From: M. Morgan (mikemorganmindspring.com)
Date: Thu Jan 29 2004 - 09:25:07 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I'm trying to come up with a cost/benefit analysis of running Snort in a network, in general terms?

Can you add anything that you see is missing or wrong?

A.      COSTS:
        I would guess costs are mostly in Human time (FTE) functions:

        -Installation, configuration
        -Locking down/securing the boxes' processes (i.e.: Bastille scripts, etc)
        -Patching
        -Monitoring snort logs to determine legitimate alerts
        -Adding, changing fine tuning filter rules
        -Ideally a 24/7 operation requiring HOW MANY FTEs per shift?  What does the number of FTEs depend upon?
        -What is the "cost" of having only one shift covered?

        But also hardware and software costs:

        -Dedicated PCs (how many?) 
        -Operating system and Support agreements for the OS
        -Network bandwidth (how do you address questions of how much network speed is affected by Snort boxes?)

# How do you scale?
# The book: "Snort 2.0 Intrusion Detection" discusses different architectures but doesn’t give any kind of Rule of Thumb for number of boxes per architecture.  Yes, I know it depends upon the processor, RAM and BUS speed, etc…but beyond that, how do you define?

# Would it be safe to say that once you see that you are dropping packets you need to add another box?  Is it just trial and error ONLY?

B.      BENEFITS:

        -They can alert you to the presence of attacks (internal and external) the majority of attacks occur, knowingly or unknowingly, from within the network)

        -Identifies vulnerabilities and weaknesses in the perimeter protection devices: firewalls and routers
        -"What you don’t know CAN hurt you"
        -Preventative knowledge: IDSs can alert you to reconnaissance scanning in your network which can alert you to impending attacks

        -Helps enforce security policies
        -Great sources of forensic evidence
        -Inline IDSs can halt active attacks on your network
        -Rounds out an overall security model

Can you add anything or correct me?

Thanks,

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]