Re: ROI on IDS/IPS products

[Joel M Snyder <Joel.Snyder () Opus1 COM>]

Webmaster 003 wrote:
> I think the easiest way would be to buy a device with a consulting 
> company doing the backend stuff.  Then the "user" can stay fat and 
> happy, with a set monthly cost.  

In my opinion, and in my experience, this doesn't work.  Or, more importantly, 
it works for people who want to have an IPS/IDS, but don't actually care what it 
says.

The reason is simple: the "hard work" of an IPS/IDS is putting the alerts in 
context to your own network.

If you go to a MSSP, they are very good at understanding what "smtp: attempted 
command buffer overflow" means.  However, they have no concept of what it means 
TO YOU.  They don't know if you're patched.  They don't know if that server is 
vulnerable.  And they don't know the relative value of that server to you.  They 
also don't have access to the server, so they can't easily check things like 
patch levels, tripwire logs, etc.

If you consider that operating an IPS/IDS is half knowing network security, and 
half knowing your network, the problem is that an MSSP only knows half of what 
they should.

Yes, I'm sure lots of MSSPs will pass this around, outraged at my suggestion 
that they aren't doing people much good.

But my experience is that most people with MSSP-monitored IDS/IPS only get 
alerted for the absolute most egregious horrible problems; they do NOT get a 
continuous security improvement program that will help them avoid such problems.

The IPS/IDS is NOT an intrusion prevention tool; it is a network security 
visibility and risk management tool.  Someone who sticks an IPS at the edge of 
their network expecting that this will somehow help them from being cracked into 
is going to be spending a LOT of money for little benefit; they have read waaaay 
too many white papers by vendors trying to sell IPS and waaaay too little 
information about what it means to secure a network.

I am fond of saying that an IPS/IDS is a protocol analyzer for the security 
team, much as a Sniffer or Ethereal box is a protocol analyzer for the network 
team.  If you use it as such to continuously identify and mitigate risks in your 
network, you'll get value.

If you treat it as a refrigerator, then you don't understand (or, more likely, 
have been misled) what an IPS/IDS does and where it brings value.  If you ONLY 
want to treat it as a refrigerator, then you're better off doing something else 
with your dollars.

jms

--
Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719
Senior Partner, Opus One       Phone: +1 520 324 0494
jms () Opus1 COM                http://www.opus1.com/jms