RE: A novice question

[Talisker () technologist com (Talisker)]

Raj

> from all the mails i have been getting here i belive that all the IDS
> products have all the available attack signatures. ie even if the network
> that i use do not contain any solaris or NT my IDS s/w will check for all
> the possible exploits that can be mounted against an nt or solaris.
>
> now why is this necessary. since the performance of an IDS system can be
> improved if the number of attack signature can be reduced.

The IDS that I have played with have all been modular with their signature
selection, ie you can turn off those signatures that are obsolete or not
relevant.

Beware though.  retaining those signatures may detect an outgoing attack
against someone else from either an unscrupulous person from within your network or a compromised system.  Either way 
you will be held partly responsible.  

Take Care

Andy

www.internations.net/uk/talisker