RE: IDS and Firewall

[Matt Kettler <mkettler () evi-inc com>]

At 09:17 AM 4/29/2004, Shaffer, Paul D wrote:
> At 07:46 PM 4/28/2004, Matt Kettler wrote:
>
> >There are others (ie: Paul) who feel it's better to make the
> >compromise in order to gain the benefits of having an IDS on hand.
>
> Matt, I had to start over because I was got dizzy trying to follow the 
> back and forth in that offline email we had going.  I appreciate you 
> ceding this point.

Yep, it's just a matter of difference of opinion on priorities.

>  And I remember when those two vulnerabilities you mentioned (in our 
> offline conversation) came out last year, but don't recall hearing about 
> them ever being successfully exploited.

Exploits for the old snort 1.9.1 bugs are definitely in-the-wild and not 
theoretical:

http://lists.debian.org/debian-security/2003/debian-security-200304/msg00332.html

http://packetstormsecurity.org/0304-exploits/p7snort191.sh


> I'm sure you'll agree that generally speaking, computer security is all 
> about countering or mitigating risk.  The old saying about the computer 
> locked in a safe at the bottom of the ocean comes to mind.  True absolutes 
> a few and far between.  Everything is a compromise at some level.

Yep.. I agree with you.. You and I just have different priorities as to 
what parts of the compromise is important.

We're just disagreeing on what the value of an IDS is, compared with the 
value of a secure firewall. To me, it's no question, but you think 
differently, and we both hold our opinions quite strongly.





-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE. 
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users