RE: MSSP / IDS Selection

["Phil Hollows" <phollows () open com>]

Hi:

FWIW (since I work for a SIM vendor), this article, reprinted from a
January 2005 eWeek, references the experience of one of our customers
who went down your path -- looking for an MSSP and instead ended up
bringing the work in-house.  

http://www.open.com/pdfs/eweek_sim_case_study.pdf

Phil Hollows 
VP Marketing 
OpenService, Inc.
www.open.com 


-----Original Message-----
From: KJP [mailto:kjp011975 () gmail com] 
Sent: Sunday, March 13, 2005 5:52 PM
To: focus-ids () securityfocus com
Subject: MSSP / IDS Selection

I have spent much time researching various MSSP's NetSec, Verisign,
Counterpane, and LURHQ for my company.  After much research we decided
to go with Verisign for numerous reasons.  After selecting Verisign we
began narrowing down pricing.  On a monthly level the pricing looks
ok, until you look at it at a yearly level the pricing starts to get
scary.

We looked into doing the same service internally using Snort.  I
remembered the comercial implentation of Sourcefire and began
researching it.  It appears to offer services that Snort does not, RNA
and Defense Center offer the pieces missing from Snort, plus it
packages the support so I don't need to worry about hardware support,
OS support, etc.

What are the opinions of Snort and Sourcefire versus ISS, Cisco,
Enterasys, Symantec?

Thanks in advance.

------------------------------------------------------------------------
--
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------
--


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------