Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

IPS Signatures - Where do they come from and how are they enforced?

Ok i have heard different stories on this. At first I heard Trend makes these and is the reason for the licensing in the past few years. Another internal source tells me that cisco has a signature creation group/committee internally that creates these. Whats the skinny? Also, when a know vulnerability is seen out on the internet and a CVE is associated with it, what is the delta in time before this "internal committee" decides to create them as a cisco sig? Can anyone indicate the policy cisco goes through on the decisions and how long this usually takes? Lastly, Cisco sends new sigs all the time, weekly nowadays. In those new sig sets are retired sigs. Why have retired sigs sent in a new sig set ? or are these sigs stricly retiring the old sigs already in the system ? How does cisco decide to retire a sig, what process dloes it go through?

Ok there is a lot there but we have  alot of  students who ask and it may benefit a high nunber of cisco customers.....

Thanks

Jim

Jim Thomas Cisco Security Course Director Global Knowledge CCIE Security #16674
4 REPLIES

Re: IPS Signatures - Where do they come from and how are they e

Which system are you talking about here?  For some systems, there are signatures that Cisco uses, for other systems, it is trend micro.

New Member

Re: IPS Signatures - Where do they come from and how are they e

Cisco 42xx sensors, IDSM2s and AIP-SSMs

Jim Thomas Cisco Security Course Director Global Knowledge CCIE Security #16674

Re: IPS Signatures - Where do they come from and how are they e

For this box, I would recommend that you ask your question in the netpro forums.  These forums don't cover that box.

www.cisco.com/go/netpro

Re: IPS Signatures - Where do they come from and how are they e

In Late December, Cisco will ofer IPS protection on the SA500 series as a licence based SKU which can be added to your product order.

1090
Views
0
Helpful
4
Replies