RE: PCI-DSS and IPS

["Hill, Pete" <Pete.Hill () sit-up tv>]

Hi rm,

An IPS isnt obligatory, but an IDS is.  However, if you have a
requirement to be PCI compliant and need to install an IDS I see no
reason why you would not put in IPS instead.

You can go the route of FW with IPS functionality, but depending on the
segregation of your network you may find this is simply not adequate.
In most instances you will be required to have IDS modules on your
firewalls with agents monitoring every server within your card data
environment (CDE).  Your CDE will be dictated by your QSA so this is
really a question you should be asking them, it is they that will be
deeming you compliant after all!

Regards
Pete   

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of raimarm () gmail com
Sent: 20 February 2009 09:20
To: security-basics () securityfocus com
Subject: PCI-DSS and IPS

Hi All,
I am a technical orientated guy and not sure about my following
question.
Is a IPS system in regards to PCI-DSS obligatory ?
If yes, would it be possible to take a FW with IPS functionality rather
to buy a dedicated IPS (like deep-inspection, smart-defense and the
like).
Many Thanks
rm

Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file 
attachments.  Check your e-mail security settings to determine how attachments are handled.


A number of bogus e-mails are currently circulating in the UK encouraging customers to visit fraudulent websites where 
personal or Internet security details are requested. Bid tv/Price-drop tv/Speed auction tv would never send e-mails 
that ask for confidential, personal security information or details regarding your account status.

The content of this e-mail does not constitute a contract and any matters discussed herein remain subject to contract.

The contents of this message and all attachments have been sent in confidence for the attention of the addressee only.  
If you are not the intended recipient you are kindly requested to preserve this confidentiality and to advise the 
sender immediately of the error in transmission.

"sit-up ltd, registered in England No: 03877786.
Registered Office: sit-up House, 179-181 The Vale, London W3 7RW.
sit-up ltd is wholly owned by a subsidiary of Virgin Media."