RE: ISS - virtual patching



I work for ISS.

A customer can use either model. ISS ships a spreadsheet with each
content update (its name is typically issue_responses.csv) that
describes the recommended blocking actions for each algorithm or
signature. The spreadhseet is installed on the appliance with each
update. The appliances are configured to use this spreadhseet to
configure blocking by default. Customers can then choose to disable
these default blocks or enable their own blocks on an algorithm by
algorithm basis.

Also, a customer can reconfigure the appliance to not use the ISS
recommendations at all. In that case, the appliance will only block on
those algorithms that the customer specifically configures.

Paul

-----Original Message-----
From: john@xxxxxxxxxx [mailto:john@xxxxxxxxxx]
Sent: Tuesday, July 18, 2006 7:49 AM
To: focus-ids@xxxxxxxxxxxxxxxxx
Subject: Re: ISS - virtual patching

I don't get it. How do signatures get their status (detection only or
also prevention)?
Do the vendors release the signatures with this marked in the signature
or does the SOC team need to read the signatures and decide one by one
how to deploy them for each device?

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------




------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------



Relevant Pages

  • RE: IDS vs. IPS deployment feedback
    ... claiming that ISS uses 1. ... asked for an example in which Snort used more signatures to provide ... agree that they handle exactly what the Snort rules are doing. ... You state that Snort uses 300 rules to cover one vulnerability while ...
    (Focus-IDS)
  • Re: How to choose an IDS/FW MSS provider
    ... "A potential hacker can read how the signatures work, ... before you ask ISS to release their codebase for their signature ... >Bu e-posta mesaji kisiye ozel olup, ... >CORE IMPACT. ...
    (Focus-IDS)
  • Re: How to choose an IDS/FW MSS provider
    ... "A potential hacker can read how the signatures work, ... before you ask ISS to release their codebase for their signature ... >Find out quickly and easily by testing it with real-world attacks from CORE ... >CORE IMPACT. ...
    (Focus-IDS)
  • RE: Vulnerability vs. Exploit signatures and IPS??
    ... My firm is a Tipping Point and ISS reseller. ... you can have signatures based on vulnerability. ... Vulnerabilities versus writing signatures based on Exploits? ...
    (Focus-IDS)
  • RE: How to choose an IDS/FW MSS provider
    ... but since ISS signatures are not purely "match this ... ISS MSS from our experience as an ISS reseller has been positive. ... >I guess you must be special to ISS, from my experience the support has been ... My impression about Cisco IDS for example is that they just do follow ...
    (Focus-IDS)