Re: ROI on stateful and deep-packet-inspection firewalls

[Seth Hall <seth () ICIR ORG>]

On Jan 31, 2012, at 4:16 PM, Andrew Daviel wrote:

> Do you see a big dropoff in downtime and trouble tickets, or extra work creating and tuning rules ?

I would love to see the answers to this question in particular.  My expectation is that downtime increases (solely due 
to increased inline complexity), trouble tickets remain fairly stable, and there is almost certainly going to be 
considerable time spent tuning rules but that's completely unavoidable.

For anyone that knows me I certainly can't pretend to not be biased, but a suggestion that I tend to give people with 
these questions is to pay attention to the benefits that the money you spend would provide you.  Would your security 
analysts (incident hunters!) be able to understand the network better?  Would they be able to respond to problems more 
quickly?  Would it become a tool in their toolbox or would it become a box of magic?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/