Re: Is IDS/IPS worthless?

[Mike Hoskins <mike () adept org>]

On Sat, 21 Feb 2004, Andy Cuff wrote:
> I consider them essential in today's networks but I like the concept of
> defense in depth to run very deep, however, if an IDS or IPS isn't
> maintained correctly they can create more problems than they solve, as they
> may lull the staff into a false sense of security.

while i agree, i do not see the "may lull into false sense of security"
argument as that convincing.  by that, i mean that anyone who has been in
the security industry for some time will remember when the same arguments
were made for firewalls.  while most business have firewalls and believe
they provide benefit today, there was a time when some argued it would
provide a false sense of security and encourage administartors/users to
neglect host security.  while that can be true, it is not always true, and
i think making arguments based strictly upon the worst case makes some
underlying assumptions about your technical/security staff.  if you hired
such underachieving staff as a manager, that is probably more of a
business concern than the lack or pressence of IDS/IPS.

-m

---------------------------------------------------------------------------
Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection

Protect your network with the comprehensive security solution that integrates 
six applications for ease of use and lower TCO.

Firewall - Virus protection - Spam protection - URL blocking - VPN
- Wireless security.

Download 30-day evaluation at:
http://www.securityfocus.com/sponsor/Astaro_focus-ids_040219
---------------------------------------------------------------------------