IPS'

[rn4it]

We're evaluating IPS' so far, we've had a 30 day eval of a Tipping point 50 and we're just starting a 30 day eval of the McAffee Intrusheild 2600. I know the individual products have some physical differences. What we are looking at is accuracy of the detection, features, ease of use and self mgmt. I was just wondering if anyone has any opions on either of these products and or other IPS systems.
Thanks

 

[schofs]

try

http://www.prevx.com/

 

[rn4it]

Thanks schofs, but what's your opion on it?

 

[schofs]

we like it its stable and stops users trying things
we use it as a layered approach on the internal domain..
So we do not get any false positives
try the free download

 

[rn4it]

Thanks, schofs, I'll just have to read up on it a bit first. So far, we're looking into appliances that have the ability to run in-line. Thanks

 

[schofs]

the inline appliances we found took a lot of management of the false positives shutting the network down. better with IDS on the network IPs at Host level

 

[rn4it]

What kind of appliances were you running? We've already finished a 30 eval with Tipping point, with their recommended config blocking critical attacks and had no problems. We're about to start another 30 eval with McAffee.

 

[schofs]

have a look

http://www.intrusion.com/products/securenet/

 

[MichealC4]

schofs: We run TippingPoint devices here, and have had no problems with false positives nor the devices bringing down the network.

Anything will have false positives, including HIDS. It is just a matter of what minimizes those chances, and how well something does on your network. For us, TP devices work extremely well, and have covered our butts on numerous occasions.

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt