Re: IDS outside of firewall?

["Marcus J. Ranum" <mjr () nfr net>]

Ryan Russell wrote:
> Marcus, you're in a good postion to comment...
> If I only have budget for one, where's the best
> place to put it?

I'd stick it inside, mostly because if it were outside
it'd likely generate too many uninteresting alerts (where
I define "uninteresting alert" as one that notifies you
of an attack launched against your firewall that you
know your firewall can block). I might go further and
configure it to have different alert levels for intrusion
signatures directed against key internal systems (servers
and whatnot) and outgoing through the firewall (naughty
insiders running up the risk of big legal bills).

mjr.
--
Marcus J. Ranum, CEO, Network Flight Recorder, Inc.
work - http://www.nfr.net
home - http://www.clark.net/pub/mjr