See your link here
Experts say IDS here to stay after all - really???
3 comments- IT TOPICS:Security
So IDS isn't dead?? Uhhh, a big DUH is appropriate here. I'm not trying to poke fun at the author of the story, but this has been known for a while now. I'm glad to see it so blatantly stated in a reputable web publication, but this is not a new story.
I used IDS in my last job, even with an IPS in my network. The reason being is because the IPS is almost always an inline device. It is an ingress / egress device that blocks traffic. It gives you no real visibility to what is going on in your network. To get an eye on what is bouncing around in your core or distribution layers, you need something looking at the traffic via a span port. Just like the article says:
IDS products will probably remain as separate devices because of the need to monitor happenings on a network and monitor actions of other policy enforcement points.
Richard Bejtlich says:
What's an "IPS" anyway? It's a filtering device, aka "firewall." What's an "IDS"? It's an attack or incident indication system. The two functions are completely different and should be separate.
The article also states that IPS is being rolled up into the firewall while the IDS will likely still have relevance as a stand alone product for a while. Yes, the IPS is being rolled up in the firewall to a high degree. But it still has some life as a stand alone product as well. It really depends on the situation. I am writing a post now over at my personal blog so I can include some drawings and more explanation.
Print
Email this
Digg this
