RE: IDS causing troubles

All network engineers want to burn down the IPS. That's nothing new.=20

Disruptions should not be common. Most modern IPS/IDS solutions are pretty =
good about minimizing the downtime. ISS stuff is pretty good about this, al=
though not great.

I'd say your outsourced provider may have some issues or you need to update=
 to the latest versions.=20

Firmware updates should be scheduled to coincide with normal maintenance wi=
ndows in case there is any downtime. Signature updates can also be schedule=
d for a reasonable daily or weekly window. =20

Network admins will blame EVERYTHING on the IDS/IPS because it's easier for=
 them to blame the IPS then for them to do their jobs. There is a possibili=
ty you have network infrastructure issues. You might want to consider getti=
ng a third party assessment of your network. That way you can get an object=
ive analysis that will hold more weight with management. =20

Good luck.=20


Andrew Plato, CISSP, CISM, QSA
Anitian Enterprise Security=20



-----Original Message-----
From: [email protected] [mailto:[email protected]] On=
 Behalf Of Shang Tsung
Sent: Tuesday, February 01, 2011 1:53 AM
To: [email protected]
Subject: IDS causing troubles

Hello,

We have the following problem. Now and then, the IDS will cause disruptions=
 to the network, especially after updates. We have an IBM (ex ISS) Intrusio=
n Detection System with a few network sensors and several host sensors. The=
 IDS is not managed by us but we have it outsourced.

The disruptions mentioned above cause our network engineers extreme dissati=
sfaction (and anxiety) about the IDS and they would "burn the damn thing", =
if they could. We have 2 - 3 serious issues, causing downtime, per year.

My questions are:

- Are any of you experience the same issues?
- Is these disruptions common to others or should we seriously consider rep=
lacing the IDS and/or the outsourcing company?
- Could this be an issue with our network infrastructure?

I will appreciate any thoughts.

Thanks,
ST

-----------------------------------------------------------------
Securing Your Online Data Transfer with SSL.
A guide to understanding SSL certificates, how they operate and their appli=
cation. By making use of an SSL certificate on your web server, you can sec=
urely collect sensitive information online, and increase business by giving=
 your customers confidence that their transactions are safe.
http://www.dinclinx.com/Redirect.aspx?36;5001;25;1371;0;1;946;9a80e04e1a17f=
194







-----------------------------------------------------------------
Securing Your Online Data Transfer with SSL.
A guide to understanding SSL certificates, how they operate and their application. By making use of an SSL certificate on your web server, you can securely collect sensitive information online, and increase business by giving your customers confidence that their transactions are safe.
http://www.dinclinx.com/Redirect.aspx?36;5001;25;1371;0;1;946;9a80e04e1a17f194