> Could anyone in the group name a few IDS which detect spywares. In my view spywares are to > be detected by an antivirus system and not by a network device.
Your view is correct in the regard that antivirus software should DETECT and REMOVE spyware, but if you want to protect every device in a network from the effects of spyware a good defense is still through an IDP or firewall. Can you garantee every network host in your network has an anti-virus client running with the latest definition updates? Even if you can, spyware/malware creators still have tricky ways of evading anti-virus/anti-spyware scanners. In my opinion, perimeter security is still an effective way to secure a network. Juniper/Netscreen's IDP systems detect and block spyware. The nice thing about their product is they catagorize the spyware into several different catagories: CRITICAL, HIGH, MEDIUM, LOW and INFO. This makes it easier to build IDS policies for blocking the critical alerts while only alerting on the low. They currently have over 300 spyware signatures. They have a good IDP product, but I will say that it is excpensive when it comes to the support contract costs. One other thing I think they could improve is providing details or references on spyware signatures like they do with other catagories like HTTP or SMTP. Jay Archibald Student - Norwich University Master of Science in Information Assurance ----- Original Message ----- From: <[EMAIL PROTECTED]> To: <[email protected]> Sent: Friday, October 07, 2005 12:12 AM Subject: IDS and Spywares ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
