10/3/2005 -- The outbreak and intrusion prevention technologies Cisco Systems Inc. announced last week should provide a very definite degree of protection against the threat of malicious worms and viruses, analysts say.

At the same time, some argue, Cisco’s strategy could benefit from an oft-missed and much-needed ingredient -- simplicity. The upshot, write analysts Charlotte Dunlap and Jeff Conover, both of Current Analysis, is that Cisco's threat response strategy is both complex and costly.

"While this solution does help Cisco customers to better defend against known attacks, Cisco needs to make more progress in enabling its customers to detect new threats without a specialized threat response service," the pair argue. "Furthermore, the Cisco Incident Control System and outbreak containment features underscore the complexity and multi-layered nature of a Cisco Self-Defending Network in a particularly negative manner."

If anything, Dunlap and Conover claim, Cisco’s strategy invites questions about complexity -- just how many layers of technology does it take to realize Cisco’s vision of a self-defending network? –- and cost.

Not that Cisco’s vision is bereft of bite, of course. If nothing else, write Dunlap and Conover, Cisco’s outbreak prevention strategy should provide a single point of control for dealing with malicious threats. "Combined with the worldwide intelligence gathered by the TrendLabs security team, Cisco has a powerful tool for combating and often thwarting known network threats. When compared to the option of patching affected systems before the outbreak reaches the borders of the enterprise, Cisco’s system looks to be an order of magnitude faster and more effective," they concede. "The solution helps to reinforce Cisco’s current security posture by providing advanced threat protection and mitigation capabilities. Cisco’s standing in the IPS market segment is much stronger having threat intelligence and enhanced policy functionality attached to these products."

That said, both critics assail what might be called Cisco’s scattergun approach to network self-defense. "But Cisco Incident Response is just the latest in a long line of products that Cisco continues to introduce to the market to solve the problem of LAN security, and some customers are already complaining that enough is enough," they say, citing as an example Cisco’s Intelligent Information Network, which was supposed to deliver a faster, more secure LAN. "Perhaps more concerning is the fact that this portion of Cisco’s outbreak prevention strategy doesn’t even touch its desktop offerings," write Dunlap and Conover. "Cisco’s security offering has grown so large and multifaceted that it is impossible to administer from a single central console, making the system more complex and more expensive to own." -Stephen Swoyer