Vulnerability & Exploit Signatures

From: Jackson Yu (jackson.yu_at_earthlink.net)
Date: 06/14/05

  • Next message: Raffael Marty: "Re: on NIDS/NIPS tuning" 
    Date: Tue, 14 Jun 2005 14:15:44 -0700 (GMT-07:00)
To: focus-ids@securityfocus.com

    Hi, I'm new to this list, so please bear with my question:

    ASIC/FPGA/Software/detection techniques aside, I sense that a huge value of IPS
    vendors are the lab-type organizations that are constantly developing new filters
    in response to new vulnerabilities and exploits. However, there's no way that such
    vendors can "hit the market" if you will with 2000+ filters out on day
    one.

    Do all these vendors license the same set of "base" filters from, say,
    Sourcefire / Snort derived rule source in the back? Is there a commonality there? At the end of the day, can I say that "Gee, most vendors' base set of 1500 IPS signatures are the same, its just the 300 or so that the vendors have additionally developed on top of that 1500 that are different!"

    Thanks

    Jackson

    --------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from
    CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    --------------------------------------------------------------------------

  • Next message: Raffael Marty: "Re: on NIDS/NIPS tuning"

    Relevant Pages

    • Re: Please enable firewalls by default on Linux distributions
      ... In fact a firewall can in some cases help ... O/S vendors must have ... kills the throughput of the router. ... and that means everyone of them needs custom filters. ...
      (comp.os.linux.security)
    • RE: Recent Gartner IDS/IPS report
      ... > resources to properly analyze security reports, ... > replace the IDS products. ... since these same vendors compete with your ... Basing IPS entirely on IDS and making the offspring a single product is ...
      (Focus-IDS)
    • IPS test criteria (was IDSIPS that can handle one Gig)
      ... Chris - what makes ICSA particularly relevant when it comes to defining IPS ... Speak to the vendors who were at their recent forum meeting ... a wide range of traffic loads and packet sizes. ... wide range of test criteria). ...
      (Focus-IDS)
    • RE: NIPS Vendors explicit answer
      ... this is the only comprehensive independent IPS test that's been ... Make sure the product continues to block attacks when simple, ... Test the IPS like you would any other network element (switch, ... The other vendors waiting for my tests:) are Netscreen IDP,RealSecure ISS Proventia G200 and Network Associates NAI Intruvert 2600 series. ...
      (Focus-IDS)
    • Re: IPS Reliability/Availability
      ... switched focus from supplying firewall vendors to supplying in-line IPS ... Subject: IPS Reliability/Availability ... appliance simply by adding processor boards. ... Does anybody have a list of which vendors are using ASICs ...
      (Focus-IDS)