OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Gigabit IDS solutions
From: Ron Gula (rgulaNETWORK-DEFENSE.COM)
Date: Wed Nov 15 2000 - 09:59:33 CST

At 10:37 AM 11/14/00 -0800, "Teicher, Mark" wrote:
>Performance should only be one of the factors in choosing the correct
>Intrusion Detection package for one's networked environment.

As well should cost. Quoting from the NetworkICE home page,

"GigaSentry is at least 10 times the price of standard Sentry."

This is interesting since most NetworkICE folks I heard at the
CSI show were touting a 300 Mb/s perfance rate. I don't understand
why someone would pay 10x price for 3x the performance.

>Easy to configure

Two sides to this coin - do you want simple point and click GUIs or
a mountain of configuration options.

>Easy to deploy

All sorts of debates on this one. IDS is still a network retrofit
no matter how you slice it.

>Easy to manage

Again, lots of debates on this one. Unless a customer has the
appropriate staff to manage alerts, running an enterprise IDS
is anything but easy.

>Can easily protect remote users as well as LAN/WAN users

Good point. This is a weak link in many IDS offerings. One counter
to this statement would be placing a NIDS behind a VPN decryptor.
That solution has less impact on the remote road warrior and is
a lot easier to manage.

>Designed for scaleability

Again ... debatable. Measuring scalability is difficult to do.

>Doesn't use a bar code in it's logo..:)

Looks like NFR got a new logo. At least their booth at CSI had
a fresh look.

>Vendor's name and product name doesn't change name every 6 or 8 months.

Not sure what you are concerned about here or how this effects the
quality of a product.

Ron Gula
VP IDS Products
Enterasys Networks
http://www.enterasys.com
http://www.securitywizards.com