Re: Firewalls/Internet Security - TNG

[Ted Doty <ted () iss net>]

At 07:43 PM 12/1/97 GMT, Edward Cracknell wrote:
> So, firewall development is slowing/stopped. Intrusion detection is the
> future.....then where?

Biggest problem I see is that, for better or worse, the vast majority of
organizations really just want a silver bullet to make the bad guys stop.
Firewalls and IDS are both geared at stopping malicious activity - as such,
they qualify as appropriate silver bullets.  A tool that patched security
holes in all your hosts would be geared at avoiding malicious activity, and
so it would also qualify.

Note that all of these technologies are basically providing cost avoidance,
by letting smaller staffs run better security.

[snip]

> What I explicitly mean by this is a VERY trusted third party receiving
> and responding to alerts via a secure link to the internal LAN. Customer
> worries like keeping up to date, knowing what is an intrusion pattern
> etc. are removed. The customer has a 'team' of experts for the price
> (annual fee) of one guy/gal.

Many large organizations I've spoken to have problems with this; while
they're perfectly willing to outsource much of their operations, they want
to keep security management in-house.

> Surely this approach has real merit to all involved? Especially the
> customer.

For large classes of customers - mid sized companies, for example, it's
really the only option; they simply can't afford to do it themselves.
Again, the primary issue to the customer is almost always cost avoidance.


- Ted

--------------------------------------------------------------
Ted Doty, Internet Security Systems | Phone: +1 770 395 0150
41 Perimeter Center East            | Fax:   +1 770 395 1972
Atlanta, GA 30346  USA              | Web: http://www.iss.net
--------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE