Re: Concerns with NFR

From: Andrew Plato (aplato@anitian.com)
Date: 06/23/02 

Date: 23 Jun 2002 19:14:06 -0000
From: Andrew Plato <aplato@anitian.com>
To: focus-ids@securityfocus.com
('binary' encoding is not supported, stored as-is) In-Reply-To: <008801c2196b$0d8f10b0$3201a8c0@horns>

>Say, I am looking into NFR for reselling additional IDS technologies.
>Like to get some feedback and had some concerns based on recent
>discussions with other security friends.

NFR's biggest problem is that, like Cisco and some other IDSs, they are
not investing much into improving their technology. You look at companies
like Recourse, ISS, or Entercept which are pouring a lot of new features
and technologies into their IDS. Cisco, Enterasys, and NFR just keep
adding bells and whistles. No real technical improvements.

>There is a rumor floating around that they are having financial bankruptcy
>problems and I usually do not trust rumors, but with a private company
>that does not disclose its financial status, it is hard to tell. Does
>anyone know if this is even remotely possible?

Sure. Enterasys is also having some severe financial problems. A lot of
companies are. Its a very tough market right now.

I am a reseller as well and you're correct - you need to be careful what
products you hang your hat on. At my company, we throughly test and use
products in real-world situations before we will consider reselling them.
For example, we tested NFR for quite a while. It simply was not as good as
RealSecure or even Snort. Hence, we don't resell it.
these issues?

>With too many IDS companies to choose from, I believe this market is going
>to consolidate and many of these players won't be around tomorrow. I'm
>trying to be picky in my selecting of IDS technology. If there is other
>IDS technologies that people would highly recommend, please let me know.

I agree, the market will consolidate. I've heard rumors that Cisco might
buy Recourse to get their protocol analysis-based IDS. I also heard that
Symantec might buy them. Entercept is ripe for acquisition. I would even
say SourceFire (commercial snort) is probably on a few big boys radar
screens. Who knows, maybe even ISS will get gobbled up by somebody big.

I used to work closely with Network ICE, back when they were a lone small
company. When ISS bought them, I figured it was the beginning of the end.
That ISS would just kill off all the BlackICE technology and wipe out
their resellers. As it turns out, ISS actually embraced BlackICE entirely
including resellers like me. As such, it turned out very good for me as a
reseller. I have a lot of very satisfied customers using RealSecure.

Good luck.

Andrew Plato
President / Principal Consultant
Anitian Corporation
www.anitian.com