Check Point IPS-1
Check Point IPS-1 continues to serve customers that require a dedicated appliance, while Check Point emphasizes its new IPS software blade for customers interested in a multi-function security gateway that offers a lower total cost of ownership. (4/6/2010)

Cisco IPS Series, Version 7.0
The new global correlation capabilities in Version 7.0 of the Cisco IPS 4200 Series software has been well received in the market since its launch in early 2009. Cisco claims that it makes the IPS twice as effective at stopping malware. (4/6/2010)

IBM ISS Proventia Network Intrusion Prevention System
The IBM Proventia Network Intrusion Prevention System continues to perform well in independent testing and now addresses Web application security, but it has lost some mindshare due to IBM’s emphasis on wrapping services around the product. (2/26/2010)

McAfee Network Security Platform
McAfee Network Security Platform (formerly IntruShield) is a purpose-built intrusion detection/prevention appliance performing up to 10 Gbps packet analysis, which will continue to be enhanced through the company’s risk management strategy. (4/5/2010)

Sourcefire 3D System
Sourcefire’s new 3D System, Release 4.9, adds a VMware-based virtual appliance option along with better network visibility and a building block approach to policy creation. New clustering for high-end sensors supports 20 Gbps performance. (3/17/2010)

TippingPoint Intrusion Prevention Appliance
TippingPoint continued to build out its IPS business on several fronts, highlighted by the launch of its N-Series Platform, integration with 3Com’s H3C switches and secure network fabric strategy, and its new support for VMware virtual servers. (2/25/2010)

Top

Report Contents

• Current Perspective Rating
• Product Strengths & Weaknesses
• Product Buying Criteria
• Product Metrics

Top

Intrusion Prevention Appliance Buying Criteria

• Detection and Response
  • Methodology of detecting, preventing, alerting and auditing events; data analysis and correlating capabilities.
• Architecture
  • Structure of the product, including network interface, integration and pre-configuration notations.
• Throughput (Performance)
  • The speed with which the product analyzes data, and the efficiency of the network system.
• Vendor Support
  • The support customers can expect to receive during and after system set-up, in regard to routine signature updates and emergency response.

Top

Intrusion Prevention Appliance Product Metrics

• Performance And Sizing
  • Intrusion Prevention
  • Intrusion Detection
  • In-line Test Mode
  • Simultaneous IDS/IPS Mode
  • Max. In-line IPS Throughput
  • Max. IDS Monitoring Throughput
  • Monitoring Ports (IDS Mode)
  • In-line Pairs (IPS Mode)
  • TCP Reset Ports
  • Management Network Ports
  • High Availability
  • Fail-open
  • Fail-closed
  • Removable Hard Drive
  • Interface Grouping
  • Redundant Power Supply
• Detection
  • Vulnerability Attack Detection
  • Protocol Anomaly Detection
  • DoS Attack Detection
  • Stateful Signature Detection
  • No. Network & Application Protocols
  • User-defined Signatures
  • Evasion Detection/Res. IDS Attack
  • Fragmentation Attack Detection
  • Asymmetric Routing Support
  • VLAN Aware Detection
  • Behavioral Traffic/Flow-based Det.
  • Scan and Reconnaissance Detection
  • Backdoor Detection
• Analysis
  • Third-party Event Integration
  • Built-in Real Time Event Corr.
  • User-tunable Event Correlation
  • Cross-sensor Event Analysis
  • Full Packet Capture
  • Event Filtering
  • Additional Reference Data Provided
  • Event Annotation/Auditing
  • Event Description Updates
• Response Capabilities
  • E-mail Notification
  • SNMP Notification
  • TCP Session Reset (Passive Mode)
  • Session Record
  • Console Response
  • Export Flows
  • Custom Response
  • Firewall Interaction
  • Router Interaction
  • SNMP Interaction
• Management
  • Secure Remote Management
  • Multi-sensor Management
  • Automatic Signature Update
  • Auto Apply Sig. Updates to Policies
  • Auto Enable Signature Blocking
  • Pre-defined Protection Policies
  • Clone/Copy Protection Policies
  • On-Off Toggle for Blocking
  • Data Storage
  • Secure Data Storage
  • External
  • Built-in Data Storage
• Reporting
  • Scalable Info Presentation
  • Web-based Reporting
  • SQL Export
  • Automated and Schedulable Reporting
• Integration/Correlation
  • Analysis of Firewall Alerts
  • Analysis of HIDS Alerts
  • Anal. Vulnerability Assmt. Alerts
  • Analysis Third-party Net. IDS Alert
  • Data Export Enterprise Mgmt Product
• Security Content
  • Dedicated Sec. Research & Response
  • Regular Security Updates
  • 365x24x7 Outbreak Updates
  • Regular Threat Report
• Services Available
  • Full Time Managed Services
  • SLAs with Managed Service
  • Strategic Planning Services
  • Deployment Services
  • Incident Response Services
  • Education Services
  • Security Assessment Services
• Support Options
  • Telephone and Web Support
  • Product Notifications
  • Software Upgrade Insurance
  • Year Appliance Hardware Warranty
  • Advanced Alerting Service
  • Access Sec. Experts/Acct Managers
• Pricing
  • Appliance MSRP
  • First Year Maintenance/Support
  • Renewal of Maintenance Support
  • Base Cost per 100 Mbps Throughput
  • Flex Licensing-No Forklift Upgrades
  • Licensing Model