DirectPointe provided a hosted security offering which included managed firewall and managed intrusion prevention. The offering uses a SonicWall-based firewall that performs automatic blocking of network attacks. Because of the automatic blocking, we were never contacted during the duration of our tests despite the SLA requirements to the contrary. This is a problem because, although common scans against the firewall don’t usually generate much concern, a concerted effort, such as our Core Impact attack, should get the MSSP’s attention.
The offering performed security defending of the application very well. Our Nessus scan was disengaged even before the number of open ports could be enumerated, and the application blocked attempts at buffer overflows by blocking our testing IP address.
DirectPointe also includes access to an administration web portal, unique in that the user has the ability to administer the security of the hosted application.
There was no installation of the application due to the outsourced nature of the offering. The application was downloaded from the laboratory site and uploaded to the system with no activity from SC Labs. In addition, documentation was not needed; again because of the outsourced nature of the offering.
Phone and email support are available and readily usable. The staff is knowledgeable and helpful.
The pricing for the DirectPointe offering is at the low end of offerings in this Group Test, though actual pricing depends on the size of the implementation and the SLA. This offering seems perfectly positioned for organizations that need outsourced managing of an application due to audit or regulatory compliance, but are not looking for additional features beyond the basics.
Our only concern would be the speed at which DirectPointe responds in the event of an incident. Clearly, the reason for engaging an MSSP is to protect the enterprise. That consists not only of providing a firewall, it also consists of managing alerts and taking appropriate note of attacks. Depending on intrusion prevention as the only defense is not the best way to defend mission critical applications.
