Re: Wishlist for IPS Products

From: Jason Haar (Jason.Haar_at_trimble.co.nz)
Date: 09/15/04

  • Next message: Johann_van_Duyn_at_bat.com: "Re: IPS, alternative solutions" 
    Date: Wed, 15 Sep 2004 20:52:57 +1200
To: focus-ids@securityfocus.com

    On Fri, Sep 10, 2004 at 10:18:27AM -0400, PS R wrote:
    > I am thinking of:
    > - Flow Control - limitations on flooding, unused connections, etc...
    > - Robust, ACURATE signature base
    > - Packet capture - no debate on how much before, as that has been covered
    > - Pre-deployment network analysis tools to accelerate deployment
    > - Anomaly detection
    > - Alert export compatibility with 3rd party event management solutions

    One thing I think is important is that these vendors realise that just
    *MAYBE* their customers already have existing infrastructure for doing
    things like alerting, and that they should support that instead of creating
    yet another damn stand-alone application.

    We need to see more integration in this industry - hell - IT in general.

    By alerting, I mean support SNMP traps (gah!), eventlog (for Windows), and
    better yet - syslog. There are still too many "security products" out there
    that think logging to their own text file or proprietary database is the
    best way of doing things. I'm not saying any of that needs to be thrown out,
    but they should try to ADDITIONALLY support mechanisms their customers have
    probably got covered. 

    -- 
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------
  • Next message: Johann_van_Duyn_at_bat.com: "Re: IPS, alternative solutions"

    Relevant Pages

    • Re: Special upgrade treatment
      ... If technical support is recommending against any other ... | updates in that series or in any wider selected range of update ... customers, and the quality of LW releases is of public interest. ... and your bug backlog dry up. ...
      (comp.graphics.apps.lightwave)
    • Re: Special upgrade treatment
      ... If you search through this newsgroup, or google "LW 7.5 D morph mixer problems - HELP", you will find a request to confirm a bug in 7.5d, and your support department's "workaround", to wit, "... ... If technical support is recommending against any other | updates in that series or in any wider selected range of update | versions, then by all means I'd like to know about it, and I'd like to | know why. ... customers, and the quality of LW releases is of public interest. ...
      (comp.graphics.apps.lightwave)
    • Re: Special upgrade treatment
      ... > confirm a bug in 7.5d, and your support department's "workaround", to wit, ... If technical support is recommending against any other ... > | updates in that series or in any wider selected range of update ... > customers, and the quality of LW releases is of public interest. ...
      (comp.graphics.apps.lightwave)
    • Re: Extreme!!! Special timelimited competive upgrade offer
      ... I was asked a direct question about why I think a RO user should look at kbmMW, ... Im never going to tell you how you are to run your business, Im sure you know that much better than me. ... have to do all the coding themselfs to support something. ... > customers expect and pay for on top of the technology. ...
      (borland.public.delphi.thirdpartytools.general)
    • Re: Extreme!!! Special timelimited competive upgrade offer
      ... > Some examples often required in enterprise setups where competition is ... FAQs and support is much more important to us, ... customers expect and pay for on top of the technology. ... UDP and TCP/IP messaging doesn't work well over secure WANs or Internet ...
      (borland.public.delphi.thirdpartytools.general)