Re: How to choose an IDS/FW MSS provider

[Martin Roesch <roesch () sourcefire com>]

On Mar 16, 2005, at 4:59 PM, Mark Teicher wrote:
> > > I tend to disagree on this, since there are more than ways to detect 
> > > an exploit or how to discuss how and why things work when they do.  
> > > The transparency issue is mute if the product is well constructed 
> > > and doesn't shake apart when folded, binded or crumpled.  There is a 
> > > certain level of comfort that if something doesn't work right, one 
> > > can work it on themselves, but if can compare this if I pay $xxx,xxx 
> > > for fancy and very fast car. If it breaks under normal operating 
> > > circumstances, Otto the mechanic better fix it for free.  Same issue 
> > > can be applied to the openness, if it breaks, it might not always 
> > > get fixed right away since Otto isn't specifically assigned to it, 
> > > or other wanna be Otto's attempt to know how to fix it.  With the 
> > > commercial application, the fix may not be readily available or 
> > > until the number of days it is supposed to be released by the VRT :)

Support is a different issue all together.  There are many instances 
where people have received superior product support for open source 
code than for equivalent and many cases where they haven't.  It's like 
anything, it depends on the providers commitment to support the 
product.  It doesn't change whether people like or trust a product.  If 
it works well and you can see why it is or isn't doing its job in 
specific cases due to its nature as an open system then in many cases 
that bolsters trust.  If it's a black box and it just always does a 
good job then people don't question it, but if it ever screws up then 
people are going to want to know why and your black box is going to be 
far less appreciated (and IDS could be said to frequently be a 
candidate for the latter scenario).

     -Marty

--
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Discover.  Determine.  Defend. - http://www.sourcefire.com
Snort: Open Source Intrusion Detection and Prevention - 
http://www.snort.org


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------