Managed Intrusion Detection and Security Monitoring

Is there a big difference between Managed IDS and Managed Security Monitoring? One factor can be span: Counterpane's solution is designed to be security product independent, drawing events from a wider variety of sources. Another factor can be human expertise—do you want raw IDS notifications or in-depth event analysis? According to Vigilante's Reavis, "Both are active systems, looking for any sense of breach, centrally consolidating/correlating and notifying you. The difference is the technology they use. The value proposition and what they're trying to do are really pretty similar."

Automated intrusion response is a point of contention. Anyone who has used an IDS, even briefly, knows the importance of event correlation - and just how many "root cause" alerts still require human analysis. Given this, is it really a good idea to launch automated remedies? Keybridge doesn't think so; they warned, "Automated intrusion response creates additional security risks." Several other providers stressed customer involvement in creating an incident response plan, whether automated or not. As one provider put it: "The customer defines the security policy; [we] enforce it."

Managed Anti-Virus
These services may scan packets flowing through firewalls or deflect packets to an AV server. Some offerings scan e-mail and potentially infected attachments. Managed Anti-Virus Services include more than shrink-wrapped software—providers are responsible for installation, configuration, reporting, and regular updates. The platform may be a Managed Firewall, an appliance like the Nokia AV-445, or a provider-hosted AV server (below).

Managed content filtering and URL blocking
Managed Content Filtering Services typically allow or deny Web traffic based on destination (URL) or payload (Java, ActiveX). Subscriptions are typically sold as a firewall add-ons, but we found two providers offering this as a standalone service. WebSense is the platform of choice for many of those surveyed; the website database used to filter by category can often be updated daily.