Software or appliance solution?

After having gone through a couple rounds of viruses such as SoBig.F and MyDoom – including a potential intrusion into the network – management is allowing us to add some solutions to the network that will do virus scanning on more than just e-mail and potentially handle some intrusion detection. One of the decisions that will need to be made is appliance vs. software vs. open source. Suggestions?

After having gone through a couple rounds of viruses such as SoBig.F and MyDoom – including a potential intrusion into the network – management is allowing us to add some solutions to the network that will do virus scanning on more than just e-mail and potentially handle some intrusion detection. One of the decisions that will need to be made is appliance vs. software vs. open source. Suggestions?

– Via the Internet

This is a question I could write a book on, but I’ll do what I can in the space I have here. The first thing I would suggest is to don’t try to implement all the solutions you choose at once. That will make troubleshooting easier if you have problems during turnup of the new systems.

Although you’ll find that the appliances, in general, will cost more than a softare-only or open-source solution, there are several options in their favor. One advantage I’ve found on a couple devices is that they’re “transparent” to the network. Even though the device will have a management IP address so you can talk to it via Web browser or other application, the network traffic doesn’t see the device, and the network doesn’t have to be reconfigured if the device is inserted or removed.

Software and/or open-source solutions can sometimes be less expensive than their appliance counterpart; but that can be a tradeoff. The software may not be able to run as fast as a “dedicated” solution. Open-source software, while the least expensive, makes you dependent for advice or help from others in the community, and may end up costing more or require more time to manage than an appliance. If you end up with multiple solutions that perform different functions (a possibility), ensure that if  it fails, it does in an open condition in which the network traffic continues uninterrupted.

Another cost to be considered with either solution is that of support. Although you can see a cost with the appliance devices, there is also a support cost with the other solutions, as well. For both there’s the costs of ongoing operation and getting help when there is a problem. Build a checklist when you evaluate all the different systems you’re considering. What may appear to be the most expensive upfront may be either the cheapest or the easiest to control, cost-wise, in the long run.