 0)
  ----oOO----(_)----------
  | The geek shall        |
  |  Inherit the earth     |
  -----------------oOO----
               |__|__|
                  || ||
              ooO Ooo

The opinions contained within this transmission are entirely my own, and do
not necessarily reflect those of my employer.

----- Original Message -----
From: "Misha" <misha () insync net>
To: "Greg Shipley" <gshipley () neohapsis com>
Cc: <ids () uow edu au>
Sent: Wednesday, July 05, 2000 7:27 PM
Subject: Re: IDS: Ramping up for another review

> Archive: http://msgs.securepoint.com/ids
> FAQ: http://www.ticm.com/kb/faq/idsfaq.html
> IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
> HELP: Having problems... email questions to ids-owner () uow edu au
> NOTE: Remove this section from reply msgs otherwise the msg will bounce.
> SPAM: DO NOT send unsolicted mail to this list.
> UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
> --------------------------------------------------------------------------
> It looks like some products from the behemoth software companies is
> missing. I believe HP and CA have IDS products, though to be honest I
> cannot figure out what they do and have never met anyone who has deployed
> one.
>
> Misha
>
>
> On Wed, 5 Jul 2000, Greg Shipley wrote:
>
> > Archive: http://msgs.securepoint.com/ids
> > FAQ: http://www.ticm.com/kb/faq/idsfaq.html
> > IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
> > HELP: Having problems... email questions to ids-owner () uow edu au
> > NOTE: Remove this section from reply msgs otherwise the msg will bounce.
> > SPAM: DO NOT send unsolicted mail to this list.
> > UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
> --------------------------------------------------------------------------
> > Ok, it's that time again.  Time when I go stock up on Red Bull, re-tool
the
> > Network Computing Chicago lab, get some serious IDS products in and
start
> > going to town.  This year its going to be a little different, however,
as
> > I'm going to be doing this "review" in stages, and this field has gotten
> > way to big to a) compare all of these products as apples to apples and
b)
> > cover all of the topic areas in under 5,000 words.
> >
> > Yup - time for another round of IDS reviewing.  I'm thinking of sending
> > invite letters to the following:
> >
> > Network Security Wizards:
> >   - the Dragon "suite"
> >
> > ISS
> >   - RealSecure
> >   - Decisions
> >
> > Axent
> >   - NetProwler
> >   - Intruder Alert
> >
> > NAI
> >   - Cybercop monitor
> >
> > Cisco
> >   - NetRanger
> >   - What's in the IOS builds
> >
> > Hiverworld
> >   - forget the name, but it looks and sounds cool
> >
> > NFR
> >
> > Intrusion.com (was ODS)
> >   - the Kane stuff (was CMDS, and some others)
> >
> > NetworkICE
> >   - BlackICE
> >
> > CyberSafe
> > - Centrax
> >
> > So my question is - am I missing anyone?  (and don't say SNORT - I'm on
> > that, but it doesn't quite fit here).  Also, I asked this last year and
no
> > one responded: what do you guys want to see covered that hasn't been in
the
> > past?
> >
> > Feedback wanted,
> >
> > -Greg