Sources of Free Security Market Research
This morning I was looking for security market research and I came across two useful resources. First, CSO Online provides an Analyst Report section with summaries of research by all of the big name firms. For example, you can read about Symantec Gains Added Vendor Neutrality with New IPS Support by Current Analysis or Deciphering the Dual Meaning of Compliance Monitoring by Forrester. These are not the full articles, but there is enough there to make for interesting reading.
I also found some good press releases on security research from Infonetics Research. These include:
The last article's chart is revealing. It appears in-line "IPS" platforms are set to have a greater revenue share in 2005 than network IDS for the first time. I am not finding this surprising. When I looked this morning to find the "leading" IDS or IPS solutions, I created this list:
What would you add to this list? If you were to take a next-generation course on IDS/IPS and network security monitoring, what products would you want to try, hands-on, in the class?
I also found some good press releases on security research from Infonetics Research. These include:
- Growing IP/MPLS Investments Planned as
Carriers Transform Their Data Networks - Service Providers Banking on Integrated Security Services
- Network Security Market Up 30% to $3.7B in 2004
- Large Companies Lose 2%–16% of Annual Revenue to Network Downtime; Finance and Manufacturing Bleeding the Most
- ISS and Cisco Tie for Lead in IDS/IPS Market, Prevention Drives Market Growth
The last article's chart is revealing. It appears in-line "IPS" platforms are set to have a greater revenue share in 2005 than network IDS for the first time. I am not finding this surprising. When I looked this morning to find the "leading" IDS or IPS solutions, I created this list:
- Cisco 4200 Series IPS, which appears to have replaced the Cisco Secure IDS
- ISS Proventia IPS
- 3Com's TippingPoint, which is a leader according to this recent press release
- McAfee Intrushield Network IPS
- Sourcefire, which just integrated IPS via snort_inline
What would you add to this list? If you were to take a next-generation course on IDS/IPS and network security monitoring, what products would you want to try, hands-on, in the class?
Comments
personally, i prefer the cisco guard xt 5650. without the budget, i'd go for snort_inline. teach kids snort; teach pros cisco guard.
it often occurs to me that IDS/IPS products are not network-focused enough. arbor comes close, but again, i think it's too security-focused.
i usually distinguish secops vs. netops where the highest escalation point is CERT or PERT (performance) respectively. it is often that what appears to be a security problem is really a network problem or vice-versa. IPS is simply solving security problems at the network-layer. but i think there is more to the network-layer than packet sanitization.
take, for example, security policies that block all ICMP in all directions. i'm sure there are definite positive network performance reasons to have at least some unreachables coming into and out of a network.
personally, i'd rather spend the money on an internap fcp than any of the products you mentioned. so, my question is - where does network optimization fit into the IDS/IPS world?
A wise person explained to me that the enterprise network "stool" is built on three legs: security, performance, and fault management. Remove any one of those legs and the stool topples. You need to manage all three aspects, but you don't need a single product for all three.
We may have integrated appliances that handle all three functions one day, but we're not there yet. I'm not sure we need to go there anyway. Just being aware of all three areas is sufficient.