What to ask when evaluating intrusion-prevention systems
I think it is really great artcile to expand you evaluation in terms of IPSs ...
Quote:
An intrusion-prevention system (IPS) is part of an overall security strategy to protect your network from attack. The IPS literally prevents an attack by blocking bad stuff, such as viruses or malformed packets, from getting into the company network.
Sitting directly behind the firewall, the IPS examines in detail all the traffic passed by the firewall, reassembles it and "scrubs" it where necessary (removing any attempts at obfuscation or evasion) and compares it to a database of known attack patterns.
This brings us to the first and biggest difficulty faced by anyone when evaluating IPS products -- how effective is the detection mechanism? Asking vendors these questions can help you decide which IPS is right for your company.
What is the coverage like?
The total number of signatures is a well-used marketing trick, but quantity isn't always an indicator of quality of coverage. Sometimes, one well-written signature can detect a large number of exploit variations. However, some vendors with hardware-accelerated products and horsepower to spare will often throw signatures at the problem, with one signature for each variation -- not always the best approach.
Does it rely purely on pattern matching, or can it perform protocol decodes?
A protocol decoder is often the best (and sometimes the only way) to detect multiple exploits for complex vulnerabilities. However, don't believe all the hype about protocol decoders. It's not always necessary to have one, and sometimes, a few well-written signatures can work just as well. (Bear in mind that even a full protocol decoder needs to use pattern or variable matching in order to determine if the protocol-specific content it has extracted is malicious).
Full-length Article
