RE: How does and IDS help to save money??

From: Kohlenberg, Toby (
Date: 04/15/02

From: "Kohlenberg, Toby" <>
To: "'Shripal Meghani'" <>,
Date: Mon, 15 Apr 2002 12:26:39 -0700

The findings below were a result of research I was asked to do by a
customer of mine and then generalized to be included as part of my
GCIA practical. I believe it is being added to the SANS reading room
but I don't know when. It might help answer some of your questions.
Comments and feedback are appreciated. Please do not quote or redistribute
without proper attribution.


Toby Kohlenberg, CISSP, GCIA, GCIH
Information Security Analyst
503-456-2302 Office & Voicemail
877-497-1696 Pager
"Just because you're paranoid, doesn't mean they're not after you."

PGP Fingerprint:
92E2 E2FC BB8B 98CD 88FA 01A1 6E09 B5BA 9E84 9E70

> -----Original Message-----
> From: Shripal Meghani []
> Sent: Sunday, April 14, 2002 11:34 PM
> To:
> Subject: How does and IDS help to save money??
> Hi all,
> My company (assume XYZ) is in the middle of taking
> some decisions regarding security measures in the
> organisation. We have seen some vendors' IDSes. But
> the question that keep hitting us is
> 1) how does one judge the value of an IDS in the
> network?
> 2) How does it help in saving money? (over say
> something like a firewall)
> 3) What is the ROI on purchasing an IDS
> 4) And what is the TCO for the same
> I would appreciate some figures... some money related
> discussions rather than technical details, etc (have
> seen enough of those). It should make some sense to
> the "white collars" :)
> ___________________________________________________________
> Sent by ePrompter, the premier email notification
> software.
> Free download at
> __________________________________________________
> Do You Yahoo!?
> Yahoo! Tax Center - online filing with TurboTax