Re: Wishlist for IPS Products

From: David Maynor (dmaynor_at_gmail.com)
Date: 09/12/04

  • Next message: Srinivasa Rao Addepalli: "Re: Wishlist for IPS Products" 
    Date: Sun, 12 Sep 2004 00:29:51 -0400
To: PS R <secureyourself@gmail.com>

    Yeah....I am gonna go ahead and disagree with you on some of these.

    > I have seen a lot of discussion about the differences between IDS,
    > IPS, and firewalls and the potential for convergence, but I do not
    > recall a discussion on the primary features that an IPS should have
    > out of the box.
    >
    > I am thinking of:
    > - Flow Control - limitations on flooding, unused connections, etc...

    Most of this should be handled by the signature base.

    > - Robust, ACURATE signature base

    Only way to do this and not create tons of false postives is true
    protocol parsing. This knocks out most IPS vendors like Tipping Point.

    > - Packet capture - no debate on how much before, as that has been covered
    > - Pre-deployment network analysis tools to accelerate deployment
    > - Anomaly detection

    Why? I have yet to see a system that is more than a parlor trick.
    Anomaly based system are even easier to evade than sig based systems
    that don't do protocol parsing.

    What I would add is better tools for testing. Almost nobody grabs a
    copy of Canvas from Immunity or Impact from Core and actually checks
    what attacks are caught. Further more an even fewer number use modded
    copies of public exploits to see if the claims made by vendors are
    actually true. How many vendor's IPS implementation would actual catch
    a MS03-026 exploit if you frag at the RPC layer at a size like 8
    bytes?

    --------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
    --------------------------------------------------------------------------

  • Next message: Srinivasa Rao Addepalli: "Re: Wishlist for IPS Products"

    Relevant Pages

    • RE: Current IDS problems
      ... We're actually working an IPS here. ... >>with real-world attacks from CORE IMPACT. ... >ting ding ting ding ting ding ...
      (Focus-IDS)
    • Re: Wishlist for IPS Products
      ... And what about blocking fragmented packets entirely. ... This knocks out most IPS vendors like Tipping Point. ... Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. ...
      (Focus-IDS)
    • RE: IPS technology question.
      ... Subject: IPS technology question. ... >with real-world attacks from CORE IMPACT. ...
      (Focus-IDS)
    • Re: IDS Comparison
      ... We have started round 4 testing of IPS products using a much ... than waiting to collect them for a group test format) ... with real-world attacks from CORE IMPACT. ...
      (Focus-IDS)
    • Re: IPS Reliability/Availability
      ... We are testing MULTI-Gigabit IPS products right now, ... Does anybody have a list of which vendors are using ASICs ... Find out quickly and easily by testing it with real-world attacks from ... with real-world attacks from CORE IMPACT. ...
      (Focus-IDS)