Yeah, the BO stuff is awfully quirky. I have come to the conclusion that NOBODY makes a decent BO protection. Cisco's security agent also has problems. McAfee/Entercept will slow a machine down to a crawl, and it generates false positives like mad.
----------------------------------------------- Andrew Plato, CISSP President/Principal Consultant Anitian Enterprise Security ----------------------------------------------- -----Original Message----- From: Cunningham, Chris, R. [mailto:[EMAIL PROTECTED] Sent: Friday, October 07, 2005 6:57 AM To: Andrew Plato Subject: RE: [ISSForum] Server Sensors that just die Andrew, I'm not sure if this is your issue, but I would definitely disable the Buffer Overflow protection on server sensors, we have had nothing but trouble on Proventia Desktop with this. Also, there is a new build out there with SP 4.3, but I don't remember where it is on the site. It also has a lot of advanced parameters already included that we have previously had to insert into every new install. Hope this helps, Chris R. Cunningham, CISSP | Wilmington Trust Information Protection | 302.636.6225 | Security Hotline 302.636.6222 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andrew Plato Sent: Thursday, October 06, 2005 3:10 PM To: [email protected] Subject: [ISSForum] Server Sensors that just die This is a daunting little problem I have had lately. Server sensors that just croak. They stop working. When you try to restart them, you get an error that the OS cannot find the file specified. Nothing will restart them - rebooting, nothing. The issdeamon is running. Just not the Buffer Overflow / IPS engine. The only fix I have been able to discover is to reinstall SS and start over. Anybody have any info on this? I checked the Knowledge Base on this, but nothing. Also, when is ISS going to put out a new Server Sensor build. I am tired of installing it and then having to go through the whole service pack update. Can't we get a repackage? Oh, and while I am complaining - where the heck is "Proventia Server??!?!?" _____________________________________ Andrew Plato, CISSP President / Principal Consultant ANITIAN ENTERPRISE SECURITY Your Expert Partner for Security & Networking 3800 SW Cedar Hills Blvd, Suite 280 Beaverton, OR 97005 503-644-5656 Office 503-214-8069 Fax 503-201-0821 Mobile www.anitian.com _____________________________________ PGP/GPG public key available at: http://www.anitian.com/corp/keys.htm _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. Investment products are not insured by the FDIC or any other governmental agency, are not deposits of or other obligations of or guaranteed by Wilmington Trust or any other bank or entity, and are subject to risks, including a possible loss of the principal amount invested. This e-mail and any files transmitted with it may contain confidential and/or proprietary information. It is intended solely for the use of the individual or entity who is the intended recipient. Unauthorized use of this information is prohibited. If you have received this in error, please contact the sender by replying to this message and delete this material from any system it may be on. _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
