Services Like McAfee Secure

Question

What do monitoring services like Mcafee Secure actually provide? It's about $1000 per year and I'm trying to judge what they actually do, as their benefits and technology pages might as well be the sales pages for just about any software as a service.

https://www.mcafeesecure.com/us/products/mcafee_secure.jsp?tab=3

I mean, is it possible that they have any information available which a decent server admin can't get for free? Or are they just pinging your server periodically to see what headers are returned, doing some XSS injection tests, etc?

I'm running Ubuntu 10.10, and if there are self monitoring services I could install and get email alerts on relevant security data / updates, that would be preferred.

Thanks!

Answer 1

Some of the services offered (not especially by McAfee, but in general in this area):

• checking the site is up
• confirming the DNS records are correct
• scanning email in and outbound
• running your intrusion detection service
• checking for spoof/malicious versions hosted elsewhere
• checking for brand theft
• checking your versions of OS/app etc against new advisories
• scanning for common vulnerabilities
• many others

Of course, all of these are something you can do yourself, given a large enough pool of skilled staff (eg IDS requires far more humans than you might expect) - so what a lot of organisations do is assess all of these against their infrastructure and skill set and what often happens is something like the following:

• outsource IDS, email scanning, perimeter antivirus and vulnerability scanning (this is very common - the big players do this globally so have rapid response across all clients when something bad is spotted at one)
• outsource brand squatting, website spoofing
• run detailed exploitation pen tests in house, or outsourced to specialists
• some run an in house asset/vuln tracker - some outsource

You need to work out how much each of these would cost you, how much an external provider can do it for, and how important it is in your risk management/mitigation scheme.