Rubicon - an Extensible Gateway IDS
Ian Peters explores rubicon - an extensible gateway ids at DEF CON 10, examining intrusion-detection and practical defenses.
Summary
Architecture and Background
Ian Peters - Rubicon - An Extensible Gateway IDS IDSs have traditionally been seen as purely information resources, requiring human intervention in order to act on alerts.
Vulnerability Analysis
Recently, support for modifying firewall rules and killing active connections have begun to appear in IDSs, but these suffer from shortcomings.
Exploitation and Demonstrations
A desire has been recently expressed by many people for an active, 'Gateway' IDS (GIDS), allowing filtering and routing of traffic to be performed by a gateway computer using both traditional firewall-style rules, and also NIDS-style analysis.
Remediation and Defensive Strategies
Rubicon was developed to supply this functionality, and more, in an extensible manner. This talk will discuss some shortcomings of current NIDS products, and hence the need for GIDS, the design and development of Rubicon, and the future for GIDS in general and Rubicon in particular.
Related talks
Main Stage·40 min
Matthew G. Marsh
Matthew G. Marsh explores replacing tripwire with snmpv3 at DEF CON 10, examining intrusion-detection and practical defenses.
Main Stage·35 min
Jon Miller
Jon Miller explores humperdink - securing your windows internet server at DEF CON 10, examining intrusion-detection and practical defenses.
Main Stage·38 min
Daniel Burroughs
Daniel Burroughs - Correlation and Tracking of Distributed IDS Standard approaches to intrusion detection and response attempt to detect and prevent individual attacks.