Re: Intrusion Prevention

[snip]... I will be beginning evals of IntruVert soon, with NetScreen IDP to follow. For functionality ("speeds and feeds") criteria, I am relying heavily on OSEC, because the Neohapsis crew knows their stuff and nothing is hidden .... [snip]

I like the NeoHapsis guys too, but the OSEC stuff is very like the ICSA certification for firewalls, etc - you get your checklist and your "PASS/FAIL" mark - "Just Another Certification Scheme"

Whilst the OSEC results are always interesting and should not be ignored, anyone serious about deploying Gigabit IDS or Intrusion Prevention should definitely be reading the latest NSS Group report (www.nss.co.uk/gigabitids). The methodology looks every bit as thorough as the OSEC stuff (they complement each other in several areas) but they also go to the trouble of providing many pages per product of detailed subjective technical evaluations - features and benefits, scalability, ease of use, completeness of alert handling, reporting, forensics, etc, etc

OK, so you have to pay for the full report, but it's only $50 and if you can't get the budget for that then you are definitely NOT interested in deploying Gigabit IDS ;o)

We are looking at deploying such products at the moment across a large organisation throughout Europe, and I personally would not be putting ANY product forward to be considered until I had seen what the NSS guys had to say about it.

I am hoping that both Netscreen and Sourcefire will be in the next edition and I have to say that Dragon was off our list of IDS for ANY speed of network some time ago due to its constant omission from these reports (you don't have to pay for the 100Mbit IDS reports, they are all on-line for free in full).

My 0.02

Rick

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek