Hosting Provided By

RE: Active response... some thoughts.

From: Kohlenberg, Toby <toby.kohlenberg(at)intel.com>
Date: Thu Jan 23 2003 - 20:45:07 EST

I looked at the whole active response thing a while ago and have yet to see anything that changes my basic opinionvery few events are well defined enough to trust an automated response that could cause problems for a customer. The coolest response I've seen was from Dragon which can send false/funky responses to an attacker when it sees a scan going on.

It will be a long time before I think IDSs will be trustworth enough to use such technology frequently.

(all opinions are my own and in no way reflect the views of my employer)

toby

> -----Original Message-----
Received on Sun Jan 26 22:54:49 2003

This message: [ Message body ]
Next message: Abe L. Getchell: "RE: Active response... some thoughts."
Previous message: sstover: "RE: Active response... some thoughts."
Maybe in reply to: Abe L. Getchell: "Active response... some thoughts."
In reply to Gary Golomb: "RE: Where is Ron Gula? (was "Changes in IDS Companies?")"
Next in thread: Talisker: "Re: Active response... some thoughts."
Reply: Talisker: "Re: Active response... some thoughts."
Reply: Abe L. Getchell: "RE: Active response... some thoughts."

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:01:06 EDT