I have had many conversations over the years about false positives - are they really false positives, which ones are important, can we ever get to a point where there are none left, what about false negatives, etc. One of the interesting history tidbits that often comes up is just how ecstatic the IDS vendors were when they could go to an enterprise, plug an IDS into the network, and have it start popping like a popcorn popper with all of the alerts out there. I am sure this characteristic helped IDSes sell a lot of new boxes. Alas, the tide turns (and Snort comes out with configurable rules) and false positives, which everybody thought were real alerts, have been given the black eye they deserve.
This is a great learning experience for anyone out to sell products - you must really consider the nature of what you are doing and allow it to demonstrate its own value proposition legitimately, otherwise it may come back to haunt you. IDS solutions have come a long way since the era of false positives, and yet we still have people who consider them useless, even dead. Not true, even a little bit. Just people living in the past.
3:14:39 PM 
|
|
