RE: Current IDS problems

From: Vipul Kumra (vipul.kumra_at_airtightnetworks.net)
Date: 10/27/05

  • Next message: FinAckSyn: "Re: Proventia G400" 
    To: "'Nakul Aggarwal'" <nakula@gmail.com>, "'crazy frog crazy frog'" <i.m.crazy.frog@gmail.com>
Date: Thu, 27 Oct 2005 11:41:45 +0530

    They do but only partially. It also depends upon how good your
    vulnerability correlation algorithm is.

    Vipul Kumra

    -----Original Message-----
    From: Nakul Aggarwal [mailto:nakula@gmail.com]
    Sent: Monday, October 24, 2005 3:56 AM
    To: crazy frog crazy frog
    Cc: zero; focus-ids@securityfocus.com
    Subject: Re: Current IDS problems

    doesn't the existing correlation tools solve the problem of false alerts
    :-?

    regards

    On 10/21/05, crazy frog crazy frog <i.m.crazy.frog@gmail.com> wrote:
    > false positives.allthough we need to fine tune it to reduce this
    stuff.
    >
    > On 10/19/05, zero <zeroboy@arrakis.es> wrote:
    > > Hi all,
    > > I would like to know what are the problems people working with
    IDS sees in
    > > them. I mean, what are the things you hate about IDS, think
    simply you feel
    > > are plain wrong or that they should be another way to it.
    > >
    > > Al comments are greatly appreciated :)
    > >
    > > Thxs in advance.
    > >
    > >
    > >
    > >
    > >
    ------------------------------------------------------------------------
    > > Test Your IDS
    > >
    > > Is your IDS deployed correctly?
    > > Find out quickly and easily by testing it
    > > with real-world attacks from CORE IMPACT.
    > > Go to
    http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    > > to learn more.
    > >
    ------------------------------------------------------------------------
    > >
    > >
    >
    >
    > --
    > ting ding ting ding ting ding
    > ting ding ting ding ding
    > i m crazy frog :)
    >
    >
    ------------------------------------------------------------------------
    > Test Your IDS
    >
    > Is your IDS deployed correctly?
    > Find out quickly and easily by testing it
    > with real-world attacks from CORE IMPACT.
    > Go to
    http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    > to learn more.
    >
    ------------------------------------------------------------------------
    >
    > 

    --
regards
Nakul Aggarwal
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------
  • Next message: FinAckSyn: "Re: Proventia G400"

    Relevant Pages

    • Re: Current IDS problems
      ... I mean, what are the things you hate about IDS, think simply you feel ... -- ting ding ting ding ting ding ... Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. ...
      (Focus-IDS)
    • Re: Firewall / IDS for web db app site
      ... the first thing is to secure your webapplication then think about IDS ... and stuff.you can use various webapplication firewalls available to ... ting ding ting ding ting ding ... "oh yeah oh yeah... ...
      (Security-Basics)
    • Re: IDS Evaluation
      ... vulnerability scanning). ... We actually include a limited license copy of Core Impact with our ... Evaluation boxes that we ship so people can easily evaluate our IPS ... >> about the accuracy of the ids. ...
      (Focus-IDS)
    • Re: Value of IDS, ROI
      ... ROI in the operational risk arena. ... >>and possibly capable of showing a positive ROI, I wouldn't say that an IDS ... >>Your CIO should ultimately be concerned in preventing attacks, ... >>CORE IMPACT. ...
      (Focus-IDS)
    • Re: How to choose an IDS/FW MSS provider
      ... people's IDS technologies, their opaqueness drives a constant nagging ... If a "signature" is written properly then evading it will be ... ISS has had at least ... >> from CORE IMPACT. ...
      (Focus-IDS)