3 ms·
Can you please comment why installing IPS in a production environment in 2018 is silly? (genuinly want to know) Also, when or where would you recommend install
by mikevm 8y ago
Can you please comment why installing IPS in a production environment in 2018 is silly? (genuinly want to know)
Also, when or where would you recommend installing an IPS product? As part of a corporate firewall?
- tptacek 8y agoI would more or less never recommend installing an IPS. In the past dozen or so years I've spent lots of time (months at a time) working on the networks of F500s that have fleets of IPS systems, alongside their security teams, and I have never once seen an IPS do anything but generate alerts that get bucketed in a SEM and forgotten about.
- 616c 8y agoI completely agree but think this shows a failing of "blue team" culture and education. I now started work in a massive project with half a dozen companies sharing massive AWS VPCs. They have limited security team oversight and coordination. Wouldn't it be nice of they had sufficient levels of access to Snort Suricata data and could learn what normal operations looks like and educate themselves to look for poorly documented systems that are not hooked up to SIEM or even the APM correctly or are failing to talk to different EC2 instances correctly and help? Inventory and ops is sexy and not security but why countless times I see younger SOC kids know absolutely nothing about what their environment looks like. That data would not help them even if they are allowed out if the kiddie sandbox and only allowed to read baked queries and alerts. The reason this stuff is useless is bc I have never met someone with sufficient experience to act on it for any context, bc people think the tools magically bring educated talented people.