In my opinion, the best way to sell IDS is on the
number of real, actionable alerts you receive. Get in
a vendor's demo appliance or software, tune it to
filter out the noise, and deliver a list of alerts
that were not otherwise detected to your boss. You'd
be amazed how much stuff you'll find, especially at
first. Policy violations, spyware, even compromized
machines often go otherwise unnoticed.
There are methods to calculate the ROI of an IDS
system, but in my experience the above was all that
was necessary.
As far as monitoring, remove as much noise as
possible. If you recieve 100+ alerts a day, the
important ones will slip by unnoticed. Event
correlation, security context, and tuning can reduce
the volume of actionable alerts. Look for IDS
products that have this built in, or buy a SIM too.
- Chris
--- Jason Patel <patel1210@yahoo.com> wrote:
I was wondering how big companies CIO show their
executives Return of investment on IDS. What is the
monitoring strategy for IDS alerts. I am trying to
figure monitoring strategy and how to show my
executive that how important job this is, but cant
come up with a convincing solution. Anyhelp is
highly appreciated.
Thanks,
Jason
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with
real-world attacks from
CORE IMPACT.
Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
__________________________________
Do you Yahoo!?
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
