IPS Profile for Internal Segmentation

[Holy777]

Hello Everyone,

i am designing a new Internal Segmentation Projekt and wondering about IPS Profile Signatures that should be used for internal traffic.

for Example for Traffic

ClientA > ClientB   = here would you use Windows Server Signatures to protect ClientB ? as a client can also use and share some Server Services ?

Server > Client  = which signatures would you use here?

Server > Internet  = here i would set client Signatures only as i want to protect the Server

would appreciate your thoughts and ideas for using IPS Profiles in Internal Segmenation

Thank you

[ESCHAN_FTNT]

Hi Holy777

It is actually very subjective on the IPS profile used. You can use the default one as a start. A good suggestion is to apply the IPS profile that is applicable to devices you would like to protect. Eg. Use only the IPS signature for Windows OS only if you are protecting just the Windows devices, instead of all other OS such as Linux, Mac and etc.

[Holy777]

Hello,

thank you but in that case i would actualy use always Server Signatures even for the Traffic Client > Client right.

Client Signatures i would than use only if i access Internet