TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
SANS are good, but they do tend to generalise. They are offering advice to the masses,
so I guess stealth mode configuration in the hands of an IDS beginner could be
considered a risk from their point of view.
I have been to SANS conferences too and they are quite interesting sessions.
If you saw my email on the subject and the gentleman from ISS's reply, then that is
the position on the subject.
There are prerequisites that must be me for the Stealth mode to be considered secure.
If you do it carefully, you are secure.
If you dont, you arent!!
We use it. I trust it.
Stephen.
=================================================================
>From my archive:
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Actually, Stephen, if your RS monitoring interface is listening via a tap or
uni-directional span port, then even the switch is unaware.
James R Lindley
Anomaly Detection Xpert
X-Force Surveillance and Response Unit
Managed Security Services
Internet Security Systems Inc
Vox: 678-443-6323
Fax: 678-443-6482
An unquenchable thirst for Pierian Waters.
Internet Security Systems - The Power To Protect.
-----Original Message-----
From: Service ISSecurity [mailto:[EMAIL PROTECTED]]
Sent: Friday, July 21, 2000 4:06 AM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: RE: Real Secure 5.0
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
I am losing something here!!
I use stealth mode and have a high degree of confidence in it.
Yes, its true that you have to be careful.
If you disable / unbind everything in the NT network configuration (I am of
course assuming an NT sensor) from the stealth mode interface AND disable IP
forwarding AND harden your operating system I cannot see how a stealth mode
interface can be turned into a path of least resistance.
To all intents and purposes the interface is completely invisible.....except
of course to the switch to which it might be attached :)
Stephen
DISCLAIMER: Any e-mail messages from the Bank for International Settlements
are sent in good faith, but shall not be binding nor construed as
constituting any obligation on the part of the Bank.
CONFIDENTIALITY NOTICE: This e-mail contains confidential information, which
is intended only for the use of the recipient(s) named above. If you have
received this communication in error, please notify the sender immediately
via e-mail and return the entire message. Thank you for your assistance.
>>> <[EMAIL PROTECTED]> 07/25/00 06:16pm >>>
If your NE is running in stealth mode, is there any possibility that the box could be
compromised? ISS says that if there is no IP bound to the NIC then an intruder should
not be able to detect its presence.
At a SANS conference, I heard otherwise, so what's the real deal on this issue?? Our
network people think that since the box is in promiscous mode, then it is not
necessary to harden the box. I think it is important to hardent the box,
but I need some valid reasons as to why this should be done. Anyone have any ideas
that I could present to them (besides the risk of internal attacks to the IDS).
Thanks again,
Mark
