Using snort to detect if your users are doing interesting things?

• Previous message (by thread): Using snort to detect if your users are doing interesting things?
• Next message (by thread): Using snort to detect if your users are doing interesting things?
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On 6/9/05 12:08 PM, "Steven M. Bellovin" <smb at cs.columbia.edu> wrote:
> Also figure out what you're going to do with the output.  Do you have
> the resources to investigate apparent misbehavior?  Remember that any
> IDS will have a certain false positive rate.  Even for true positives,
> do you have the customer care resources to notify your users and (if
> appropriate) hold their hands while they disinfect their machines.

And along the same lines, as much as it irks me to state this, one needs to
ask whether this really is a desirable state and what sort of implications
does one create when that is done.  One might find the discussions with
appropriate legal counsel to be quite enlightening, for example, and they
are probably a good starting point prior to even attempting to
operationalize sorting out wheat from chaff, let alone responding in a
useful manner.

Best regards,
Christian


*****

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. 117

• Previous message (by thread): Using snort to detect if your users are doing interesting things?
• Next message (by thread): Using snort to detect if your users are doing interesting things?
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]