But the idea behind operation modes is that block ciphers are deterministic algorithms (given a particular input, will always produce the same output) so applying them we avoid creating identical output ciphertext blocks from identical plaintext data, correct?

Don't know how but indeed I've missed it. Thank you! So basically it is an algorithm that is applied to the encryption algorithm?

@schroeder okay, that makes sense. One question though. I was looking at Snort and it looks like it does not support decryption. If I'm not mistaken signature based detection would not work in that case since the payload is encrypted. What can an IDS/IPS possibly do with encrypted packets (perform network analysis based on L2,3,4 addressing information?) to detect anomalies?

Thank you. As I can see there are many Risk Management / Assessment methodologies, frameworks. Is it important which one I use ?

My concern is, that I could not include a threat initially but one could get discovered during vulnerability assessment. But I guess that works both ways.

I still have some doubts. I mean risk assessment per my understanding is a process of defining a likelihood of a threat exploiting a vulnerability and the impact it may have. But without and vulnerability or without a threat I don't have a risk. If I have a set of assets and on them I'd like to perform a risk assessment. Should I first write down threats (and possibly divide them into categories like adversarial, accidental, structural, environmental ) and see whether there are any vulnerabilities that could be exploited by any of the listed threats ?

Generally. BlueCoat is one option. But maybe there are better more efficient ways to address our problem?