Re: Testing IDS/IPS Solutions

On 1/7/06, Andres Riancho <andres.riancho@xxxxxxxxx> wrote:
> You could use tcpsic for testing how well the appliance handles
> fragmented packets, you could use nikto and nessus to see how many
> attacks each one detects a

Why would you use a vulnerability scanner to see how an UTM detects an
attack? Vuln scanners nowadays go to great lengths NOT to actually
exploit a vulnerability because people get pissed when their servers
crash.

If you want to see how well an UTM detects someone running nessus
against your network, then by all means use nessus. But if you want
to see how well it detects an actual attack, then you had better use
traffic which actually looks like an actual exploit.

With that said, the original poster should go look in the list
archives and google. Someone asks how to test an
IDS/IPS/Firewall/UTM/etc on this list every virtually every week and
it's pretty boring reading the same answers/vendors reminding us that
nothing significant has changed in the last year or so.


--
Aaron Turner
http://synfin.net/

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------

Relevant Pages

  • Re: Vuln Scanner
    ... > A) Is as effective as nessus. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • RE: Nessus - open or closed source?
    ... Does Nessus hit on something that ISS missed, yes sometimes, ... > Hackers are concentrating their efforts on attacking applications on ... Up to 75% of cyber attacks are launched on shopping ... Check your website ...
    (Pen-Test)
  • RE: Vuln Scanner
    ... Does anyone here know of an inexpensive vulnerability scanner, ... Is as effective as nessus. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
    (Pen-Test)
  • Re: Nessus - open or closed source?
    ... While I cannot state who I work for due to security reasons, ... whether it be nessus or others. ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
    (Pen-Test)
  • RE: Vuln Scanner
    ... > one other vulnerability scanner to compare the output. ... > A) Is as effective as nessus. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)