Security
by inkster
Firewalls are your perimeter defense against unwanted guests. IDS is your alarm system in case someone has broken down the door, so to speak. In any case, In order for a security plan to work, especially in a financial institution, you need both to protect all of your vital information. You also need a good security policy, antivirus program, user training for security awareness, business continuity plan, just to name a few.
As far as your IDS goes, you need both a network based and a host based IDS to cover all important areas in your network. The companies that you will have doing the monitoring will basically take a lot of added work away from your staff. Monitoring is very time consuming for whoever your Security Professional is.
There is more to security than just firewalls and intrusion detection systems.
by james r linn
Then start with a good firewall. Its very similar to home security -a good lockk is more cost effectove than an alarm, but you may need both.
The concept to think about is defense in depth. Any system has vulnerabilities - but if you have a number of defenses you can be more confident in your protection.
Most large companies use both.
James
by james r linn
Then start with a good firewall. Its very similar to home security -a good lockk is more cost effectove than an alarm, but you may need both.
The concept to think about is defense in depth. Any system has vulnerabilities - but if you have a number of defenses you can be more confident in your protection.
Most large companies use both.
James
by alon
We use Kavado InterDo which is an application layer security protection. This does a far better job then running ISS (IDS system). I would recommend the use of Check Point NG and Kavado InterDo as they do the job very well.
Alon S. Moritz
www.moozatech.com alon@moozatech.com
by admin
asking if you should hire someone to monitor all activity at your firewall, or just to notify you of intrusion. I think this is often blurry and similar in practice, and that different companies will provide different things, so it's not easy to be general. You have to read each contract closely.
In theory, firewall monitoring should give you more information including unsuccessful intrusion attempts or queries. It can also bog you down with huge logs (believe me, I get to wade through a lotof reletively worthless stuff) and more expense to get good reports. The advantage, however, is that it is likely that you can change things BEFORE you get an intrusion and also a good idea of all the traffic that may not be an intrusion attempt, but worth knowing about with good monitoring.
I would check each companies specific services though. There could be a lot or little overlap between these.
by gbalonek
well...firewall simply blocks the attackes from outsite...closes ports and stuff like that...
but what if you are inside the network...
most of the attacks and hackings are done from withing a network so firewall will not be usefull...
IDS on the other hand picks up signals from withing the network and out side of it and it will log them. It will also blocks he person or logg him of and ...
by ssgduff
with ids you have to rely on known signatures. For an IDS to actively block it must be an intrusuion prevention system.
Also most of the so called internal hacks are mere end users looking for something they have lost, or trying take a look around. Most interanl hacks that are damaging are cost by people who have access, still the ids will not do its job, neither will the firewall. For that you need to set the propertties of the file structure and have damn good back ups.
First an formost, you have to "lock the doors to the house" so you can regulate who and what is legitimet traffic. Thats the firewalls job. Then you include an IDS/IPS system to layer the systems defense.
Think about it, an IDS does not have an up todate signature, I use that exploit, you are still open 1. the signiture was not detected and 2. You have not shown diligence to secure your network. (no firewall) and thats bad juju.
Nothing is 100% secure, no matter who makes it. A rubber hose attack should work when all else fails.
This discussion is closed to new replies.
Sort by Trending