Friday, April 29, 2005

Sources of Free Security Market Research

This morning I was looking for security market research and I came across two useful resources. First, CSO Online provides an Analyst Report section with summaries of research by all of the big name firms. For example, you can read about Symantec Gains Added Vendor Neutrality with New IPS Support by Current Analysis or Deciphering the Dual Meaning of Compliance Monitoring by Forrester. These are not the full articles, but there is enough there to make for interesting reading.

I also found some good press releases on security research from Infonetics Research. These include:

The last article's chart is revealing. It appears in-line "IPS" platforms are set to have a greater revenue share in 2005 than network IDS for the first time. I am not finding this surprising. When I looked this morning to find the "leading" IDS or IPS solutions, I created this list:

What would you add to this list? If you were to take a next-generation course on IDS/IPS and network security monitoring, what products would you want to try, hands-on, in the class?


Anonymous said...

add radware, arbor, mazu, toplayer, and captus to the list.

personally, i prefer the cisco guard xt 5650. without the budget, i'd go for snort_inline. teach kids snort; teach pros cisco guard.

it often occurs to me that IDS/IPS products are not network-focused enough. arbor comes close, but again, i think it's too security-focused.

i usually distinguish secops vs. netops where the highest escalation point is CERT or PERT (performance) respectively. it is often that what appears to be a security problem is really a network problem or vice-versa. IPS is simply solving security problems at the network-layer. but i think there is more to the network-layer than packet sanitization.

take, for example, security policies that block all ICMP in all directions. i'm sure there are definite positive network performance reasons to have at least some unreachables coming into and out of a network.

personally, i'd rather spend the money on an internap fcp than any of the products you mentioned. so, my question is - where does network optimization fit into the IDS/IPS world?

charlesjsmith said...

I would say that wireless intrusion prevention and detection might be of interest. If you want a specific vendor, Aruba Networks would be the one. Their 5000 switch is tremendous (in feature set).

Richard Bejtlich said...

Anonymous -- you are talking about different issues here. When you say "teach kids snort; teach pros cisco guard" you are comparing apples and oranges. Your Cisco Guard is an anti-DDOS platform. Snort is a monitoring platform. I don't see your Cisco Guard catching intruders and I don't see Snort mitigating DDOS attacks.

A wise person explained to me that the enterprise network "stool" is built on three legs: security, performance, and fault management. Remove any one of those legs and the stool topples. You need to manage all three aspects, but you don't need a single product for all three.

We may have integrated appliances that handle all three functions one day, but we're not there yet. I'm not sure we need to go there anyway. Just being aware of all three areas is sufficient.