RE: How to measure 'status' of IDS Deployment

From: Alan Shimel (alan@latis.com)
Date: 08/23/02 

Date: Fri, 23 Aug 2002 12:32:10 -0600
From: "Alan Shimel" <alan@latis.com>
To: "Kohlenberg, Toby" <toby.kohlenberg@intel.com>, <idsquestions@hushmail.com>, <focus-ids@securityfocus.com>

We have worked up a pretty cool ROI calculator that we use in our sales
process here. If anyone is interested write back and I can send it to
you.

Thanks
alan

Alan Shimel, VP Sales & Business Development
Latis Networks, ashimel@latis.com
Ph. 303 642-4515 Cell 516 857-7409
 
 The information transmitted is intended only for the person or entity
to which it is addressed and may contain confidential and/or privileged
material. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you
received this in error, please contact the sender and delete the
material from any computer.

-----Original Message-----
From: Kohlenberg, Toby [mailto:toby.kohlenberg@intel.com]
Sent: Friday, August 23, 2002 11:37 AM
To: 'idsquestions@hushmail.com'; focus-ids@securityfocus.com
Subject: RE: How to measure 'status' of IDS Deployment

The comparing to other companies can be hard- getting most companies to
actually talk in detail about what they are doing is damn hard. I
believe
Gartner has a forum that you can pay a lot to join to be able to ask
other
companies about this sort of thing under NDA but other than that you are
stuck doing lots of public research.

For the ROI question, that I can offer a little more help with. I'm
attaching
a paper I wrote as part of my SANS GCIAA practical on making a business
case
for IDS. It might help you with that.

All opinions are my own and in no way reflect the views of my employer

Toby

> -----Original Message-----
> From: idsquestions@hushmail.com [mailto:idsquestions@hushmail.com]
> Sent: Friday, August 23, 2002 9:23 AM
> To: focus-ids@securityfocus.com
> Subject: How to measure 'status' of IDS Deployment
>
>
>
> I have been tasked with comparing my IDS deployment at work
> to determine if it is 'world class'/'best in class' quality'.
> This is rather vague as it is hard to quantify and compare
> placement issues and success. I wonder how others are
> approaching this? This more than 'we saw 500,000 things this
> week and 100 were real things we investigated'..
>
> How do you, perhaps as a ROI issue, justify the money spent
> and compare your deployment to established(?) benchmarks?
>
> -Bob
>
>
>
> Get your free encrypted email at https://www.hushmail.com
>