Equant offers managed IDS

Network operator Equant NV said Tuesday that it is adding a managed intrusion detection service to its portfolio of security services.

Equant Intrusion Detection will use Cisco Systems Inc. IDS 4250 sensors to monitor customer traffic flow in real time, recording attacks and correlating alerts from various sensors, according to Steve Maslin, security product manager at Equant, which is based in Amsterdam.

When incidents are detected, Equant will provide customers with advice on incident handling and intervention, the company said.

In the area of security device management, Equant will oversee signature and software updates, store IDS (intrusion detection system) information and issue detailed reports on intrusions along with recommended fixes, according to Equant.

Equant is partnering with Ubizen NV to provide security event monitoring component of the intrusion detection service, Maslin said.

Consultants in Ubizen's security operations centers (SOCs) will use that company's proprietary State and Event Analysis Machine technology to weed out security events from a steady stream of IDS alerts. Ubizen consultants will then provide Equant Intrusion Detection customers advice on remediating security events using configuration changes or other remedies, Equant said.

The goal is to lower the cost ownership of IDS for enterprises that are interested in deploying an IDS service without sacrificing the "intelligent response" capabilities that come from security analysts reviewing the output from IDS sensors, Maslin said.

That will set the service apart from IPS or intrusion prevention services that rely mostly on automated responses, he said.

Service level agreements (SLAs) ensure a high level of service for the managed IDS customers, mandating response to the customer regarding intrusions within 40 minutes, Maslin said. Equant hopes to reduce the response time as the program matures, Maslin said.

By comparison, competitors such as MSSP (managed security services provider) Guardent Inc. of Waltham, Massachusetts, issue SLAs to customers promising notification within 15 minutes of identifying a security issue according to Jonas Hellgren, vice president of operations at Guardent.

As with other managed security service companies, Equant will offer a customer Web portal that provides event tracking, query management and report features, Maslin said.

Equant will also store up to 12 months of forensic data for use by the customer, he said.

Equant already offers a Secure Gateway service that includes managed firewall with antivirus and URL (Uniform Resource Locator) filtering capabilities, a Secure Authentication service that provides remote user authentication services for customer Web sites, and security consulting services, according to Equant.

After entering the managed security services business less than five years ago, Equant now manages 1,200 security devices such as firewalls and gateways at customer premises and does between US$30 million and $40 million in security services business annually, according to Peter Glock, head of security products at Equant.

Typical customers have networks with between 20 and 30 locations under management. Equant also manages much larger networks with between 200 and 300 separate locations, Glock said.

Equant is hoping its breadth of service both inside and outside of the security area and its solid IP (Internet protocol) infrastructure will attract companies looking to outsource, but have broader needs than can be met by MSSPs, Glock said.

Organizations interested in outsourcing security work to Equant are typically bundling those services with other outsourced IP networking business or are looking to extend their existing network capability, for example: banks that hoping to expand their electronic banking services into new markets, he said.

Compared with MSSPs like Guardent, Foundstone Inc, and Qualys Inc., Equant can offer comprehensive SLAs covering security and non-security managed services with a single point of contact, he said.

Equant Intrusion Detection is available immediately to customers worldwide, Equant said.

Pricing for Equant Intrusion Detection varies depending on the size of the IDS deployment, but includes both a one-time start-up charge that covers consulting fees, account setup and device setup as well as monthly charges, according to Equant.

While many companies remain wary of managed security services, there are still enough that are comfortable with the idea to make an attractive market for companies like Equant, said analyst Pete Lindstrom of Spire Security LLC in Malvern, Pennsylvania.

However, while managed firewall and antivirus services are established practice at many companies, managed IDS presents new and formidable challenges to MSSP providers, Lindstrom said.

"Companies should consider the outsourcing route because of level of expertise required, but they should also figure that into their pricing," he said. "There's a big difference between a managed firewall and antivirus service and managed IDS."

In particular, a lack of reliable benchmarks to build SLAs upon means that companies like Equant may find themselves locked into a "nebulous" and unprofitable service, he said.

"The bottom line is, we have no benchmarks -- no metrics or solid data to go on," Lindstrom said.

Questions about how many events and high-priority alerts to expect from a typical deployment, and how many security professionals to devote to problems need to be answered and figured into pricing for the service, he said.

In theory, however, managed security services governed by iron-clad SLAs could have a beneficial effect for businesses, guaranteeing that a company's security policy is followed to the letter when events arise, Lindstrom said.

ITWorld DealPost: The best in tech deals and discounts.
Shop Tech Products at Amazon