Network operator Equant is adding a managed intrusion detection service to its portfolio of security services.
Equant Intrusion Detection will use Cisco Systems IDS 4250 sensors to monitor customer traffic flow in real time, recording attacks and correlating alerts from various sensors, according to Steve Maslin, security product manager at Equant.
When incidents are detected, Equant will provide customers with advice on incident handling and intervention.
In the area of security device management, Equant will oversee signature and software updates, store IDS (intrusion detection system) information and issue detailed reports on intrusions along with recommended fixes.
Equant is partnering with Ubizen to provide security event monitoring component of the intrusion detection service, Maslin said.
Consultants in Ubizen's security operations centres (SOCs) will use that company's proprietary State and Event Analysis Machine technology to weed out security events from a steady stream of IDS alerts.
Ubizen consultants will then provide Equant Intrusion Detection customers advice on remediating security events using configuration changes or other remedies.
The goal is to lower the cost ownership of IDS for enterprises that are interested in deploying an IDS service without sacrificing the "intelligent response" capabilities that come from security analysts reviewing the output from IDS sensors, Maslin said.
That will set the service apart from IPS or intrusion prevention services that rely mostly on automated responses, he said.
Service-level agreements (SLAs) ensure a high level of service for the managed IDS customers, mandating response to the customer regarding intrusions within 40 minutes. Equant hopes to reduce the response time as the program matures.
By comparison, competitors such as MSSP (managed security services provider) Guardent, issue SLAs to customers promising notification within 15 minutes of identifying a security issue according to Jonas Hellgren, vice-president of operations at Guardent.
As with other managed security service companies, Equant will offer a customer web portal that provides event tracking, query management and report features, Maslin said.
Equant will also store up to 12 months of forensic data for use by the customer, he said.
Equant already offers a Secure Gateway service that includes managed firewall with antivirus and URL filtering capabilities, a Secure Authentication service that provides remote user authentication services for customer websites, and security consulting services.
Equant Intrusion Detection is available immediately to customers worldwide.
Pricing for Equant Intrusion Detection varies depending on the size of the IDS deployment, but includes both a one-time start-up charge that covers consulting fees, account setup and device setup as well as monthly charges.
Paul Roberts writes for IDG News Service