So... what you're saying is that tuning signatures keeps your team in shape... and if they had a solution that could prevent successful attacks they would get lazy?
They COULD get lazy - I've seen this far to often.
"Hey lets' buy a firewall - plug it in and we are safe (and forget that there's more to this)."
The app and protocol decoding at the core of the system is very new.
No - app and protocol decoding is rather old when thinking in IT periods of time. The principles of decoding and analyzing any layer 4-7 protocol haven't changed.
Face it... the days of signature-processing/tuning and throwing processor cycles and custom chips at the problem are over
I never said that IPS are a solution to this problem - they never were a solution and they never will be - they are an additional security layer you could use (to a greater or lesser extent).
Server security without tuning,...
Security without tuning isn't possible.
BTW: I expect IPS to be obsolet in less than 3 years.
Then again, maybe Patch Tuesday, etc and reboots give you a sense of purpose...
not really
I didn't say that I have no interest in it - I will definitely give it a try. But as I said before - I don't expect it to be the philosopher's stone.
I have seen far to many "cool new things" in IT security - therefore I step gently.
There's nothing wrong using BlueLane VS (or any other product) - if you don't get trapped with its features and get a wrong feeling of safety (the laziness again).
