IDS mailing list archives
RE: Real world experience with HIDS
From: "Sekurity Wizard" <s.wizard () boundariez com>
Date: Fri, 3 Feb 2006 14:57:51 -0500
Haha... I work with a very large installation of ISS RSS 7.0 on UNIX & Windows. I wish I could tell you which company I work for, but alas, it's against regulations. We currently have 200+ RSS/HIDS Agents on UNIX + Windows platforms, and your answers are in-line below. Cheers. /Wizard -----Original Message----- From: Palmer, Paul (ISSAtlanta) [mailto:PPalmer () iss net] Sent: Tuesday, January 31, 2006 6:20 PM To: focus-ids () securityfocus com Subject: RE: Real world experience with HIDS Paul, I wonder how many sales guys are going to e-mail you pretending to be from a competitor ;) Paul -----Original Message----- From: Paul Schmehl [mailto:pauls () utdallas edu] Sent: Tuesday, January 31, 2006 4:45 PM To: focus-ids () securityfocus com Subject: Real world experience with HIDS I have some questions for real world users (not vendors) of HIDS products. If you are using HIDS products *and* you're happy with the results, please respond to the following quesitons. 1) Ease of install - can it be done through GPO? SMS? Login scripts? No, No, No :-) 2) Usefulness of the information generated - have you detected any exploits? How were you notified? Etc., Useful for lots of false positives and we even found some work propogation with it. 3) Centralized management - is there any? If so, how easy is it to use? RSS SiteProtector Console - decent at best - slow Configurable at the host level? Or group of hosts level? Group level, via policy per group container. 4) Access to data - is it possible to restrict access to the data so that an administrator on the server would *not* be able to see the output of the HIDS? Not sure what you mean? 5) Interference with the server - does it consume lots of memory or CPU? No, it doesn't, barely noticeable Is it proactive or passive? Proactive but mostly passive, only a few signature trigger auto-blocks 6) Would you purchase again, if you had the option? No - there are better solutions PLEASE NOTE: Any vendor on this list who emails me suggesting their product will be automatically dropped from consideration, so be forewarned. You're welcome to respond on the list, if you like, but don't email me or you'll be eliminated from consideration. Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/ir/security/ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- Re: Real world experience with HIDS Pukhraj Singh (Feb 02)
- RE: Real world experience with HIDS Charles Heselton (Feb 07)
- <Possible follow-ups>
- RE: Real world experience with HIDS Palmer, Paul (ISSAtlanta) (Feb 02)
- Re: Real world experience with HIDS FinAckSyn (Feb 06)
- Re: Real world experience with HIDS Paul Schmehl (Feb 06)
- RE: Real world experience with HIDS Gregg Earnhart (Feb 07)
- Real world experience with Dlink Hotspot Max Kreimerman (Feb 07)
- Re: Real world experience with HIDS lucien Fransman (Feb 07)
- Re: Real world experience with HIDS Paul Schmehl (Feb 06)
- RE: Real world experience with HIDS Sekurity Wizard (Feb 07)
- Re: Real world experience with HIDS Daniel Cid (Feb 13)
- Re: Real world experience with HIDS Sebastien Tricaud (Feb 14)