Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What do monitoring services like Mcafee Secure actually provide? It's about $1000 per year and I'm trying to judge what they actually do, as their benefits and technology pages might as well be the sales pages for just about any software as a service.

https://www.mcafeesecure.com/us/products/mcafee_secure.jsp?tab=3

I mean, is it possible that they have any information available which a decent server admin can't get for free? Or are they just pinging your server periodically to see what headers are returned, doing some XSS injection tests, etc?

I'm running Ubuntu 10.10, and if there are self monitoring services I could install and get email alerts on relevant security data / updates, that would be preferred.

Thanks!

share|improve this question
1  
I'm sure some of the folks here will weigh in with answers about what McAfee and others provide (I probably will as well), but you will need to remember that these types of services develop over time, so I would advise contacting them and asking a technical person to talk you through the current services they can offer to you. –  Rory Alsop Sep 23 '11 at 16:23
add comment

1 Answer

Some of the services offered (not especially by McAfee, but in general in this area):

  • checking the site is up
  • confirming the DNS records are correct
  • scanning email in and outbound
  • running your intrusion detection service
  • checking for spoof/malicious versions hosted elsewhere
  • checking for brand theft
  • checking your versions of OS/app etc against new advisories
  • scanning for common vulnerabilities
  • many others

Of course, all of these are something you can do yourself, given a large enough pool of skilled staff (eg IDS requires far more humans than you might expect) - so what a lot of organisations do is assess all of these against their infrastructure and skill set and what often happens is something like the following:

  • outsource IDS, email scanning, perimeter antivirus and vulnerability scanning (this is very common - the big players do this globally so have rapid response across all clients when something bad is spotted at one)
  • outsource brand squatting, website spoofing
  • run detailed exploitation pen tests in house, or outsourced to specialists
  • some run an in house asset/vuln tracker - some outsource

You need to work out how much each of these would cost you, how much an external provider can do it for, and how important it is in your risk management/mitigation scheme.

share|improve this answer
    
Great answer. Thanks for the input. –  Calvin Froedge Sep 23 '11 at 21:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.