[Tfug] Lightweight IDS options/strategy/policy

[Bexley Hall]

Hi Tyler,

On 9/25/2013 1:17 AM, vaca at grazeland.com wrote:
> IDS is a part of a comprehensive security program.  I don't think anyone
> is suggesting it as a replacement for perimeter security, OS hardening,
> anti-malware software, strong policies, etc.

The *tougher* problem is how you deal with (3rd party) "apps" running on
the system.  Do you prevent them from dialing out (not practical even
if they are "PULLing" information as it is easy to set up a covert
channel that appears to only be "reading" from the outside world)?  Or,
do you restrict what they can *see*?  (i.e., only let them see things
that you don't care if they "disclose")

How do you create tools that let the *user* decide what he considers
"public" information vs. private (so your mechanisms can apply the
appropriate safeguards)?