Managed Security Services

Hi

My current client had an audit requirement to implement a IDS infrastructure
a while ago so did, along with an any-any-any allow firewall!  They did not
have the skills in house so outsourced this to a 3rd party.  This went fine,
until I came in and the first thing I did was to remove the any-any-any
allow, and start putting in a proper rulebase.

The thing is, the number of changes we now have to make to the firewalls
make the managed service seem pointless.  We are putting more than enough
work for at least one FTE their way and are paying for changes on an hourly
basis (expensive!)

Does anyone have any numbers available for when outsourcing a security
service is viable and when it should be done in house?

I know there are dozens of variables here, but the general question is how
static should your rulebase be before you outsource the management of it
(well the hardware software and support)?

Thanks



James