RE: GIDS, Intrusion Prevention: A Firewall by Any Other Name

["Ofir Arkin" <ofir () sys-security com>]

What I learned along the years is that the borders between "classical"
roles are more blurred than ever since the levels of defense we require
as well as the places we wish to have it, the flexability and the
feature set is more demanding as the years pass.

I hope this is more clear this time :)

Ofir Arkin [ofir () sys-security com]
Founder
The Sys-Security Group
http://www.sys-security.com
PGP CC2C BE53 12C6 C9F2 87B1 B8C6 0DFA CF2D D360 43FA  

-----Original Message-----
From: Crispin Cowan [mailto:crispin () wirex com] 
Sent: 18 August 2002 01:54
To: Ofir Arkin
Cc: 'Iván Arce'; firewall-wizards () nfr net;
core.lists.firewall-wizards () corest com
Subject: Re: [fw-wiz] GIDS, Intrusion Prevention: A Firewall by Any
Other Name

Ofir Arkin wrote:

> Hogwash is cool, do not forget it is open source and developed on the
> spare time of Jed. At the end of the day it works well and provides
> exactly what Jed tells you it provides.
As I said when I posted my rant, I'm not criticizing Hogwash per se. I 
think Hogwash is *very* cool. I just think it is a mistake to label it 
anything other than a kind of firewall (I suggest "signature firewall").

Of course, Hogwash is a lot less guilty of using funky labels to avoid 
direct comparisons to firewalls than the commercial signature firewall 
vendors. Jed does it in his spare time, and the commercial vendors stand

to earn $ if they can sell stuff, and avoiding comparisons to 
Checkpoint|Raptor|Whale AirGap|pick-your-favorite-funky-firewall, that 
may help.

I'm just trying to consistently call a spade a spade. Inline IDS is a 
kind of firewall. Once that is understood, we can discuss the 
competative merrits, and the benefits of composing various kinds of 
firewalls in series. Say, there's an interesting thought:

    * NIDS compose in parallel:
          o clamp as many different NIDS onto your network as you can
            afford to monitor
          o more NIDS don't slow down your traffic at all
          o parallel NIDS can check for more/different kinds of
            intrusions in parallel, providing scaling
    * firewalls (including in-line IDS) compose in series
          o put as many in as you like, so long as *none* of them block
            your legitimate traffic
          o adding more firewalls increases latency, and throughput is
            limited to the throughput of your slowest device
          o serial firewalls can also scale to provide checking for
            more/different kinds of attacks, at the expense of the above
            latency and throughput issues

Crispin

-- 
Crispin Cowan, Ph.D.
Chief Scientist, WireX                      http://wirex.com/~crispin/
Security Hardened Linux Distribution:       http://immunix.org
Available for purchase: http://wirex.com/Products/Immunix/purchase.html



_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards