At 11:10 AM 8/22/00 -0500, [EMAIL PROTECTED] wrote:
> I have had the same questions about these services as well. Some
>other questions I have is who are they hiring and what are their skillsets.
>We all know how tight the job market is right now and I suspect they are
>hiring new people right out of college who are just taught how to run some
>tools. I would like to see an example of the kind of report they give you.
I don't know what type of reports are provided by these type of
services. There are several startup type firms doing this, offering a
online security service or profiling service (options), Some services
stated ok, please list the type of applications and operating system you
have, and we will assemble a list of vulnerabilities, exploits, patches
that apply.
>Are they just running ISS scanner having it create a fancy little report
>and throwing the top ten SANS vulnerabilities at the bottom? Granted, they
>at least save me the time of running the scan myself but how much is that
>worth?
My first impression is that it is more than just running ISS, Cybercop or
Axent ESM, but more of a profiling (NMAP) type approach anf go from their,
but I don't know, that is why I am asking the question
> Are the people hired by these companies capable of doing some
>in-depth analysis of my network or are they just starting out in network
>security? My fear is that these companies will hire less qualified people
>because that will increase their profit margin and I will not be getting
>the service I need.
I am very confused on how these type of service oriented offerings collect
their information, validate it, and ensure that the information is actually
applicable to a given organization.
>I started out working for a firewall vendor and I
>remember how woefully inexperienced I was. At least it only took me two
>months to learn everything there is to know about network security;-)
> Regardless of how they store the information on your network there
>still needs to be some access granted. A company like this would have to
>have a pretty stringent hiring process and background check at the minimum
>as well as good logging of who accesses client company information. I
>suspect that they could be held liable if information they have on your
>network is used to break into your network. I thought NetworkICE offered
>those type of services as well as their Intrusion Detection products. If
>not it would be a good field for you guys to get into. You could progress
>from vendor support to installs to intrusion detection consulting. A good
>way to capitolize on existing talent.
It does matter how the information is stored, there is a lot of liability
regarding what information can be deemed confidential, restricted
etc. Particular if a government agency is turning the information over to
an online security service.
This thread is not to promote Network ICE products or it's service, but
this thread is a general inquiry on the value of online security service
type companies that was mentioned in Wired a month or two ago.
/mark
>Regards,
>Jeffery Gieser
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
