Hosting firm to put intrusion detection to the test

DENVER - Application-hosting services provider Verado is readying a rollout of intrusion-detection technology to provide a new line of defense against hackers and denial-of-service attacks that might compromise its customers' business servers.

Verado, which operates eight data centers around the country, claims to be investing in the range of "seven figures" in systems administration, software and equipment to launch Recourse Technologies' ManHunt and ManTrap intrusion-detection software. ManHunt detects and analyzes attacks, while ManTrap is a deception system - commonly called a honeypot - that emulates a typical server but is actually a decoy to keep hackers preoccupied while the intended victim gathers information on the attacker.

"The Recourse Technologies honeypot will be a kind of academic environment for us to learn more about how attacks are being perpetrated," says Regan Packer, director of logical security at Verado.

ManTrap and ManHunt, both based on Solaris servers, are designed to work together. ManTrap is a nonpublicized server that can emulate different devices, such as DNS, FTP, e-mail or Web servers. When ManTrap senses possible hacker activity, it communicates with ManHunt, which can track the hacker's activity through correlation of events.

Packer says Verado expects to have Recourse's software fully deployed within a few months. ManHunt has only been available for two months, while ManTrap shipped in late 1999.

As a service provider, Verado is working closely with its customers to ensure the intrusion-detection system meets their needs. One such customer is Cactus Strategies, a market analysis firm in Denver that counsels corporations on product, audience and investment strategies. Cactus maintains a large Oracle database at Verado's hosting center.

"We have customer lists of our clients in that database, and other information that belongs to others," says Carl Covine, CEO of Cactus. "It's very important to us to make sure none of that data is compromised."

Covine says he's "uncomfortable" relying only on a firewall as barrier to the Internet against hackers. Currently, only Cactus' employees are allowed access to the Oracle database housed at Verado via the Internet. But after Verado adds intrusion-detection capabilities, Cactus plans to let trading partners and clients access the database over the Internet.

One issue still in discussion among service providers is whether to charge for more advanced intrusion-detection services.

John Harper, CTO at Verado, says his firm will likely offer ManHunt and ManTrap as dedicated services with round-the-clock monitoring. There's likely to be a fee for this, but the exact cost hasn't been determined, he adds.

"I'd like to see the fees as low as possible, of course," Covine says. But to get the kind of security protection that's envisioned, he says he'll accept that separate costs are likely going to be part of it.