[177770] in North American Network Operators' Group
Re: Checkpoint IPS
daemon@ATHENA.MIT.EDU (Terry Baranski)
Thu Feb 5 09:31:56 2015
X-Original-To: nanog@nanog.org
In-Reply-To: <DD04B334-98F4-4653-B6F1-A26B1EFE0F27@arbor.net>
Date: Thu, 5 Feb 2015 09:31:49 -0500
From: Terry Baranski <terry.baranski.list@gmail.com>
To: Roland Dobbins <rdobbins@arbor.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
On Thu, Feb 5, 2015 at 8:34 AM, Roland Dobbins <rdobbins@arbor.net> wrote:
> I've never heard a plausible anecdote, much less seen meaningful
statistics,
> of these devices actually 'preventing' anything.
People tend to hear what they want to hear. Surely your claim can't be that
an IPS has never, in the history of Earth, prevented an attack or exploit.
So it's unclear to me what you're actually trying to say here.
> And the fact that well-known evasion techniques still work against these
> devices today, coupled with the undeniable proliferation of compromised
> hosts residing within networks supposedly 'protected' by these devices,
> militates against your proposition.
Your tendency of making blanket statements is somewhat baffling given the
multitude of intricacies, details, and varying circumstances involved in a
complex topic like this. To me, it's indicative of an overly-simplified
and/or biased way of looking at things.
In any case, go ahead and stick with your router ACLs and (stateful!)
proxies. Different strokes.
-Terry
