RE: [Snort-users] Re: [Snort-devel] IDS vs IPS

From: Bob Walder <bwalder(at)spamcop.net>
Date: Mon Sep 01 2003 - 13:02:30 EDT

Frank,

At last.... A voice of sanity and reason

However, I will take issue with one part of your reply - why do we have to abandon the term at all? It has been grabbed - for better or worse - by a particular group of vendors to refer to a particular group of products. And I don't think the term is that wide of the mark. If you are going to get all precious about it, why not decide that IDS is not a good term, is marketing fluff, because it should really be ICDSIBMNAOTASOTOIDDMBFP (I Can Detect Some Intrusions But Not All Of Them And Some Of The Ones I Do Detect Might Be False Positives)... Not as catchy though, is it?

We are getting into the realms of The European Community and its ridiculous assertions that bananas should be straight and The Brits are no longer allowed to call their ice cream "ice cream" 'cos there is actually no cream in it - instead it should be known as Non Fat Dairy Substitute or some other similar ridiculous term.

So, now we have IDS (or NIDS), and HIDS, and IPS (or NIPS) and HIPS... And we have firewalls, of course... And routers... And ACLs... And everyone knows what all these things do (and all of them could be said to have elements of "intrusion detection" and "intrusion prevention" in them if we look hard enough). So get over it.

When we finally DO get our wonderful converged product which everyone is waiting for and which is the best of the firewall/IDS/IPS world with built in anti virus checker, content scanner and coffer maker, then you can call it the All Singing All Dancing Gateway Security Appliance - or the Firewall Intrusion Detection and Prevention Appliance - or whatever other marketing term you like.

And then we can all argue about THAT one for weeks on end because someone decides it can't be "all singing and all dancing" unless it has a CD player in it and comes with a free pair of tap shoes.

Regards,

Bob

>> -----Original Message-----
>> From: Frank Knobbe [mailto:frank@knobbe.us]
>> Sent: 01 September 2003 18:37
>> To: Mark Teicher
>> Cc: Jeff Nathan; Jason Sheffield; Crumrine Gary L; Jason;
>> bwalder@spamcop.net; Vkmobile@aol.com;
>> snort-devel@lists.sourceforge.net;
>> snort-users@lists.sourceforge.net; jon.brody@sygate.com;
>> cklaus@iss.net
>> Subject: Re: [Snort-users] Re: [Snort-devel] IDS vs IPS
>>
>>
>> I'll cut down to gist of it...
>>
>>
>> On Sun, 2003-08-31 at 10:32, Mark Teicher wrote:
>> > Jeff said:

---

This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven.
http://thinkgeek.com/sf

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Mon Sep 1 13:22:30 2003