IDS: Re: Value of IDS, ROI

[Chris Byrd <cbyrd01 () yahoo com>]

In my opinion, the best way to sell IDS is on the
number of real, actionable alerts you receive.  Get in
a vendor's demo appliance or software, tune it to
filter out the noise, and deliver a list of alerts
that were not otherwise detected to your boss.  You'd
be amazed how much stuff you'll find, especially at
first.  Policy violations, spyware, even compromized
machines often go otherwise unnoticed.

There are methods to calculate the ROI of an IDS
system, but in my experience the above was all that
was necessary.

As far as monitoring, remove as much noise as
possible.   If you recieve 100+ alerts a day, the
important ones will slip by unnoticed.  Event
correlation, security context, and tuning can reduce
the volume of actionable alerts.  Look for IDS
products that have this built in, or buy a SIM too.

- Chris
--- Jason Patel <patel1210 () yahoo com> wrote:
> I was wondering how big companies CIO show their
> executives Return of investment on IDS. What is the
> monitoring strategy for IDS alerts. I am trying to
> figure monitoring strategy and how to show my
> executive that how important job this is, but cant
> come up with a convincing solution. Anyhelp is
> highly appreciated. 
>
> Thanks,
>
> Jason
--------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with
> real-world attacks from 
> CORE IMPACT.
> Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
--------------------------------------------------------------------------
>

                
__________________________________ 
Do you Yahoo!? 
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/ 

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------