Re: RE: IDS vs. IPS deployment feedback

>>1. Immature Technology
>>
>>IPS is far from immature. (snip)

Its's more to technology maturity than just time.
It must have been in used as well :)
And it hasn't really been used afaik on a larger scale for the last two years or so.

>>2. False Positives
>>This is ultimately an issue of tuning.  (snip)
As far as I am concerned there isn't much difference between IDS and IPS in the number of false positives.

>>If you think you're going to drop an IPS inline, >>slap some rules on it, and never touch it again >>- you shouldn't be getting an IPS. (snip)

Or an IDS for that matter...

>>And frankly, what is worse - a few POSSIBLE >>disruptions due to false positives, or getting >>hacked and 0wn3d and losing your business.

I for one worry more about downtime than getting hacked. If I am are well organised, patched and secured in depth, the possibility for getting
hacked is very low. A 'leet hacker would probably operate under a IPS/IDS detectonrange anyway.


>>With an IPS, when you see a really nasty alert, >>you can take note and move along, because you >>know the IPS blocked it.

BEFORE you add an rule to your IPS/IDS you patch for the vulnerability it detects and /or make sure
it doesn't pass your firewall. Then you don't need any IPS to block it.

>>Also, I think the DOS angle is WAY overhyped. >>Its frankly a weak excuse.

By adding IPS, you open up for DoS attacks that was not there before. Why increase risk when you really do not have to ? Imho it is IPS that is WAY overhyped :)


>>IDS Dead?

>>IDS may not be dead, but its value is >>diminishing.

IDS may be passive but an security analyst who knows his job is not. In fact by placing a IPS in your network you might even introduce false sense of security into your organisation.

"Oh, I thought the IPS was supposed to blocked that"


>>The unexamined IDS is not worth having, to >>paraphrase good old Socrates.

But the unexamined IPS is ???!


>>These are, of course, my opinions. And >>naturally, I have a vested interest in people >>buying more IPSs - because I sell them.

I rest my case :)

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------