ISS has centers in Sweden, Italy and Brazil, and in April plans to open one in Japan, says Mark Hagen, president of the ISS managed security services division. For the intrusion-detection managed service, corporations have to deploy the ISS RealSecure Network Sensor software in their internal network to remotely monitor traffic across LANs or behind the firewall. Later this year, ISS plans to add host-based monitoring of servers, which would require users to buy into the RealSecure Server Sensor software. ISS often partners with telephone companies and Web-hosting providers, such as Exodus and network integrators or consultants, such as PricewaterhouseCoopers, to market its managed security services. The ASP technical staff aren't going onto the customer site to manage only NAI's CyberCop intrusion-detection software, but also competing products from companies such as ISS and Cisco.
Sentry collects all that.
Sentry then transmits that datastream in encrypted form to the Counterpane data center staffed around the clock. If you went through a network expansion, we need to know there's a change. Otherwise, we don't know what's happening in the network. Counterpane contacts the corporation to report suspicious findings or an attack in progress, but doesn't take further actions, such as shutting down access. Those steps are up to the corporation because Counterpane is there as a 24-7 remote monitoring alarm service, Schneier says.