Network Magazine RNA Review

I received the latest edition of Network Magazine (NM) in the mail yesterday. There is a review article on the Sourcefire RNA. My shop has one RNA device for testing purposes and a couple of coworkers and I recently visited Sourcefire in Tysons Corner to get a more in depth look at RNA and the new Defense Center (DC).

The NM article seems fair and balanced with highlights of both the good aspects and weaknesses of the RNA tool. What I found to be of most interest is RNA will accept input from ISS and Cisco events by end of 2005. This is a very good move by Sourcefire to accept event feeds from vendors other than Sourcefire. ISS is widely used, although it seems to be losing some big customers, and Sourcefire's initiative to incorporate ISS events will be a huge benefit.

Hopefully, Sourcefire can iron out the issues with the RNA's vulnerability alerts by going to an aggresive scanning method. Who cares if it touches the nodes on your network, because after all, it is your network! Another item of interest to me was the mention of ArcSight as an event correlator that accepts RNA output.