I also found some good press releases on security research from Infonetics Research. These include:
- Growing IP/MPLS Investments Planned as
Carriers Transform Their Data Networks - Service Providers Banking on Integrated Security Services
- Network Security Market Up 30% to $3.7B in 2004
- Large Companies Lose 2%–16% of Annual Revenue to Network Downtime; Finance and Manufacturing Bleeding the Most
- ISS and Cisco Tie for Lead in IDS/IPS Market, Prevention Drives Market Growth
The last article's chart is revealing. It appears in-line "IPS" platforms are set to have a greater revenue share in 2005 than network IDS for the first time. I am not finding this surprising. When I looked this morning to find the "leading" IDS or IPS solutions, I created this list:
- Cisco 4200 Series IPS, which appears to have replaced the Cisco Secure IDS
- ISS Proventia IPS
- 3Com's TippingPoint, which is a leader according to this recent press release
- McAfee Intrushield Network IPS
- Sourcefire, which just integrated IPS via snort_inline
What would you add to this list? If you were to take a next-generation course on IDS/IPS and network security monitoring, what products would you want to try, hands-on, in the class?
3 comments:
add radware, arbor, mazu, toplayer, and captus to the list.
personally, i prefer the cisco guard xt 5650. without the budget, i'd go for snort_inline. teach kids snort; teach pros cisco guard.
it often occurs to me that IDS/IPS products are not network-focused enough. arbor comes close, but again, i think it's too security-focused.
i usually distinguish secops vs. netops where the highest escalation point is CERT or PERT (performance) respectively. it is often that what appears to be a security problem is really a network problem or vice-versa. IPS is simply solving security problems at the network-layer. but i think there is more to the network-layer than packet sanitization.
take, for example, security policies that block all ICMP in all directions. i'm sure there are definite positive network performance reasons to have at least some unreachables coming into and out of a network.
personally, i'd rather spend the money on an internap fcp than any of the products you mentioned. so, my question is - where does network optimization fit into the IDS/IPS world?
I would say that wireless intrusion prevention and detection might be of interest. If you want a specific vendor, Aruba Networks would be the one. Their 5000 switch is tremendous (in feature set).
Anonymous -- you are talking about different issues here. When you say "teach kids snort; teach pros cisco guard" you are comparing apples and oranges. Your Cisco Guard is an anti-DDOS platform. Snort is a monitoring platform. I don't see your Cisco Guard catching intruders and I don't see Snort mitigating DDOS attacks.
A wise person explained to me that the enterprise network "stool" is built on three legs: security, performance, and fault management. Remove any one of those legs and the stool topples. You need to manage all three aspects, but you don't need a single product for all three.
We may have integrated appliances that handle all three functions one day, but we're not there yet. I'm not sure we need to go there anyway. Just being aware of all three areas is sufficient.
Post a Comment