EXPERT RESPONSE
Good question. However, it is unanswerable without a lot more information
about your environment. We typically spend a day or two looking at
requiements before making a recommendation on something like this. That
said, both products are fantastic. Their speed is wonderful, and the
management interfaces are both pretty good. I think the question hinges
on your prior experience with IDS in your environment and your budget. If
you have no IDS experience and/or a limited budget, download the free
version of Snort and experiment with one or two sensores for two months.
If you like what you see, go with more free Snort or a commercial version
of Snort such as that available from www.sourcefire.com. If you don't
like what you see, try the Cisco IDS card. If you have a lot of
experience with IDS, you should be able to make the call as to whether the
Cisco product will meet your needs up front. By the way, another item to
consider is that the Cisco IDS card requires, of course, a Cisco switch.
If you have any LANs that aren't Cisco, you'll either have to use another
solution or leave IDS off of that network. So, make sure to carefully
consider Snort if you have a mixed network.
For more information on this topic, visit these other SearchSecurity.com resources:
News & Analysis: Commercial grade of Snort arrives
Ask the Expert: Placement of Cisco Secure IDS sensor
Ask the Expert: An IDS with a user-friendly interface
|
