RE: ForeScout ActiveScout (was: Re: Intrusion Prevention)

> -----Original Message-----
> From: Adam Powers [mailto:apowers@lancope.com]

> I would also be curious to know how you deal with NATed addresses and

> Example: If I'm a bad guy accessing a server protected by ActiveScout
prevent
> all the other users at Company A from being DOSed out of accessing the

In the scenario Adam describes, they can't help but paint with a broad brush (i.e. block the source IP) unless they are dropping individual TCP sessions. Following that path raises another unwieldy issue -- DOS-ing the firewall that's receiving the SAM "drop & inhibit" commands from the ActiveScout. If an attacker were to somehow learn that the target host/network was protected by an ActiveScout/FW-1 firewall combo he could conceivably send enough "marked" traffic at the target to seriously degrade the firewall's performance.

Regards,  

Matt

Matt McGuirl                                
Lucid Security Corporation