Re: [fw-wiz] Corporate H/N IPS

From: Talisker (talisker@networkintrusion.co.uk)
Date: 12/14/02 

From: "Talisker" <talisker@networkintrusion.co.uk>
To: "Crispin Cowan" <crispin@wirex.com>
Date: Sat Dec 14 19:34:01 2002

Crispin
I'm not exactly in agreement with many of your points

> EXACTLY like a firewall, only they look at higher level aplication
> protocols than classic packet filtering firewalls.

I for one would not entrust my perimeter defense to a NIPS, however I may
consider using a NIPS to look for intrusion signatures on those packets that
have been passed by the firewall. I feel they complement each other very
well.

> Unfortunately, marketeers are pushing new buzz-words, trying to convince
> people that "host intrusion prevention" is some how different from
> secure operating systems.

There is little doubt that marketing forces are at work. However, from
experience we have lost this battle and to be fair the term IPS isn't so
bad. I do see HIPS as different from Secure OS's they are more widely
available to all, deployable with minimal impact on an existing network and
enterprise aware out of the box.

> True: "intrusion detection" is what you call it when your detector is so
> slow or imprecise that it cannot be used for prevention.

IDS can be a little hit and miss, I've had to switch some off because they
were so inadequate. However, I have also used others to good effect they
have saved my network on many occasions. There are some excellent examples
of both Host and Network IDS and as they mature they are becoming ever more
capable. That isn't to say they will work out of the box they do need a lot
of tender loving care but the investment of some time and tuning pays
dividends.

take care
-andy
Taliskers Network Security Tools
http://www.networkintrusion.co.uk
----- Original Message -----
From: "Crispin Cowan" <crispin@wirex.com>
To: "Talisker" <talisker@networkintrusion.co.uk>
Cc: <firewall-wizards@honor.icsalabs.com>
Sent: Saturday, December 14, 2002 2:36 AM
Subject: Re: [fw-wiz] Corporate H/N IPS

Relevant Pages

  • RE: can ping but not browse
    ... I have stopped the firewall. ... # are safed from all (security) hazards. ... firewall/bastion host to the internet ... # internet and to an internal network, ...
    (Fedora)
  • Re: Why not use NETBEUI on Windows XP ??
    ... Trusted zones means that firewall rules will be bypassed for any or certain ... not count on netbeui being a defense for such as long as smb connectivity ... while the connection is open. ... > Microsoft Networking components on my network. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Why not use NETBEUI on Windows XP ??
    ... Trusted zones means that firewall rules will be bypassed for any or certain ... not count on netbeui being a defense for such as long as smb connectivity ... while the connection is open. ... > Microsoft Networking components on my network. ...
    (microsoft.public.win2000.networking)
  • Re: Firewall for broadband connection
    ... A personal firewall application that runs on your computer will often be ... it clearly needs user intervention to apply updates. ... IP address, then VNC is a simple way to do ... I install VNC, even in a protected network, I always change the port ...
    (comp.security.firewalls)
  • RE: Hidden Ports
    ... this is done by the firewalls to prevent authenticated files from being replaced by trojans and connecting to the internet. ... kerio firewall ... or a program that already had network access attempted to ... > Depending on the Access setting for a component, ZoneAlarm Pro ...
    (Security-Basics)