OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Installing RealSecure Questions -reply
From: Mark.Teicherpredictive.com
Date: Tue Apr 04 2000 - 07:54:25 CDT

TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
majordomoiss.net Contact issforum-owneriss.net for help with any problems!
----------------------------------------------------------------------------

Mark,

Review the ISS RealSecure Getting Started Guide pages 11 -13, on the
deployment of ISS RealSecure Console, Detectors and Agents within your
network.

RTFM

/mark

MTalor00aol.com
Sent by: owner-issforumiss.net
04/02/00 03:03 PM

 
        To: issforumiss.net
        cc:
        Subject: Installing RealSecure Questions

Content-Transfer-Encoding: 7bit
Return-path: MTalor00aol.com
From: MTalor00aol.com
Full-name: MTalor00
Message-ID: <38.3de20e5.261269a1aol.com>
Date: Tue, 28 Mar 2000 15:01:37 EST
Subject: Installing RealSecure Questions
To: idsiss.net
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
X-Mailer: Unknown (No Version)

I'm going to install RealSecure in our dmz network, and I was
contemplating on whether or not the IDS should be sitting outside or
behind our firewall. My objective is to monitor traffic targeting our web
servers. Does anyone have any insights on the pros and cons as to where
the IDS should be placed on the network?

I'm getting ready to install the RealSecure console and engine. Does it
matter if I do that first, then set up the machines in promiscous mode or
should I set up the machine so that it is dual-homed and then install the
console and engine software?

Also, does anyone know of any known vulnerabilities that should be fixed
before I place the IDS in a production environment? If I place the
machine outside our firewall should certain ports be disabled? Do certain
ports also need to be diabled if the RealSecure box is sitting behind our
firewall?

Sorry for the long list of questions, but any help would be appreciated.

Thanks,
Mark