Re: BlackICE IDS

[robert_david_graham () yahoo com (Robert Graham)]

--- Ron Gula <rgula () network-defense com> wrote:
> It should be pointed out that Mr. Graham is an employee of 
> Network Ice Corp. Obviously Marcus is from NFR and I am from
> Security Wizards.

Yeah; I'm not a CEO though :-), just a lowly CTO. I still get to influence
things, though.

> ...no way a nod that says one IDS is
> better than another. 

Better? Network ICE, NFR, and Dragon are very _different_ programs and take
very different approaches. Firewalling is a science, and you really only need
one vendor, but IDS is an art, and each vendor does things very differently,
and you could probably use the overlap. I admire both NFR and Dragon for the
approaches they've taken.

> My largest concern is with BlackICE's marketing claims of 
> protecting the CEO's laptop with a packet based IDS. During 
> my past experience conducting many penetration tests and
> network security audits, targeting a CEO's computer usually 
> revealed completely shared out hard drives and similar 
> usernames and passwords.

Again, there are two variants. The host-based variant comes with a built-in
personal firewall managed from the centralized console. One of the cool things
is that the console can act as a hunter/killer: it can monitor your corporation
looking for anybody who has file sharing enabled, then remotely install onto
their machines. At this point, the firewall filters will prevent the outside
world from getting at the CEO's hard-disk.

> If the CEO is not
> security friendly, then I would first invest the time and
> effort to educate the CEO. 

That is why the console allows the network manager to easily manage/install the
system. BlackICE can be installed invisibly so that the CEO isn't even aware
that it is there. But when he/she takes the little Win98 notebook on the road
and starts dialing up the web, he/she will still be 'behind the firewall'.

> FYI, BlackICE was recently reviewed in NWC's IDS article and
> they had a lot of good things to say about including its
> performance and accurate network session reconstruction. The
> URL for the BlackICE piece is at:
>
> http://www.nwc.com/1023/1023f18.html

This discussion was about performance numbers when doing sniffer-style
intrusion detection. Please see the graph labeled "Network IDS Failure Points"
that compares many products:
http://www.nwc.com/1023/1023f19.html

Regards,
Rob.

=====
Robert Graham
"Anxiously awaiting the millenium so I can start programming
dates with 2-digits again."
__________________________________________________
Do You Yahoo!?
Thousands of Stores.  Millions of Products.  All in one place.
Yahoo! Shopping: http://shopping.yahoo.com