Anderson, Derick wrote:
Joel, thanks for providing your IPS assessment - it was hugely
beneficial.
Do you see, in general, any benefit to having an IDS monitoring traffic
when there's an IPS at the gateway? The reason I ask is because of your
comment about turning on IDS inside the firewall (although you also
mentioned that Cisco has a separate processor for IDS). As I see it, an
IDS serves a different purpose than an IPS, which is auditing. For
example, I set up my IPS in "sane" mode and I set up a separate IDS
behind that which should only trigger on stuff the IPS misses.
To me, that kind of setup can have value, I was just wondering what your
> thoughts were on that.
Derick:
Yes, I very much think that there is a need for IDS even when you
have IPS. I think that my words were not as precise as they
should have been.
When I said that you should not run
"IDS inside the firewall," I did not mean
"IDS topologically inside of the firewall" but
"IDS actually incorporated inside of the firewall itself."
I re-read my post and see how it could easily be misinterpreted.
But since IDS and IPS are two VERY different things
(one blocks known attacks; the other is a security problem
detection and network visibility tool), I think that there is
room for both.
In fact, we run both: IPS out at the edge near the firewall
(don't have any of those fancy UTM firewalls ourselves :-(),
and IDS closer to the things I "care" about.
So I'm in total agreement with you. Sorry if I wrote poorly
and didn't make that clear.
jms
--
Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719
Senior Partner, Opus One Phone: +1 520 324 0494
[EMAIL PROTECTED] http://www.opus1.com/jms
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
