Slashdot Mirror
Network-Based Solution for Phishing Attacks?
An anonymous reader is curious about this: "A company called TippingPoint (3com) sells an Intrusion Prevention System (IPS) that promise 'to block phishing attempts and guard against identity theft'. What I found interesting is the wide spectrum of actions they take to acheive a single goal: 'The IPS uses a variety of mechanisms to detect and prevent phishing scams including vulnerability protection, pattern-matching protection, and behavior-based protection.' What do you think about the effectivness of IPS?"
It's not every day that you can get on "Ask Slashdot" by quoting brochure copy. If multiple vendors were mentioned I'd take this seriously, but this sounds a lot like a marketing shill to me.
A few months ago I took part in a test of several IPS units from major manufacturers. We had the manufacturer set them up with the "toughest" settings to make our network as secure as possible. We ran several different hacks, malicious code, exploits, etc through the IPS. The IPSs blocked hardly any attacks through. Even exploits that were a decade old that the unit was supposedly blocking were allowed through. From what we could determine, they were pretty much glorified anti-virus boxes. They relied far too much on signature files instead of heuristics. IPSs have a long way to maturity IMHO.