Re: CVE selection for IDS/IPS signature rules

[Enigma <enigma () security-fu com>]

Ravi Chunduru wrote:
> Hi,
>
> There are over 30000 CVE vulnerability reports.  Many IDS/IPS devices
> have around 4000-5000 signature rules. My guess is that these
> signatures may cover (detect)around 4000-7000 attacks.  23000 to 26000
> CVEs, that is, significant number of CVEs are not covered by IDS/IPS
> devices.
>
> I am guessing that there is reason for this. IDS/IPS vendors may be
> selecting few CVEs for developing signatures. What is the selection
> criteria followed in industry? One criteria, I know is that Network
> IDS/IPS devices don't need to worry about attacks that can only be
> mounted on the local machine, that is,  NIDS/NIPS devices only need to
> worry about detection of attacks mounted remotely. Are there any other
> considerations?
>
> Thanks
> Ravi
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
> to learn more.
> ------------------------------------------------------------------------
>
>
>   
Couple of things:

  1. If you are talking about Network IDS/IPS, not all vulnerabilities
     are remotely exploitable.  Some local vulnerabilities can only be 
     detected by a HIDS if they can be detected at all.
  2. Keep in mind that CVE is Common **Vulnerability* *and Exposures,
     so it covers any vulnerability where IDS/IPS are generally
     exploit-centric.  How are you going to detect if a vulnerability
     is exploited if there is no publicly known exploit?  How do you
     find something when you don't know what it looks like?


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------