RE: Low cost HID based IDS system

["Schmehl, Paul L" <pauls () utdallas edu>]

Nothing in life is free.  Everything has a cost associated with it.  For
example, while he may be able to provide a similar service for much less
money, what happens if he misses an attack that devastates one of his
customer's networks?  Will he indemnify them?  Will they sue him and
destroy *his* business in the process?  Is he going to be watching the
IDS 24/7 like an MSSP would?  Is he knowledgeable enough of IDS to
provide the same level of service to them that an MSSP would?  Does he
have the resources?

Everything has a cost.  Sometimes the cost doesn't show up until you've
already realized the decision you made was flawed.  What's the value of
the business lost while your network is down?

I just don't think it makes good business sense to cut corners on
security to save a few dollars.  In the end, you'll regret it.  ISTM he
would serve his customers better by negotiating a reasonable rate for
the services of an MSSP *through* his company to each of his customers.
With his higher bargaining power, he has the opportunity to provide them
with real value at a reasonable cost that is much less than what they
might be able to negotiate on their own.  Especially now, when security
companies are scrambling to find revenue.

In the final analysis the question he needs to answer is; is he trying
to provide his customers with true value for their dollars?  Or just
throw together something cheap that will make them feel safer but won't
really make them any more secure?

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/



-----Original Message-----
From: Alan Shimel [mailto:alan () latis com] 
Sent: Friday, May 16, 2003 10:00 PM
To: Schmehl, Paul L; Zach Forsyth; Focus-Ids
Subject: RE: Low cost HID based IDS system


There are tools out there that would allow him to provide these services
to customers at substantially below some of the MSSPs you mentioned
charged.  I think it is possible to provide this service sub-1000
dollars a month

-------------------------------------------------------------------------------
INTRUSION PREVENTION: READY FOR PRIME TIME?

IntruShield now offers unprecedented Intrusion IntelligenceTM capabilities
- including intrusion identification, relevancy, direction, impact and analysis
- enabling a path to prevention.

Download the latest white paper "Intrusion Prevention: Myths, Challenges, and Requirements" at:
http://www.securityfocus.com/IntruVert-focus-ids2
-------------------------------------------------------------------------------