Re: IDS and Spywares

["Jay Archibald" <jay.archibald () comcast net>]

>  Could anyone in the group name a few IDS which detect spywares. In my
view spywares are to
>  be detected by an antivirus system and not by a network device.

Your view is correct in the regard that antivirus software should DETECT and
REMOVE spyware, but if you want to protect every device in a network from
the effects of spyware a good defense is still through an IDP or firewall.
Can you garantee every network host in your network has an anti-virus client
running with the latest definition updates?  Even if you can,
spyware/malware creators still have tricky ways of evading
anti-virus/anti-spyware scanners.  In my opinion, perimeter security is
still an effective way to secure a network.

Juniper/Netscreen's IDP systems detect and block spyware.  The nice thing
about their product is they catagorize the spyware into several different
catagories:  CRITICAL, HIGH, MEDIUM, LOW and INFO.  This makes it easier to
build IDS policies for blocking the critical alerts while only alerting on
the low.  They currently have over 300 spyware signatures.

They have a good IDP product, but I will say that it is excpensive when it
comes to the support contract costs.  One other thing I think they could
improve is providing details or references on spyware signatures like they
do with other catagories like HTTP or SMTP.

Jay Archibald
Student - Norwich University
Master of Science in Information Assurance


----- Original Message ----- 
From: <neelabhsharma1 () gmail com>
To: <focus-ids () securityfocus com>
Sent: Friday, October 07, 2005 12:12 AM
Subject: IDS and Spywares




------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------



------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------