In we act according to the user selection and broadcast to issue the topic which are “use IDS and the IPS secret effectively” in the network direct seeding, honored guest speaker Jeff Posluns provided has used IDS/IPS to implement the skill which the positive security crack managed, and thoroughly inspected an enterprise's secure state. Some questions which in the scene direct seeding below is Jeff answers the user who proposed.
Questioning: Is should receive the IDS warning merely by information system security group's members, many members as well as corporate management level's member should receive this kind of warning?
Answer: Your this question's answer should be based on the following fact decision-making:
1. comes from IDS many warnings is the wrong report.
2. comes from IDS many warnings to have nothing to do with the urgent question.
3. comes from IDS many warnings not to need to take the action immediately.
4. comes from IDS the minority warning to need to carry on the investigation.
5. the very few warnings need to take the action immediately.
This is I to this question idea. If has a person to accept visiting or have one to accept visiting the plan, only then this person is the human who should inform. If you already spent many time, to adjust your alarm system diligently with the money, you will not obtain many warnings and need to track these warnings. Perhaps a ticket clerk system is most appropriate. In this case, the IDS system founds a ticket, security group's members is responsible to receive the messenger call and the warning. If this ticket has not renewed within four hours, that uses the beeper to call a manager. I once saw has worked like this ticket clerk system.
Questioning: Because IPSes possible to prevent the normal correspondence, IPSes has filled the danger?
Answer: IPSes the question which causes in the history the solution question are more. But, uses today's technology, blocks the normal correspondence the situation very little to occur wrongly. Must remember, you cannot purchase and install IPS, then washes one's hands of lets it handle all matters. IPS or IDS need to look like the child to give the care equally; Let it study, but, you must correct its mistake as far as possible, passes to it yours wisdom.
I already saw probably 200 have moved the IPS case, I can recall extract the present question to have 3. These questions are between the http server not the normal correspondence create, IPS these correspondence examination for bad correspondence. Once after rule repair, did not have the question which was worth worrying.
Questioning: I use one kind of named Snort the invasion examination system, in mine impression not massive false alarms. I really has not trusted the OTS technology such to trust this system likely. What thing did I omit?
Answer: The default Snort rule does not need to adjust in the majority networks. You very possibly see to many wrong ICMP (the Internet control news agreement) the warning, and possibly sees certain wrong DNS and the HTTP warning. If you install “Bleeding Edge” the rule, you will see more things.
Other pages: : 1 * 2 * Next>>
|
You are here: hacking technology
> invades the examination
> Content
Category: Home
> invades the examination