RE: Newbie question: autoblocking with IDS/IPS

From: Gary Halleen (ghalleen) (ghalleen_at_cisco.com)
Date: 12/17/04

  • Next message: Dimitrios Patsos: "Local Mirror Prevention with IDS" 
    To: "'Mike Johnson'" <mike@enoch.org>, <focus-ids@securityfocus.com>
Date: Thu, 16 Dec 2004 20:40:41 -0800

    Inline...

    Gary

    -----Original Message-----
    From: Mike Johnson [mailto:mike@enoch.org]
    Sent: Monday, December 13, 2004 2:00 PM
    To: focus-ids@securityfocus.com
    Subject: Re: Newbie question: autoblocking with IDS/IPS

    Daniel wrote:

    > I'm thinking of buying one of that new CISCO IDS boxes which can be
    > placed inline in the future.

    MJ> Do you mean the 4240? If so, we just received a couple of them and
    intend to put them through their paces in our lab.

    The following Cisco sensors can be run in inline mode with IPS 5.0 software:

            - 4215
            - 4235
            - 4240
            - 4250
            - 4255
            - 4250-XL
            - IDSM-2

    The 4240 and 4255 are the newest sensors, and have just recently started
    shipping. The main difference between these and the other models is they do
    not have hard drives or CDROM drives. Instead, they utilize flash cards and
    can be upgraded or reimaged from the network rather than the CD.

    > Is anybody of you using the automatic shunning (I guess it's called
    > so) feature of the CISCO IDS? Does this make sense? (Which signatures
    > should be autoblocked?)

    MJ> We were told that the version of the software that handles blocking is
    not yet shipping. If anyone knows any different, do tell. We haven't quite
    figured out our policy on what gets blocked and what doesn't, but we'll take
    it on a signature by signature basis.

    The IPS 5.0 release will be shipping in the next couple months, and allows
    inline operation. Shunning is an older feature that many customers used in
    earlier releases. It will continue to be supported if you wish, but several
    drop actions will likely be more popular.

    > Or are you just monitoring and then blocking manually?

    MJ> We're not 100% convinced we'll put them in blocking mode at this point.
      Ideally, it would be automagic, but false positives lead to blocking
    legitimate traffic by accident.

    Traffic normalization and antivirus signatures might change your mind on
    this. Even when installed in inline mode, though, you can select which
    signatures take automatic blocking actions of any type.

    Gary

    --------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from
    CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    --------------------------------------------------------------------------

  • Next message: Dimitrios Patsos: "Local Mirror Prevention with IDS"

    Relevant Pages