Re: Total Cost of Ownership for Snort Implementation?

[Bennett Todd <bet () rahul net>]

2003-06-18T01:45:44 Nicholas Brawn:
> [...] I've been approached to put together some information on the
> TCO of implementing Snort at 5-10 locations throughout our network
> (internal and perimeter).  We're going to be comparing this to the
> TCO for implementing a commercial solution.

That's enough boxes that I'd base the snort TCO estimate on
building and configuring boxes, deploying them, tuning them,
organizing alerting and/or reporting to meet your needs, and
updating sigs. Hardware costs are in the noise. How expensive is it?
Depends entirely on the skills you have available to build on. If
you have folks who are really good at configuring appliance-style
devices, automating their building and rebuilding, automating
distribution of config updates and collection of alerts, etc. then
snort can be an amazing winner.

If on the other hand you don't have folks who are experienced at
organizing an automated appliance build/maint process around open
source tools, then getting an appliance from a vendor is liable
to be a better value. Note that Snort is available on that basis
as well as do-it-yourself free open source. Sourcefire sells and
supports appliances built on Snort.

-Bennett

Attachment: _bin
Description: