ssh and ids

["Runion Mark A FGA DOIM WEBMASTER(ctr)" <mark.runion () us army mil>]

Lets suppose the attacker is mildly sophisticated, and after making the
initial assault roots the box and installs a secure backdoor or two.  Is
there any IDS capable of isolating data it cannot read, except to monitor
authorized port usage of a system or group of systems?  Not to complicate
the question, but when the attacker is using portal gates and all
communications traffic is encrypted in normal channels how can an IDS
participate?  Monitoring normal traffic patterns seems a bit slow for
detection.

-
Mark Runion 


---------------------------------------------------------------------------

---------------------------------------------------------------------------