"Legacy network-management solutions do not readily adapt to customer-specific processes." ~ Bill Ross
HIP Advice
I read Mike Fratto's article about testing HIP systems ("HIP Check," Oct. 21, 2002). Next time, he should check out Systrace (www. citi.umich.edu/u/provos/systrace/). It does almost all the things done by the article's test winner, Okena StormWatch and StormFront, and sometimes more--but for free. It first appeared on OpenBSD and is now ported to NetBSD and Linux as well. Also, one comment about the article: The fact that products were able to halt known attacks, such as unicode directory traversals and known overflow attacks, doesn't mean they'll succeed in halting unknown attacks.
Petr Ruzicka Security Consultant
Core Computer; pruzicka@core.cz
Mike Fratto replies: Since the products capture system calls and process them through an ACL, any requests that don't satisfy the "allow ACL" should be blocked. Common exploits, such as directory traversals and buffer overflows, often try to read, write or execute files outside the scope of the application, so any new vulnerabilities that work the same way should fail. I can envision two possible attacks: Find a flaw in the ACL logic or get a program on the target that talks to the hardware. However, if an attacker has physical access to the computer to install software, all bets are off.
MoM Power
I read Bruce Boardman's interesting article "A MoM With Smarts" (Aug. 5, 2002). I've implemented Smarts and agree it has a good correlation engine, maybe even the best correlation engine. I've worked with HP OpenView NNM and Tivoli NetView and prefer Smarts. However, I think your MoM article focuses a little too much on the network side of things. A MoM is a manager of all managers--it needs to manage the enterprise, of which the network is only a component. As far as I know, Smarts does not have its own OS monitoring solution. Yes, you can add systems such as AIX and Windows 2000 to Smarts and monitor their availability, but can you monitor their CPU, memory and paging utilization without using a third-party product that feeds Smarts? Furthermore, Smarts doesn't have plug-ins for enterprise applications, such as SAP. Its ASM is merely a framework for which you again need to write your own application plug-ins.
Also, I understand that you can't test all products, but is there a particular reason you didn't test Tivoli TEC/BSM?
Bruno Misseeuw Technical Consultant
Bruce Boardman replies: It's true that Smarts doesn't perform systems management, but it is able to gather performance alerts from systems management suites. About the absence of Tivoli, IBM did not respond to our request for the product in time for us to include it in the review.
Web Ahead
Regarding Bruce Boardman's recent network management articles ("Network Management on $1.19 a Day," Feb. 6, 2003, and "Hot MoMs!" Aug. 5, 2002), the primary reason network-management implementations fail to realize suitable ROIs is that network management is rarely viewed as a process. Software automates processes: If you can narrowly define a process, you can use software to automate it. The challenge of network management is that there are few commonly accepted operational processes; every enterprise has different ones.
Further, legacy network-management solutions do not readily adapt to customer-specific processes. Enterprise-class management solutions come with what are essentially predefined processes. There is a presumption that customers will alter their processes to adapt to those of the product. Many customers initially buy into this but ultimately realize it's unacceptable.
These customers then modify the inherent workflows, integrate the solution with other point solutions, and develop proprietary scripts to create a solution that maps more closely with their desired processes. With few exceptions, this leads to an incredibly expensive solution to maintain, and an even more difficult solution to adapt to changing business conditions.
Managed service providers documented what it felt was a comprehensive series of "best practices" and then automated those practices using legacy technologies and proprietary code. But when the dot-coms collapsed, so did the MSPs. They attempted to move upstream to midsize companies but failed; they could not cost-effectively adapt their hard-wired best practices to those of these customers.
Web services promises to change how networks are operated and managed. The next breed of network-management products will be Web services-enabled and will allow for the rapid automation of custom network operations processes as opposed to imposing rigid processes upon the user.
Bill Ross Vice President of Sales; Cygsoft
bill@cygsoft.com
Racking Up Ideas
Thank you for Steven Schuchart's good article "Equipment Racks" (Jan. 23, 2003). It's the first time in a long time that someone has written on equipment racks.
I suggest another topic for Schuchart to write about: best practices for control/server room design. I'm not talking about enterprise centers with 1,000 or more servers, but rooms with about three to 25 servers or other equipment.
Frank Bulk Network Administrator; Dordt College Computer Services
bulkf@dordt.edu
Tell us how you really feel. Write to us at editor@nwc.com, fax to (516) 562-7293 or mail letters to Network Computing, 600 Community Drive, Manhasset, NY 11030. Include your name, title, company name, e-mail address and phone number. All correspondence becomes the property of Network Computing.
REPORTS
Analyize In-Line NAC strategies and products.
ANALYTICS Plan and design your enterprise blade server deployments
InformationWeek U.S. IT Salary Survey 2008
Salaries for business technology professionals are falling. Here's what you need to know in order to make good hiring decisions and personal career choices. Download Today
REPORTS
ANALYTICS
Follow 
