Slashdot Mirror
Network Intrusion Detection Systems Fail to Impress
TheBongPipe writes "I'm reading a nice test here about 7 commercial IDSs. Who won the prize? Nobody..." They also looked at Snort, but found that all the products generated way too many false alarms.
It really gets my blood boiling when journalists review security technology poorly. IDS is a powerful TOOL to help you secure your networks. It detects and helps you respond to security incidents (with TCP resets and "shunning" of attackers when integrated witha firewall). IT HAS TO BE TUNED! You can't go down to your corner computer store and ask, how much will security cost me? There's no magic box you can buy! This is what Journos expect, a magic box. Journalists when they do a wide comparision of security products usually do a few things: Install software on standard hardware (click next a lot). Look at the pretty GUI. Click on all the buttons they don't understand. Measure throughput/uptime as it is easy to do in between sneaking off to the bar. Do some half-baked "real world" test. It is really highlighted in this article, how they did not understand what role IDS plays in an organization. IDS is your eyes and ears in a corporate security setting. It lets you know what's going on...who's runing peer to peer file sharing, who's scanning networks for vulnerabilities. They installed it in an ISP for A security professional is tuning their IDS EVERY day, modifying the policies on the IDS to reflect the constantly changing environment that it is installed. Watching the console at every spare minute! When we review security technology for use with our clients some of our criteria are: 1. Ease of deployment (product availability, channel relationships, ease of install) 2. Ease of management (most security incidents are due to misconfiguration) 3. Availability 4. Performance 5. Market Share of company 6. Level of technical support provided by vendor. Again and again it annoys me how journos write off good products!