Hi Bernard, 1)Any value migrating to SiteProtector (which is a free replacement of WGM) , and then implementing add-on Fusion (at a premium) ?
well, the significant value of SP is the Fusion Module that it supports. With only NS and SS installed, without Internet Scanner, there is no point you install SP+FM. Somehow the FM needs Internet Scannet in order for it to perform impact analysis and event correlation. In your case, you need an Internet Scanner. 2) Do we really need to install also ISS Network or System Scanner to have a complete IDS or IPS ? There are a no. of free or cheap scanners in the market ? Can they do the same job as ISS's ? Emm....yes, NS detects the attack and SS confirms an attack and block/prevent the attack at host level. I believe there are alot of cheap IDS in the market and free! eg; snort. You can download signatures for SNORT everywhere. But how you know what this signature does? There is a possiblity that you downloaded multiple same signatures from different sources and deploy these signatures all together! Then, how u confirm it detects an attack well? ISS got:- - PAM, protocol analysis module - X-Force attack signatures - Host Based IDS to compliment the Network Based IDS - Site Protector + Fusion Mudule to perform impact analysis - etc... 3) Any value of implementing RS Guard ? With Guard installed, do I have a IPS then ? Yes, Guard is an IPS. This means it performs inline detection. Concerns are traffic bottleneck and the risk of false positives which may collapse the whole network. IPS is good, but some ppl choose NOT to implemement IPS for the above reasons. IDS is more than enough. Configuring an IPS requires skill and knowledge to make sure it really protects! It is NOT an easy as configuring a firewall. Regards, Nicholas EK Ng Security Engineer -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Saturday, September 06, 2003 5:05 AM To: [EMAIL PROTECTED] Subject: [ISSForum] Advice on SiteProtector Fusion, Guard, Scanners etc Hi All Currently we are using just RS Server and Network Sensors with WorkGroup Manager. Can any one comment on the follwoing ? 1) Any value migrating to SiteProtector (which is a free replacement of WGM) , and then implementing add-on Fusion (at a premium) ? 2) Do we really need to install also ISS Network or System Scanner to have a complete IDS or IPS ? There are a no. of free or cheap scanners in the market ? Can they do the same job as ISS's ? 3) Any value of implementing RS Guard ? With Guard installed, do I have a IPS then ? Thanks Bernard _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
___________________________________________________________________________________________________________________________________________________________________ This mail is protected by Silicon Communications S/B The information contained in this message maybe confidential and protected from disclosure. If you are not the intended recipient of this message, please delete this message immediately. You are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. ~~~This email has been scanned by our anti-virus system. For precaution, please make sure you scan every attachment in this email. Please use at your own risk. Thank you. :) Mailadmin~~~ ___________________________________________________________________________________________________________________________________________________________________
