Re: [fw-wiz] Corporate H/N IPS

From: Fritz Ames (fritzames@earthlink.net)
Date: 12/15/02 

From: Fritz Ames <fritzames@earthlink.net>
To: firewall-wizards@honor.icsalabs.com
Date: Sun Dec 15 10:46:29 2002

        I have two concerns, promises and promises. Is it consesus that
"Intrusion Prevention System" is a term devised to create a
market--instead of creating a solution to a problem in order to satisfy
a market? (It *is* cheaper to dream of product-differentiating terms,
and feature names, than to actually make products accomplish anything
that would be differentiating.) Is it also agreeable to say that
application proxies are harder to support and administer than packet
filters? Is it still fact that IDS's need a lot expertise, care, and
feeding to avoid their being turned off or ignored? Don't "IPS" vendors
pitch their solutions as being superior because they can do what IDS's
and application-level firewall's can do? I feel that I have been told
that products falling in the "IPS" category will cure all of my ills
with no significant burden to keep them going, despite the fact that
they combine two worlds that require expertise and to install and
maintain. (My experience keeps failing me, as I find them a lot of
work. 'Could just be me, and not being able to devote my time to them
100%.) The promises of new "product categories" like IPS's appear only
good for obfuscation of what products actually do--therefore making
competition on function and price much more difficult. The false
promises by some also make it more difficult for legitimate and solid
innovations to compete (because they are competing with vaporware or
marketingware or, more accurately, lies.) So, what to do? Am I wrong?

Thank you,

Fritz

(Sorry for offering kerosene without offering solutions, but I have to
start somewhere...)

Crispin Cowan wrote:
> Talisker wrote:
>
>> Crispin
>> I'm not exactly in agreement with many of your points
>>
> No worries; that's what forums like this are for :)
>
>>> EXACTLY like a firewall, only they look at higher level aplication
>>> protocols than classic packet filtering firewalls.
>>>
>>
>> I for one would not entrust my perimeter defense to a NIPS, however I may
>> consider using a NIPS to look for intrusion signatures on those
>> packets that
>> have been passed by the firewall. I feel they complement each other very
>> well.
>>
> Neither would I. I'm not saying that products marketed as NIPS make
> *good* firewalls. In particular, they are incomplete firewalls, because
> they don't have the classical capability to block on IPs, ports, & such.
> Conversely, one could also say that classical packet filters are also
> incomplete, because they don't look at high level application traffic.
> The composition of the two adds value to make a more complete firewall
> system.
>
> None of which is new: ancient firewall design calls for an outer
> firewall defend your DMZ, and an inner firewall to defend your LAN.
> These firewalls would often be of different design, e.g. a packet filter
> on the outside and a proxy firewall on the inside.
>
> To be clear, my claim is not that NIPS suck. My complaint is that the
> claim that NIPS is a bold new concept is crap, and that NIPS should
> properly be understood as an incremental improvement in firewall
> technology.
>
>> I do see HIPS as different from Secure OS's they are more widely
>> available to all, deployable with minimal impact on an existing
>> network and
>> enterprise aware out of the box.
>>
> Again, this is an incremental improvement on an old concept. A retro-fit
> security enhancement package fitted onto an existing OS to make it a
> secure OS. Olde schoole secure OS people will rant about how much less
> cost-effective it is to retro-fit security, and they may be right, but
> that's what it is. We built one (Immunix) because I thought it was
> interesting, and because the economics of the cost of wholesale
> replacement of operating systems dwarf the cost benefits of designing in
> security vs. retrofitting it.
>
>>> True: "intrusion detection" is what you call it when your detector is so
>>> slow or imprecise that it cannot be used for prevention.
>>>
>>
>> IDS can be a little hit and miss, I've had to switch some off because
>> they
>> were so inadequate. However, I have also used others to good effect they
>> have saved my network on many occasions.
>>
> Again, I'm not saying that IDS has no value, just that its value needs
> to be understood. Both Intrusion Preventers and Intrusion Detectors are
> looking at traffic/operations, and trying to distinguish good from bad.
> If the distinction can be done precisely (nearly zero false positives)
> and in real time (before the traffic/operation completes) then it can be
> used for access control. If the distinction is heuristic (has a real
> false positive rate) or is slow (makes the distinction long after the
> traffic/operation completes) then you use it for detection instead of
> prevention.
>
> The trade off for detection is that detectors can detect much more
> subtle intrusions. They can infer attacks comprised of legitimate
> operations that would have passed access control. They can spend more
> time on analysis. This is why you have detection in addition to your
> access controls/prevention stuff.
>
> Crispin
>

Relevant Pages

  • RE: Rather funny; looks like page defacement to me
    ... another security tool (VA, AV, firewall, etc.) that could have done the job ... I am not saying the IDS are always useless, but they are most useful as ... they denigrate Intrusion Prevention Systems and hail ...
    (Focus-IDS)
  • Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?)
    ... > what makes it not be equal to a firewall? ... of me if I turn out to be wrong (the joy of archived email lists!): ... think what we know today as a "Network Intrusion Prevention System" (NIPS) ... the comparison between NIDS and NIPS was silly, ...
    (Focus-IDS)
  • Re: Changes in IDS Companies?
    ... Well...Netscreen didn't *build* a NIPS, ... while everyone gets all excited about the possibility of inline IDS, ... IPS is not a performance bottleneck. ... Firewall & IDS vendors ally/acquire partners on the other side, ...
    (Focus-IDS)
  • Re: [fw-wiz] Corporate H/N IPS
    ... >but using IDS techniques to block an attack. ... EXACTLY like a firewall, only they look at higher level aplication ... A HIPS will block an attack aimed at the Host upon which it is ... finer-grained intrusion prevention (such as Type Enforcement access ...
    (Firewall-Wizards)
  • RE: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?)
    ... were busy producing their new "Intrusion Prevention Systems" - both are ... integrated device - the firewall guys or the IDS/IPS guys? ... >> access lists? ... >> comparison between NIDS and NIPS was silly, ...
    (Focus-IDS)