Well, if you lined up a 1000 ICOs, I guess I will line up a RAC!
Didn't get the part about "laws of foreign lands"...
But in my experience, a flawless IDS/IPS or even an IDPS seems utopian and unreal! An IDS tells me an attack is in progress, when, how, etc. And expects me to do something about it - meanwhile, I am losing business by the minute! An IPS generates too many false positives (disconnects valid business - my loss again) and is a little too easy to fool (!?! suspect the AV and Network Security Industry guys want it to be that way?! - anyway, reading signature patterns or reading load patterns is hardly an intelligent way to deduce an "attack" - have seen too many instances of peak load, line noise setting off an IDPS)... Both sit on my network and eat resources - its like I have to grease the greedy policeman to keep the extortion gangs out!
If I must do all of that, why can't I instead draw out a contract with my ISP, tell them to install a BFF (thats a Big F***ing Firewall
) on their end (don't see the logic behind a downstream firewall - if the bloody little rascala packets have to reach my downstream firewall to get blocked, why, they have already won half the war by clogging my lifeline to my ISP), configure it with some strict rules and maybe, use a IDPS to simulate an attack just to harden my rules (and then get rid of it) and then sit back and pray that someone with a big honeypot does not want to pawn my a$$?
It would still not mean 100% security (not like the IDPS would guarantee that either), but I got rid of resource hoggers and applications that sometimes like to chase back and confirm that the port the attacker suspected is open IS actually open!
The only advantage I can see an IPS might hold is that it will trigger even when the attack originates from inside my network! But I guess that is easily taken care of by architecting the network properly in the first place and having a second BFF
inside the DMZ.
I guess I am just trying to say, if the very nature of IP makes a IDPS fall short of what it must do (or at least is expected to do), why use it in place of something which would let me do kind of the same thing with lesser resources and better accuracy! Granted a DOS would leave its marks on my logs, but the idea is to save my a$$ (my business), not sue people later on to recover the losses.
