Re: Replacing antivirus soft with a real IDS/IPS

I don't think it's a good idea to knock out AV. A blended tool of AV
and HIPS / firewall would be great. Even most HIPS vendors will say
that they don't recommend getting rid of your current AV solution.

AV is not going to stop a targetted attack. If I put a trojan or some
other back door on your machine that doesn't match an AV signature...
and there are lots of them... I am free to do what I want, unchecked
pretty much. AV is very reactive and it counts on the fact that your
network is only affected by viruses / worms / trojans that already
exist in its database that is assumed to be updated; any of these even
slightly altered will bypass an AV signature and will be able to
infect your client PC. If its a 0-day attack, you're not well
protected and AV heuristics is poor at best. A combination of AV and
HIPS is the way to go. Make sure the HIPS is somewhat intelligent and
is capable of protocol / application anomaly detection and has a built
in firewall. ISS Desktop Protector does this, but I haven't had a
chance to put it through the paces yet. I will be soon, maybe over the
holidays when I have time.

Maybe see if your current AV provider has a HIPS product for desktop.
It would integrate better for sure, and would probably keep your
systems more stable as you won't have two separate software packages
contending to secure the desktop.

-J

On 12/6/05, carlopmart <carlopmart@xxxxxxxxx> wrote:
> Hi all,
>
> I am going to setup a testing lab with several windows XP virtual
> machines. My pourpose is to do some tests with HIDS/IPS software for
> windows and not to use antivirus software. Can you recommends me some
> HIDS software for windows ( free software if it is possible)?.
>
> And another question, will windows survive to several attacks
> (virus, trojans, etc) without using antivirus software ??? Have anyone
> tryied this??
>
> Thank you very much and sorry for my bad english.
>
> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------
>
>

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------

Relevant Pages

  • RE: eEye Blink and other Endpoint IPS solutions.
    ... > Is there anyone out there using Host Based Intrusion Detection ... > on system performance and how their effectiveness compares to NIPS. ... while HIPS are great at stack-based detection (please forgive ... about DDoS attacks, you need NIPS. ...
    (Focus-IDS)
  • RE: Real world experience with HIDS
    ... I work for a HIPS company, but I am also an information security ... most HIPS (agents and management consoles) are quick software ... Yes, as discussed, User-level access control. ... specific attacks, zero-day attacks. ...
    (Focus-IDS)
  • RE: 7-ZIP ARJ Archive Processing stack overflow - Is there any role for Network IPS?
    ... the vulnerability is in a fixed stack-based buffer of ~2.5k allocated for one of the values extracted from the ARJ file header. ... a HIPS should be able to stop the attack with a canary/integrity check. ... There are fewer options with NIPS, but there are things that can be done to provide protection. ... If so, is it fair to assume that only security solutions running, on the client machine, catch>these kjinds of attacks. ...
    (Focus-IDS)
  • Re: Please help me...
    ... your advice and I am in the process of doing what you ... >> the appropriate software that blocks these attacks. ... a "Windows" operating ... firewall can be found ...
    (microsoft.public.security)
  • ZA Logs as requested
    ... I keep Windows updated. ... > firewall to prevent this from happening again: ... attach so he could monitor attacks and my ports. ... > 6) Create a rule to drop any and all IGMP protocol packets. ...
    (comp.security.firewalls)