Re: How to choose an IDS/FW MSS provider

[Mark Teicher <mht3 () earthlink net>]

At 05:30 PM 3/17/2005, Martin Roesch wrote:

> Support is a different issue all together.  There are many instances where 
> people have received superior product support for open source code than 
> for equivalent and many cases where they haven't.  It's like anything, it 
> depends on the providers commitment to support the product.  It doesn't 
> change whether people like or trust a product.  If it works well and you 
> can see why it is or isn't doing its job in specific cases due to its 
> nature as an open system then in many cases that bolsters trust.  If it's 
> a black box and it just always does a good job then people don't question 
> it, but if it ever screws up then people are going to want to know why and 
> your black box is going to be far less appreciated (and IDS could be said 
> to frequently be a candidate for the latter scenario).
>
>      -Marty
>
> --
> Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
> Sourcefire - Discover.  Determine.  Defend. - http://www.sourcefire.com
> Snort: Open Source Intrusion Detection and Prevention - http://www.snort.org
Actually support for open source has always been questionable over the 
years, some projects have more a community support structure, but as we all 
know, support is somewhat to be desired.  Although one can place a fairly 
popular intrusion detection solution in this category, but what happens in 
10 years, will the focus of the community be on open source intrusion 
detection or something else, like a new and improved logging utility for 
example.  Black box, Crystal Box, it is all the same, each product and it's 
support should be measured for what it is worth and also the knowledge 
level that a particular IDS/FW MSS provider may or may not have.

/m 


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------