Archive for May, 2010

IDS at Layer 7: Challenges of packet inspection in the Web 2.0 world

Bill Brenner, Senior Editor at CSO talks to Endace’s Tim Nichols about the challenges of IDS and packet inspection in the Web 2.0 universe in this Podcast.

Making next generation IDS a reality

SearchSecurity.com has profiled Endace on its Security Bytes blog. There are some good points there about the evolution of Intrusion Detection Systems, Intrusion Prevention, and the limitations of both, and how Endace is taking Intrusion Detection to the next level with its 100% packet capture technology and support for Suricata.

NSS IPS tests show average block rate only 57%

NSS Labs conducted a test of multiple IPS solutions from 7 well-known vendors in Q4, 2009. Their full report is available for purchase here (if you are interested in a copy of the full report, let us know as we’ve still got a limited number to give away and we’ve also negotiated a special deal for “friends of Endace”).

The NSS testing revealed issues with IPS performance that tally with our experience in the field, and which we felt are important for people to know about. So, with agreement from NSS, we’ve just released a graph (anonymised) from the NSS IPS testing. This showed that, even with tuned rule-sets, the average block-rate performance of the IPS solutions tested was just 57%.

Endace Probe 3.7.1 Release

We’re happy to announce that the Endace Probe 3.7.1 Release is now available for existing customers from the Endace support site and will be available on newly factory shipped systems from May 17.

This release is primarily a bug fix release with further improvements to Endace Analytics via the latest 2.2 version of CACE Pilot. This release also provides support for the legacy 200/2000 and 500/5000 Probe platforms, as well as full support for the new 3000 and 7000 Probe platforms. It also includes Endace Security Manager update 5.2.0.0, and support for 1GbE/10GbE mixed SKU’s on the 7000 series.