Re: IDP/IDS products

["Avdagic, Indir" <indir_avdagic () WSU EDU>]

We are using Cisco and Juniper IPS devices in inline mode. Now we are
looking to test Tipping Point, too. We are blocking traffic instead of
individual hosts. From time to time we completely shun individual hosts
or small subnets. We didn't have any problem with false positives.
Before we introduce the new IPS device we spend a lot of time testing in
the lab. Also, we contacted the other university which run the same IPS
(info provided by vendor) and discuss their experience. We had a lot of
problems with Juniper's Deep Inspection. DI is software based IPS and we
had a lot of problems with high CPU usage - so we decided to cancel our
Deep Inspection subscription by Juniper Networks.

I hope this helps.

Best Regards,

_________________________________
Indir Avdagic, CISSP, ACSA, TICSA
Network Security Engineer
Washington State University 
indir_avdagic () wsu edu
Phone: (509) 335-3279



-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Chuck Braden
Sent: Tuesday, September 16, 2008 12:24 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] IDP/IDS products

I am also in the process of a similar effort. Can I be included in the
responses if possible?

I would also like to know if any open source solutions have been
attempted/deployed?



Jimmy C Braden
Information Security Officer
Extension Information Technology
Texas AgriLife Extension Service
j-braden () tamu edu


> > > Robert Riley <rriley3 () ND EDU> 9/16/2008 2:04 PM >>>
We are seeking peer feedback on the use of Intrusion
Detection/Prevention systems.

If your organization has deployed an enterprise IDP/IDS, are you:

1. Using the product inline or in bypass mode?
2. Are you using the product to shun hosts?
3. How are you managing false positives?
4. Which product do you use and what was your selection criteria?
5. Have you documented any known issues with the product?

Please feel free to contact me offlist if you prefer.

Thank you.
--
Robert Riley
Information Security Professional
University of Notre Dame