4

What do monitoring services like Mcafee Secure actually provide? It's about $1000 per year and I'm trying to judge what they actually do, as their benefits and technology pages might as well be the sales pages for just about any software as a service.

https://www.mcafeesecure.com/us/products/mcafee_secure.jsp?tab=3

I mean, is it possible that they have any information available which a decent server admin can't get for free? Or are they just pinging your server periodically to see what headers are returned, doing some XSS injection tests, etc?

I'm running Ubuntu 10.10, and if there are self monitoring services I could install and get email alerts on relevant security data / updates, that would be preferred.

Thanks!

Improve this question
2
  • 1
    I'm sure some of the folks here will weigh in with answers about what McAfee and others provide (I probably will as well), but you will need to remember that these types of services develop over time, so I would advise contacting them and asking a technical person to talk you through the current services they can offer to you. – Rory Alsop♦ Sep 23 '11 at 16:23
  • @Calvin, Link down............. – Pacerier Mar 28 '15 at 18:54
3

Some of the services offered (not especially by McAfee, but in general in this area):

  • checking the site is up
  • confirming the DNS records are correct
  • scanning email in and outbound
  • running your intrusion detection service
  • checking for spoof/malicious versions hosted elsewhere
  • checking for brand theft
  • checking your versions of OS/app etc against new advisories
  • scanning for common vulnerabilities
  • many others

Of course, all of these are something you can do yourself, given a large enough pool of skilled staff (eg IDS requires far more humans than you might expect) - so what a lot of organisations do is assess all of these against their infrastructure and skill set and what often happens is something like the following:

  • outsource IDS, email scanning, perimeter antivirus and vulnerability scanning (this is very common - the big players do this globally so have rapid response across all clients when something bad is spotted at one)
  • outsource brand squatting, website spoofing
  • run detailed exploitation pen tests in house, or outsourced to specialists
  • some run an in house asset/vuln tracker - some outsource

You need to work out how much each of these would cost you, how much an external provider can do it for, and how important it is in your risk management/mitigation scheme.

Improve this answer
4
  • What do you mean by outsource "brand squatting"? Are there even such services? – Pacerier Mar 28 '15 at 18:54
  • It should read checking for brand squatting – Rory Alsop♦ Mar 28 '15 at 19:15
  • @RoryAlsop, When you say brand squatting, are you simply talking about domain squatting or do you mean besides domain squatting there is something else? – Pacerier May 4 '15 at 23:17
  • Brand squatting also includes similar looking sites, not just mis-spelled domains etc – Rory Alsop♦ May 5 '15 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.