RE: Intrusion Prevention

[Frank Knobbe <fknobbe () knobbeits com>]

On Wed, 2002-12-11 at 14:30, Matthew L. McGuirl wrote:
> ActiveScout's whole approach to the issue of reducing false positives is to assume that all attacks occur after a 
> reconnaissance effort has been conducted. While this is certainly true in many cases it is unlikely that _all_ 
> attacks follow recon.

... or that all attacks are coming from the same source IP address.
Anyone that, during a pen test, scans the target from the same IP
address that he performs attacks from, should seriously revisit his
pen-test methodology.

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part