RE: IPS vs Firewall

From: Steven Trewick (STrewick_at_joplings.co.uk)
Date: 04/29/04

  • Next message: maxwi8_at_gmx.at: "Re: Windows SUS" 
    To: 'Juan Velasquez' <Juan@EvolutionH.com>, security-basics@securityfocus.com
Date: Thu, 29 Apr 2004 11:26:23 +0100

    IPS = Intrusion Prevention System, and for someone who didn't know
    what it stands for, your general description is remarkably apt :-)

    Here's a good starting point to learn more :
    http://www.securityfocus.com/infocus/1670

    HTH

    > -----Original Message-----
    > From: Juan Velasquez [mailto:Juan@EvolutionH.com]
    > Sent: 28 April 2004 07:44
    > To: security-basics@securityfocus.com
    > Cc: 'Benny Late'
    > Subject: RE: IPS vs Firewall
    >
    >
    > I'm sorry, but can you remind me as to what IPS stands for?
    > I found IDS in the dictionary of "Virtual Entity of Relevant Acronyms"
    > meaning "Intrusion Detection System."
    >
    > However, IPS only brings up "InPlane Switching [technology]
    > (LCD)," and
    > "Information Processing Standards."
    > I can't imagine that I have the correct meaning here.
    > Searches in google also were not very helpful either.
    >
    > You seem to use the term IPS as if it's not completely
    > equivalent to an
    > IDS or a firewall and that it may be used as an alternative to either.
    >
    > Anyway, in regards to your question: "how would you go about showing
    > that firewalls or BigIP routers can be attacked directly?"
    >
    > Searching in google for "cisco firewall exploits" brings up a few
    > interesting links.
    >
    >
    >
    >
    > -----Original Message-----
    > From: Benny Late [mailto:lvmygop@hotmail.com]
    > Sent: Tuesday, April 27, 2004 10:16 AM
    > To: security-basics@securityfocus.com
    > Subject: IPS vs Firewall
    >
    > List,
    >
    > I am to give a presentation concerning IPS vs. IDS and why we have
    > decided
    > to implement an IPS solution. I have stuff about each of
    > those, but my
    > big
    > problem is going to come from my LAN/WAN group. Because I've
    > decided to
    >
    > place the IPS outside the firewall, they have already moaned about it
    > and I
    > know they're going to bring up why we need IPS vs. Firewall. I have
    > stuff
    > about what firewalls don't look for or do compared to IPS.
    >
    > My question is, how would you go about showing that firewalls
    > or BigIP
    > routers can be attacked directly? For those of you
    > concidering IPS, can
    > you
    > impart any of the knowledge gained by implementing your solutions?
    >
    > Many thanks,
    > Benny
    >
    > _________________________________________________________________
    > >From must-see cities to the best beaches, plan a getaway with the
    > Spring
    > Travel Guide! http://special.msn.com/local/springtravel.armx
    >
    >
    > --------------------------------------------------------------
    > ----------
    > ---
    > Ethical Hacking at the InfoSec Institute. Mention this ad and get $545
    > off
    > any course! All of our class sizes are guaranteed to be 10 students or
    > less
    > to facilitate one-on-one interaction with one of our expert
    > instructors.
    >
    > Attend a course taught by an expert instructor with years of
    > in-the-field
    > pen testing experience in our state of the art hacking lab. Master the
    > skills
    > of an Ethical Hacker to better assess the security of your
    > organization.
    >
    > Visit us at:
    > http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    > --------------------------------------------------------------
    > ----------
    > ----
    >
    >
    > --------------------------------------------------------------
    > -------------
    > Ethical Hacking at the InfoSec Institute. Mention this ad and
    > get $545 off
    > any course! All of our class sizes are guaranteed to be 10
    > students or less
    > to facilitate one-on-one interaction with one of our expert
    > instructors.
    > Attend a course taught by an expert instructor with years of
    > in-the-field
    > pen testing experience in our state of the art hacking lab.
    > Master the skills
    > of an Ethical Hacker to better assess the security of your
    > organization.
    > Visit us at:
    > http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    > --------------------------------------------------------------
    > --------------
    >
    > ---
    > Incoming mail checked for known viruses
    > Checked by AVG anti-virus system (http://www.grisoft.com).
    > Version: 6.0.672 / Virus Database: 434 - Release Date: 28/04/04
    >
    >

    </code>
    The information contained in this e-mail is confidential and may be privileged, it is intended for the addressee only. If you have received this e-mail in error please delete it from your system. The statements and opinions expressed in this message are those of the author and do not necessarily reflect those of the company. Whilst Joplings Group operates an e-mail anti-virus program it does not accept responsibility for any damage whatsoever that is caused by viruses being passed.
    joplings.co.uk

    ---------------------------------------------------------------------------
    Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
    any course! All of our class sizes are guaranteed to be 10 students or less
    to facilitate one-on-one interaction with one of our expert instructors.
    Attend a course taught by an expert instructor with years of in-the-field
    pen testing experience in our state of the art hacking lab. Master the skills
    of an Ethical Hacker to better assess the security of your organization.
    Visit us at:
    http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    ----------------------------------------------------------------------------

  • Next message: maxwi8_at_gmx.at: "Re: Windows SUS"

    Relevant Pages

    • Re: Analysing and configuring IPS/IDS Policies
      ... If you have no faith in the firewall or you are concerned about more ... Remove the IPS from the network. ... policies and logs on those devices. ...
      (Focus-IDS)
    • RE: IPS (was: [fw-wiz] Sources for Extranet Designs?)
      ... IPS has been pretty much been expected to weed out the known bad traffics on ... looks for these type of behaviour in a sequence of packets, ... firewall don't make these kind of mistakes. ... decently good ones will go through the trouble of reassembling the packets ...
      (Firewall-Wizards)
    • RE: IPS (was: [fw-wiz] Sources for Extranet Designs?)
      ... it merely does string-matchings on the packets alone. ... Network IPS: ... A software shim (firewall) that sits between the kernel and the application. ... deployed deep inside a network. ...
      (Firewall-Wizards)
    • RE: IPS vs Firewall
      ... Might I suggest using the witty worm as an example? ... > to implement an IPS solution. ... > place the IPS outside the firewall, ... of an Ethical Hacker to better assess the security of your organization. ...
      (Security-Basics)
    • RE: IPS vs Firewall
      ... Subject: IPS vs Firewall ... to facilitate one-on-one interaction with one of our expert instructors. ... Attend a course taught by an expert instructor with years of in-the-field ...
      (Security-Basics)