| 1. |
Where
is this product designed to sit on the network? |
| 2. |
What
are the latency, throughput, and jitter claims you make regarding
this product and how did you arrive at those numbers? (See Issues
with IPS performance numbers.) |
| 3. |
Is this product primarily designed to mitigate attacks with rate-based
mechanisms or content/anomaly-based mechanisms? |
| Rate-based
products |
Content/anomaly-based
products |
| 4. |
What
additional content-based features does this product offer? |
What
additional rate-based features does this product offer? |
| 5. |
What
tools does this product offer that let you measure baseline traffic
norms? |
What
is the underlying IDS system in this product? |
| 6. |
How
granularly can you define which incoming traffic the IPS is going
to examine and, eventually, limit or block? |
How
big is the signature database? Which of those signatures are turned
on by default? What is the update mechanism for new signatures? |
| 7. |
How
sophisticated are the rate detection and control mechanisms offered?
(For example, can they detect just a flood or can they track potentially
malicious single connections over time?) |
How
do you see, enable, disable, and modify attributes of bad traffic
signatures? |
|
| 8. |
How
does this product discover machines and services running on the
network that need IPS protection? |
| 9. |
Does
your product have a learning mode, how long does it take, and how
do you recommend running it in learning mode? |
| 10. |
How
easily can you run this product in an alert-only mode? |
| 11. |
What kinds of traffic can this product block (DoS attack UDP protocol
attacks, buffer overflow attacks, fragmentation attacks, spoofing
attacks (inbound/outbound), application-layer attacks, for example? |
| 12. |
What
are the action options offered by this product once malicious traffic
is discovered (drop-only, pass and track, pass and alert, pass but
limit, for example). |
| 13. |
What
kind of communication happens between this IPS device and either
my installed firewall or a built-in one? |
| 14. |
Does
the product provided centralized configuration and/or management
capabilities? |
| 15. |
What
are your configuration options (rules per port, per system, for
example.)? |
| 16. |
Does
the product provided centralized configuration and/or management
capabilities? |
| 17. |
What is the overall strategy for alert you of both malicious activity
and of blocked traffic? |
| 18. |
What
are the product’s reporting capabilities? |
| 19. |
Does
this product have the ability to connect to a Security Event Management
system via some event reporting mechanism? |
| 20. |
If
this device’s log fills, will it continue to operate without
logging? |
| 21. |
Does
the vendor offer log analysis tools for forensics and capacity planning? |
| 22. |
What
secure management access methods does this device support, such
as SNMPv3 or SSHv2? Are these the only methods enabled by default? |
