RE: IDS event filtering

dcdave_at_att.net
Date: 01/02/05

  • Next message: Reto Baumann: "Re: IDS event filtering" 
    To: "Harper, Patrick" <Patrick.Harper@phns.com>, <CraftedPacket@securitynerds.org>, <focus-ids@lists.securityfocus.com>
Date: Sun, 02 Jan 2005 17:09:33 +0000

    I typically want a sensor outside the firewalls and DMZs to register all attacks 'beating against the door' (within traffic limitations). Firewalls block most of the problems, and I may have a sensor somewhere inside to determine if any attack got through or around the firewall, but most non-vulnerabilities are tweaked out by threshold or by legitimate address list on the inside.
    It is important to avoid tuning out real attacks when they happen by having over-pruned the inside attack tree...

    dcdave
    Dave Druitt 

    --
CSO
InfoSec Group
703-626-6516		
	
 -------------- Original message ----------------------
From: "Harper, Patrick" <Patrick.Harper@phns.com>
>  
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Thresholding is a wonderful thing.  And no, I personally do not want
> to see alerts on tings I do not have.  If I am an all apache shop
> then I do not turn on any IIS rules.  I also make sure, via scanning
> and vulnerability analysis, that I do not in fact have any IIS (or
> whatever) installed.  You first need to have a good inventory of what
> you have.  And you need to keep that up to date so you always know
> what you have.  Then you trim all rules to that.  Weather it be
> ingress - egress firewall rules, IDS configs, or whatever.  Figure
> out what you have, learn how it flows (and make it work/flow the
> secure way) then monitor it. 
> 
>  
> - -----Original Message-----
> From: Billy Dodson [mailto:CraftedPacket@securitynerds.org] 
> Sent: Friday, December 31, 2004 9:37 AM
> To: focus-ids@lists.securityfocus.com
> Subject: IDS event filtering
> 
> I am wanting to get an idea of what you guys out there filter from
> your
> IDS sensors.  Some of the sensors I monitor get TONS of events for
> MSSQL
> control overflows.  If the customer is patched for slammer and does
> not
> have any SQL services on the internet, is it safe to filter out those
> events?  Do you still want to see that traffic even though you know
> your
> are not vulnerable?  Thanks!
> 
> - ----------------------------------------------------------------------
> - ----
> Test Your IDS
> 
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks
> from 
> CORE IMPACT.
> Go to
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> - ----------------------------------------------------------------------
> - ----
> 
> 
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.1
> 
> iQA/AwUBQdXFLpiWafDb7+B/EQLkZwCgxqFePWcqpCbc4/gTEuaUJYBY6iYAoOKi
> xe1e6rLpQeTIU7O+zuW96Fj1
> =SkUh
> -----END PGP SIGNATURE-----
> 
> 
> 
> 
> Disclaimer:
> This electronic message, including any attachments, is confidential and intended 
> solely for use of the intended recipient(s). This message may contain 
> information that is privileged or otherwise protected from disclosure by 
> applicable law. Any unauthorized disclosure, dissemination, use or reproduction 
> is strictly prohibited. If you have received this message in error, please 
> delete it and notify the sender immediately. 
> 
> 
> 
> 
> --------------------------------------------------------------------------
> Test Your IDS
> 
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from 
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> --------------------------------------------------------------------------
> 
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------
  • Next message: Reto Baumann: "Re: IDS event filtering"

    Relevant Pages

    • RE: Intrusion Prevention
      ... Coverage what can it detect; this covers basic attacks, ... IDS purchase. ... While doing these implementations and while working in an IDS vendor I ... sometimes we're told that we cannot see the testing methodology upfront. ...
      (Focus-IDS)
    • RE: Changes in IDS Companies?
      ... This means you need a standard IDS sitting behind it/next to it watching the ... Things like port scans and DoS attacks ... >>> If people are running insecure web servers, ... > Pretty sad state of affairs, when people don't update their patches at ...
      (Focus-IDS)
    • RE: Best Method(s) for signature verification.
      ... on this list - and other IDS lists - for the means to test their IDS ... When I say we use IDS Informer for our signature recognition testing, ... should point out that we do NOT use all the default attacks! ... (IIS attacks run against Apache web servers on Unix - "real ...
      (Focus-IDS)
    • Re: How to choose an IDS/FW MSS provider
      ... First, "recording everything" is not what IDS's were EVER meant for, ... others can create "audit" trails of every web request, every mail, every ... >detect attacks by inspecting layer 3 headers for prohibited IP ... >facility with an IDS or IPS deployed. ...
      (Focus-IDS)
    • Re: Alarming (was protocol analysis)
      ... Obviously, there are different ways to "detect" attacks, but John uses the ... no one should ever "rely" on any IDS for our ... As for Johns Metaphor of the motion sensor vs the pressure sensor, ... toward Intrusion Prevention as opposed to just Intrusion Detection. ...
      (Focus-IDS)