Re: Hybrid IDS

[Dan Nadir <dan () iss net>]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems... email questions to ids-owner () uow edu au
NOTE: Remove this section from reply msgs otherwise the msg will bounce.
SPAM: DO NOT send unsolicted mail to this list.
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
-----------------------------------------------------------------------------

Mark, I agree with you, but the job of a "marketing" person is not to 
explain packet grepping and protocol decodes to people on this list. 
Marketing people try to explain how a product solves a problem and/or how 
it is different from something that "normal people" already know.  That's 
why IDS presentations always started with "you already have a firewall" and 
went from there by way of comparison.
The term "hybrid" is being used by vendors to convey the same message. If 
you sell IDS that monitors logs, and you sell IDS that monitors packets, 
then to *your customers and future customers*, a hybrid system is one that 
does both. Not a lot of technology here.

Trying to define a term like this is only sightly easier than defining 
"host-based" IDS in general. ;-)
Ask SymAxent, Centrax, ISS, NetworkIce, and NAI to define exactly what 
host-based IDS is and what it must do at a minimum to be considered 
host-based. You'll (unfortunately) get 5 answers.

Dan



At 9/7/00 10:33 AM, mark.teicher () networkice com wrote:
> I tend to agree with MJR on this space, the marketing type firms out there 
> don't really understand the space or the techie geekie stuff that some of 
> us utter to them.  The tend to grab onto the first one or two blurbs of 
> techie talk and that what they stick with.  You try to explain them the 
> different between packet grepping and protocol decode, they get all glossy 
> eyed and almost fall over from boredom.