Re: About IPS testing

[Tod Beardsley <todb () planb-security net>]

Julius Detritus wrote:

> Also everybody knows that IPS are subject to performance issues when they
> are not tuned. So "old" and useless signatures are usually disabled in
> production. Having them enabled for tests will make results unreliable as
> they do not match production conditions.

I don't understand your logic of 'disabling old filters.'

It'd be a pretty sorry state of affairs if your site with your expensive 
IPS got 0wned by Nimda/Slammer/Witty again.

An IPS that can't keep up on both old and busted /and/ new hotness would 
be a pretty useless IPS. You'd be better off just patching your exposed 
machines.

-tod
 (ObDisclaimer: I work at an IPS vendor, TippingPoint)

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------