IDS mailing list archives
Re: How to choose an IDS/FW MSS provider
From: Martin Roesch <roesch () sourcefire com>
Date: Thu, 17 Mar 2005 17:30:28 -0500
On Mar 16, 2005, at 4:59 PM, Mark Teicher wrote:
I tend to disagree on this, since there are more than ways to detect an exploit or how to discuss how and why things work when they do. The transparency issue is mute if the product is well constructed and doesn't shake apart when folded, binded or crumpled. There is a certain level of comfort that if something doesn't work right, one can work it on themselves, but if can compare this if I pay $xxx,xxx for fancy and very fast car. If it breaks under normal operating circumstances, Otto the mechanic better fix it for free. Same issue can be applied to the openness, if it breaks, it might not always get fixed right away since Otto isn't specifically assigned to it, or other wanna be Otto's attempt to know how to fix it. With the commercial application, the fix may not be readily available or until the number of days it is supposed to be released by the VRT :)
Support is a different issue all together. There are many instances where people have received superior product support for open source code than for equivalent and many cases where they haven't. It's like anything, it depends on the providers commitment to support the product. It doesn't change whether people like or trust a product. If it works well and you can see why it is or isn't doing its job in specific cases due to its nature as an open system then in many cases that bolsters trust. If it's a black box and it just always does a good job then people don't question it, but if it ever screws up then people are going to want to know why and your black box is going to be far less appreciated (and IDS could be said to frequently be a candidate for the latter scenario).
-Marty -- Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616 Sourcefire - Discover. Determine. Defend. - http://www.sourcefire.comSnort: Open Source Intrusion Detection and Prevention - http://www.snort.org
-------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly?Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------
Current thread:
- Re: How to choose an IDS/FW MSS provider, (continued)
- Re: How to choose an IDS/FW MSS provider Sasser (Mar 19)
- Re: How to choose an IDS/FW MSS provider Mark Teicher (Mar 16)
- RE: How to choose an IDS/FW MSS provider THolman (Mar 16)
- RE: How to choose an IDS/FW MSS provider Andrew Plato (Mar 16)
- Re: How to choose an IDS/FW MSS provider Andre Ludwig (Mar 19)
- Re: How to choose an IDS/FW MSS provider Prashant Khandelwal (Mar 24)
- Re: How to choose an IDS/FW MSS provider Andre Ludwig (Mar 19)
- Re: How to choose an IDS/FW MSS provider Adam Powers (Mar 19)
- RE: How to choose an IDS/FW MSS provider Chris Harrington (Mar 19)
- RE: How to choose an IDS/FW MSS provider KoƧ.net (Mar 19)
- Re: How to choose an IDS/FW MSS provider Mark Teicher (Mar 19)
- Re: How to choose an IDS/FW MSS provider Martin Roesch (Mar 19)
- Re: How to choose an IDS/FW MSS provider Mark Teicher (Mar 24)
- Re: How to choose an IDS/FW MSS provider Devdas Bhagat (Mar 28)
- Re: How to choose an IDS/FW MSS provider Martin Roesch (Mar 19)
- RE: How to choose an IDS/FW MSS provider Nigel Lewis (Mar 19)
- RE: How to choose an IDS/FW MSS provider Sergey V Soldatov (Mar 19)
- RE: How to choose an IDS/FW MSS provider Jason Baeder (Mar 19)
- Re: How to choose an IDS/FW MSS provider fuijdancer (Mar 23)
- Re: How to choose an IDS/FW MSS provider fuijdancer (Mar 23)
- Re: How to choose an IDS/FW MSS provider fuijdancer (Mar 24)