- Bank Web sites full of security holes
- SCO Group: Its future is all used up
- Maligned feature being added to IPv6
- I returned my iPhone 3G after six days!
- VPNs: Six burning questions
News | Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:App Performance | On Demand Security | Networking Solution | SOA | Value of WDS
Sourcefire's most recent 3D System release certainly puts the company on the right track to making network intrusion-detection/prevention systems much more useful tools in the enterprise. In the Sourcefire 3D System Version 4.7, we found substantial progress in areas specific to management and configuration of the IPS, along with newly integrated tools which link user information to security incidents.
Sourcefire's 3D System includes detection engine software for IDS/IPS, service and vulnerability discovery (called Realtime Network Awareness), and user-to-IP address mapping (called Realtime User Awareness) and the hardware to run all the software components. The same Sourcefire software can also be run on hardware from Crossbeam, Nokia, and Nortel. The Sourcefire bundle also includes a management system – we used the Defense Center 1000 in our test but the company also offers a DC3000 version geared toward very large networks.
Two of the most important changes in 3D System Version 4.7 lie in the RNA and RUA components. When we looked at the RNA in its first releases, we found its ability to provide network visibility by passively discovering systems, applications and vulnerabilities useful. However, RNA was not integrated into IDS and IPS policy definition at that point. In this release, Sourcefire finally brings RNA into the big picture by letting the network manager easily use RNA-discovered information to refine IDS and IPS policy and build compliance policies. For example, RNA can recommend enabling and disabling IDS rules based on the services and systems actually running on the network — helping to simplify and speed the process of tuning the IDS policy.
Another addition to the 3D System is Netflow analysis, which did provide traffic and service information in our test network, but required a cumbersome deployment. Netflow analysis takes advantage of the ability of routers and switches to collect and forward information about which hosts are on the network and what they're doing — an alternative to full-fledged RNA analysis that would be useful in very distributed networks or ones where IDS monitoring is technically impractical.
what are the benefits of project management - Anonymous
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask to prospective vendors to get the right endpoint solution.
Download the white paper.
Unauthorized applications: Taking back control
Employees installing and using unauthorized applications like IM, VoIP, games and peer-to-peer file-sharing applications cause many businesses serious concern. How do you control these applications?
Download the white paper.
Comments (2)
IPSes aren't the same as Firewalls: yeah, I know.By Joel Snyder on January 23, 2008, 10:41 pmI am guessing (I can't tell for sure) that you're talking about the part of the test where we used the Mu-4000 to run various attacks through the IPS. I think...
Reply | Read entire comment
RE: Sourcefire boasts strong IPS management toolsetBy alvarius on January 22, 2008, 1:55 pmI find it peculiar that the author is putting an IPS product and a Firewall under the same umbrella. The fact that both products are capable of blocking traffic...
Reply | Read entire comment
View all comments