RE: Changes in IDS Companies?

Actually, I'll have to respectfully disagree. There are many systems that run in various environments where for one reason or another you simply can't patch them immediately (or in some bad cases, any time soon), in those cases, you absolutely want to implement protective measures (firewalling, changes in configuration (if possible), isolation, etc...) but those situations are exactly the sort of place where a GIDS _would_ be useful and appropriate. While it isn't the ideal or final solution (removing the vulnerability would be that), it is a reasonable interim solution to manage the risk until a real solution can be implemented.

As any sysadmin can tell you, sometimes the patch is worse than the vulnerability. Downtime from a bad patch can be just as bad or worse than downtime from a compromise. :)

All opinions are my own and in no way reflect the views of my employer.

Toby

> -----Original Message-----
> From: Dominique Brezinski [mailto:dom@decru.com]
> Sent: Tuesday, November 12, 2002 2:29 PM
> To: detmar.liesen@lds.nrw.de; focus-ids@securityfocus.com
> Subject: Re: Changes in IDS Companies?
>
>
> For a smart-ass response, see below....
Received on Wed Nov 13 12:21:39 2002