Re: Network IDS

["Adam Newhard" <atnewhard () microstrain com>]

I don't have an answer to your question on Symantec, but you may wanna pick
up the most recent issue of 2600 (2600.org).  You can usually buy a copy at
a local barnes and noble or just off their site.  There's a pretty decent
article (or at least a starting position) on writing an IDS for IIS.  It's
probably not exactly what you're looking for and you probably don't wanna
write the thing from scratch yourself, however, it might prove somewhat
beneficial to you if you ever need to do something custom that the program
doesn't stop.
adam
----------------------------------------------------
Adam Newhard
Microstrain, Inc.
If vegetarians eat vegetables, watch out for humanitarians

----- Original Message ----- 
From: "Duston Sickler" <dustons () charter net>
To: <security-basics () securityfocus com>
Sent: Friday, August 15, 2003 1:30 PM
Subject: Network IDS


> Hello,
>
> I would like to thank in advance everyone who is out of the office.  I
> really do like to hear about it.
>
> The Network Administrator for the company I work for has charged me to
> locate a Network Intrusion Detection System.  We do have a monitored
> firewall between us and the outside world.  We need something to protect
our
> servers from anyone coming from the inside.  We have about 20 Windows 2000
> Servers, 5 NT 4 Servers, and 250 Windows 2000/Thin Net workstations.
>
> We live in a 100% Windows world and the powers that be will not be
receptive
> to any *nix solutions.  We are more the willing to pay for a top of the
line
> product as long is it is in fact top of the line.
>
> Currently I have been looking at the Symantec Gateway Device.  We like the
> idea of a stand alone piece of hardware.  The only problem is we already
> have a gateway server washing our email of viruses and 99% of Spam.
>
> Does anyone have any comments on the Symantec Gateway device?  We have had
> excellent experiences with there Gateway software and NAV Corp.  Does
anyone
> have a different or better device that they could point me towards?
>
> I would like to thank everyone who replies to this post.  I have learned a
> great deal being on this list the last year and will continue to
appreciate
> all the expertise that is freely given here.
>
> Duston Sickler
> CompTIA A+ Certified
> "Cedo nulli."
>
>
> --------------------------------------------------------------------------
-
> --------------------------------------------------------------------------
--
>


---------------------------------------------------------------------------
----------------------------------------------------------------------------