Re: IPS, alternative solutions

From: Devdas Bhagat (devdas_at_dvb.homelinux.org)
Date: 09/26/04

  • Next message: Ben Nelson: "Re: free hIDS, or system assessment tools" 
    Date: Sun, 26 Sep 2004 06:04:36 +0530
To: focus-ids@securityfocus.com

    On 22/09/04 12:22 -0400, Mike Frantzen wrote:
    >
    > > The way I see it, an IPS can attempt to contain your infestation and
    > > help reduce your legal exposure from outbound attacks that would
    > > otherwise make it to your partners... This is a value I can quantify and
    > > the best use case I have seen for IPS. The problem I have with it is
    > > that a properly implemented firewall can most likely do the same and
    > > provide much better overall value.
    >
    > One of the spots where an IPS beats a firewall hands down is on the
    > interior of a large organization. I've seen too many large
    > disfunctional companies that compartmentalize their departments by
    > placing firewalls between each and every one. Marketing and sales can't

    Which is broken behaviour in the name of security. People who need
    access to certain data for normal work related purposes must be given
    such access. Those who don't need access should not be given such
    access.
    I believe that this type of issue is largely caused by people equating
    firewalls with simple packet filters.

    > access engineering project schedules and feature lists on the
    > engineering web server. Engineering can't access the support database
    > to look for common issues and trends. No one can access their
    > department's machines from their laptop when in a conference room...
    > etc etc

    Actually, that is broken firewall design and/or implementation. If the
    requirements of the various customers are not met, then the firewall
    is just an impediment to work, or it lets too much traffic through.

    In such cases, the company should be using proxies with proper
    authentication and logging to regulate traffic flow (IMHO firewalls
    should be a combination of packet filters and proxies anyway).

    >
    > We end up with an authoritarian system where the firewalls inhibit the
    > communication inside the company. An IPS can maintain the security
    > compartmentalization and containment without impeding the free flow of
    > information between departments.

    No. an IPS is just an attempt at a proxy looking for bad things. In my
    book, this is equivalent to filtering untrusted user input for bad stuff
    instead of limiting it to known good stuff and removing the rest.

    This should not be acceptable behaviour for security enforcement
    management and/or personnel.

    Devdas Bhagat

    --------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
    --------------------------------------------------------------------------

  • Next message: Ben Nelson: "Re: free hIDS, or system assessment tools"

    Relevant Pages

    • RE: RE: IDS vs. IPS deployment feedback
      ... A well tuned IPS controls more than just exploits. ... It's the Risk Reduction Bang for the Buck chart. ... Also - you cannot patch your way to security. ... doesn't pass your firewall. ...
      (Focus-IDS)
    • Re: Analysing and configuring IPS/IDS Policies
      ... If you have no faith in the firewall or you are concerned about more ... Remove the IPS from the network. ... policies and logs on those devices. ...
      (Focus-IDS)
    • RE: IPS (was: [fw-wiz] Sources for Extranet Designs?)
      ... IPS has been pretty much been expected to weed out the known bad traffics on ... looks for these type of behaviour in a sequence of packets, ... firewall don't make these kind of mistakes. ... decently good ones will go through the trouble of reassembling the packets ...
      (Firewall-Wizards)
    • RE: Recent Gartner IDS/IPS report
      ... despite what Gartner states) there is no single solution for IDS or IPS (or a ... We use a suite of tools that includes both and a firewall. ... system and it continued to stay compromised because the firewall or an IPS did ... Point being...everyone knows how to have good physical security, ...
      (Focus-IDS)
    • RE: Experiences with Toplayer Attack Mitigator IPS
      ... Experiences with Toplayer Attack Mitigator IPS ... network intrusion uk guys who are coming out with the IPS shootout ... as security vendors are so fond of touting nowadays? ... > - Make firewall, VPN, and NAT rules interoperable across heterogeneous ...
      (Focus-IDS)