| In some implementations, the IPS system may work with the firewalls, routers, or switches to dynamically update or create rules. Changes to the IPS may cause the sensors to miss critical attacks.
The IPS sensors are configured to transmit sensor logs using network configuration information. They also may communicate with the Firewall and other network devices. The IPS must have the capability to dynamically reconfigure destination addresses, user privilege assignments, and changes to traffic flow requirements.
This requirement is applicable only to IPS implementation allowing external devices to update sensor signatures, rules or other scanning configuration.
If unauthorized devices are allowed to update the IPS configuration, information flow and access control attributes may be maliciously changed, thus adversely impacting network availability or gain unauthorized access to the information. |
