RE: IDS requirement

["Brito, Nelson (ISS Brazil)" <NBrito () iss net>]

I disagree, because the IPS concept is misunderstood for almost
everybody.   
  
IPS, as you said, is Intrusion Prevention (some people says Protection)
System.  
  
IMHO, IPS is something between the source of attack and the target,
blocking or stopping the attack in real time, without interaction (or
any kind of re-configuration) with other device / application.   
  
The IPS, by default, uses its own engine to do that, which means that
IPS does not need to re-configure nor Firewalls neither Routers to block
or stop a threat, even because IPS is not just a technology to use
protecting network segments. It is a concept, as I said bellow, between
the source of attack and the target. It can be a HIPS, stopping the
attack before it reaches the target (OS).  
  
So, briefly, IPS can be:  
1 - A network engine to stop attacks before they reach the target
systems, a device in other words;  
2 - An engine installed on a machine which stops the attacks before they
reach the machine, an engine working in Kernel space or even in a lowest
level.

Sorry my broken English, it is not my main Language, by the way.

Cheers.

- nb

{(!($^O=~/^[M]*$32/i)&&($0=~s!^.*/!!))||($0=~s!.*\\!!)}print$0;

 

-----Original Message-----
From: Jimi Thompson [mailto:jimi.thompson () gmail com] 
Sent: Wednesday, December 01, 2004 2:35 AM
To: skill2die4 () secguru com
Cc: Raj B; focus-ids () securityfocus com
Subject: Re: IDS requirement


I realize that I'm a bit late here, but it's been a holiday.  We had a
similar discussion on the SNORT mailing list recently and I'll distill
it down for you.  The general concensus is that IPS is mostly marketing
hype.  Unless you are doing something to identify an attack in progress
in real time and actively doing something (i.e. modifying a firewall
rule or routing table) to stop that attack, you are not an IPS, because
you are not, by definition, preventing anything.

IDS = intrusion detection system

IPS = intrusion prevention system

HTH,

Jimi


On Mon, 22 Nov 2004 15:28:28 -0600 (CST), skill2die4 () secguru com
<skill2die4 () secguru com> wrote:
> > Can anyone email me a document on how IDS/IPS actually 
> > works.....with the terminology well explained.
>
> IMHO, articles of your interest would be :
>
> FAQ's
> ============
> [FAQ] Sniffing (network wiretap, sniffer)
> [FAQ] IDS
>
> Terminology
> =============
> [AndyCuff] Intrusion Detection Terminology
> [A.Cliff] Intrusion Detection Systems Terminology
>
> Basic Papers
> ===============
> [SecurityFocus] An Introduction to Intrusion Detection Systems 
> [SecurityFocus] Network Intrusion Detection Signatures [SecurityFocus]

> Intrusion Detection: Filling in the Gaps [Cisco] Intrusion Detection 
> Planning Guide
>
> links to all the above is availabe at,
>
> http://www.secguru.com/index.php/content/category/6/145/115/
> [ www.secguru.com -> Network Devices -> IDS ]
>
> Also , visit Andy Cuff's site : http://www.networkintrusion.co.uk/
> for much info ... :-)
>
> HTH,
>
> -=skillz=-
>
> ..
>
>
>
> ----------------------------------------------------------------------
> ----
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from

> CORE IMPACT. Go to 
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ----------------------------------------------------------------------
> ----


-- 
Thanks,

Jimi

------------------------------------------------------------------------
--
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------
--


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------