IPS: relationship between signatures and network service

Unanswered Question
Jun 11th, 2008
User Badges:

Hello,


Does anybody know if there is documentation regarding the recommended signatures to be activated depending of the network service being deployed?

Let's say that I have several servers behind a firewall, therefore, in theory I would only need to activate in my IPS the signatures related to those services, for example, ftp, https, aaa, etc...

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Farrukh Haroon Wed, 06/11/2008 - 18:18
User Badges:
  • Red, 2250 points or more

I'm not aware of any such recommendation or profile available on the IPS based on services deployed. But within the IPS you can arrange the current signatures 'view' based on Engines/Categories/Protocols etc. and you can use that functionality to disable/enable multiple signatures in one go.


http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/idm/idm_signature_definitions.html


Regards


Farrukh



TradeSecrets Fri, 07/11/2008 - 07:21
User Badges:
  • Bronze, 100 points or more

Hi there,


Depending on IPS, you should be able to disable signatures for Solaris, OSX, Windows, Linux if you are not using them in your network. The trick is getting the vendor to admit how many signatures the device can handle. They will almost always lye to you.


Also if you but sensors in front and behind your firewalls. You will see which are getting through the firewall, That then need to be install on the IPS to protect against.. if you add a 3rd sensor in back of the IPS. you can see how many made it past all your defenses


Let me know if that helps a little.

~TS

Actions

This Discussion