Intrusion Detection Software

[ccrowell]

Looking for recommendations on intrusion detection software. I'm an administrator at an auto dealership and we have a lot if information ro protect. I've heard good things about Snort (doesn't hurt that it's free, either), but I have some concerns about ease of installing and using. Does anyone have any recommendations and a relatively inexpensive IDS that is somewhat easy to operate?

[owen]

It entirely depends on your budget and how much work you are willing to do to mitigate costs. One inexpensive solution out-of-the box is one of several IDS devices available for about $3500- $5000. DELL sells an appliance which appears to be a DELL server with Snort installed for about $5,000. If you are not particularly intimidated by this document:
http://www.snort.org/docs/snort_acid_rh9.pdf
then you can save yourself $2500+ by putting it together yourself. There is another way as well -- you can find a company that is good with Linux that will build you a machine configured with Snort for around $2000. Hope this helps.

[pcassell]

Snort is a good selection and serves its purpose very well. Many snort signatures are posted less than a day after a major worm comes out (ex sasser). However, the ease of use might be something to watch here. Its not the easiest thing to setup and use.

There are also other issues to look at. If you are trying to protect your data, an intrusion detection system is only one component of security. Remember, an IDS is mainly for detecting intrusions. Protecting your data involves many more applications and solutions.

A firewall is one of the most basic but one of the best defenses you can have, from both internal (LAN) and external (internet) intruders.

Patching your systems and keeping them up to date is another basic, low cost, but critical function of security.

Another thing to look at is the applications and actual network structure your running.

There are many factors to security, and an intrusion detection system is not the only solution, however it is good.

[johnsje]

I am a reseller for Contego 2.0 which is an intrusion detection system among many other features. Please checkout there website and see if it would meet your needs. Feel free to contact me if you are interested.

http://www.trigeo.com/