RE: Value of IDS, ROI

[THolman () toplayer com]

Hi Jason,

This is one of the big problems with IDS.  Being detection-based technology,
IDS is only capable of detecting intrusions\worm\virus outbreaks, rather
than PREVENTING them.
What is the ROI of a detection-based system that alerts you to the fact
you're completely overrun by worm activity?  Absolutely nothing.  In fact,
if you are relying on IDS to protect you, you will face a negative ROI, as
by the time a zero-day attack gets past it, you will be losing money, even
more so if you've an online presence to protect.
Your CIO should ultimately be concerned in preventing attacks, rather than
detecting them, and you should steer his/her investments toward a good IPS
to compliment (and protect) existing IDS technology, and in some cases, do
away with IDS devices altogether, as they are simply not relevant in terms
of protection.

Regards,

Tim


-----Original Message-----
From: Jason Patel [mailto:patel1210 () yahoo com] 
Sent: 03 May 2005 19:15
To: focus-ids () securityfocus com
Subject: Value of IDS, ROI



I was wondering how big companies CIO show their executives Return of
investment on IDS. What is the monitoring strategy for IDS alerts. I am
trying to figure monitoring strategy and how to show my executive that how
important job this is, but cant come up with a convincing solution. Anyhelp
is highly appreciated. 

Thanks,

Jason

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------