Re: host-based ids evaluation

From: Kurt Seifried (bugtraq@seifried.org)
Date: 08/15/02

Previous message: Muhammad Faisal Rauf Danka: "RE: IPSec and IDS"
In reply to: roy lo: "Re: host-based ids evaluation"
Next in thread: Talisker: "Re: host-based ids evaluation"
Reply: Talisker: "Re: host-based ids evaluation"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: "Kurt Seifried" <bugtraq@seifried.org>
To: "roy lo" <roylo@sr2c.com>, "Talisker" <talisker@networkintrusion.co.uk>
Date: Thu, 15 Aug 2002 15:13:58 -0600

Ok... So solutions such as SecureWave SecureEXE which are host based, and
block execution of non approved code in real time (generate a database of
md5/sha1 sigs for known good apps, install client, done) is reactive?

People, definitions like this pro/reactive are SILLY. Really really silly.
There are so many products out now taking all sorts of interesting
approaches and implementaitons it's really stupid to be making such broad
overgeneralizations.

Let the argument and bad analogies begin!

Kurt Seifried, kurt@seifried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/

Previous message: Muhammad Faisal Rauf Danka: "RE: IPSec and IDS"
In reply to: roy lo: "Re: host-based ids evaluation"
Next in thread: Talisker: "Re: host-based ids evaluation"
Reply: Talisker: "Re: host-based ids evaluation"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]