Re: [Snort-users] Re: [Snort-devel] IDS vs IPS

From: Frank Knobbe <frank(at)knobbe.us>
Date: Wed Aug 27 2003 - 23:47:15 EDT

On Thu, 2003-08-28 at 03:16, Jason wrote:
> Thanks, I think the matrix shows fairly well that the _new IPS_ is a

Right. It is the merger of firewall and IDS. It has as much IDS as firewall in it. But I wouldn't say that it is closer to either one. It appears to have evolved into a category of its own.

> You can also have confidence in your firewall because your IDS verifies

Exactly. This is precisely the point that Gartner missed. IDS are far from obsolete. You always need to have an IDS inside to verify the function (and detect failure) of the firewall or IPS.

I probably made this prediction before, but here is a good place to do it again. Mark my words :) "We will see a new breed of software become popular soon which is a merger of IDS and forensics software".

Cheers,
Frank

---

This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven.
http://thinkgeek.com/sf

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-develReceived on Thu Aug 28 00:40:45 2003