Printable View
I have a client who wants a 24/7 managed ids system and i was wondering if you guys know of any particual companys who do this type of service.
If found a handfull but none are true 24/7 monitering, these guys want some one watching their network at any given time.
luckly they have the financial backing to afford 60-150K a year for this service.
So Any ideas would be helpfull thanks.
Verizon does it out here where I live. There is also LEI, but I've never used them. I think the "buzzword" for this type of service these days is called MSM or managed security monitoring. I remember reading an article with all the pros and cons @ Sans.
Hrmm.. hell for 150K a year.. I'll move my company from Computer Sales to IDS Monitoring for yas..
It's actually an MSSP, Managed Security Service Provider. Redsiren is one to the best They do 24/7 IDS and firewall monitonring and managing on multiple platforms. Check it out.
http://www.redsiren.com/
hell, for 60k a year i'll do it...
Hrmm... we're talking US Funds eh...
I'll do it for 50K
Haha, if you guys will sit in front of a computer for 24/7 days a week im sure they will pay you 150 K. The thought had crossed my mind to do it to ...........
Cool Links Ive got some price quotes and just to inform you guys it seems to cost around 2Gs a month.
Qualys can do this. I do not know what their prices are but here is their website...
http://www.qualys.com
http://www.secureworks.com/
Does exactly what your asking for.
Cool guys thanks alot for all the links
ISS also provides a managed service for this both directly as well as through resellers. I would guess they have broad geographical coverage and high quality of service though we do not use them. It sounds like your client has a healthy budget and may be interested in top-tier service.
http://www.iss.net/products_services..._intrusion.php
I would be interested to hear the results of your search and what interesting lessons came to light about this area as I am going to be looking into the same issue soon.
Good Luck!
I have been researching SecureWorks a little myself. They do 24/7 managed IPS as opposed to IDS. They claim to have pioneered IPS. Here is a quote from their site:
Rather than simply monitoring and alerting when an intrusion is detected, their IPS allows you to specify countermeasures like blocking specific IP addresses or ports. It does this automatically and proactively rather than waiting for the admin to receive an alert and manually implement mitigation.Quote:
Process: The SecureWorks method of encoding attack signatures is unique, and the process is patent-pending. Our approach dramatically reduces false-positive alerts, allows legitimate network traffic to flow unabated, and launches very specific countermeasures against very specific exploits rather than deploying broad or poorly defined attack signatures
It seems interesting and I am trying to gather more info and see if IPS is all its cracked up to be or if its just a nice buzzword for IDS on steroids.
Tony- In my opinion IPS is the same thing as IDS... And there are other companies, and have been other companies in the past that provide this type of service. Pilot network services was a company that a good friend of mine worked for. They went out of business because of poor management, but they had a system that was an IDS as well as what this company is calling an IPS. In that if the IDS saw that there was x number of alarms coming in from a specific IP, it would send the appropriate commands to the firewall router to block that IP.
I recently worked on a job where we used ISS and NetIQ to accomplish the same thing. Not really groundbreaking, but a good way to do things.