Security - IDS Refresh Project Phil Healey Date of Greenlight Meeting

Business Problem  Sourcefire Intrusion Detection devices on the SPE network are no longer the preferred IDS system  They are leased from a vendor at a cost of $278,472 per year, with $117,890 for maintenance on top  SPE bandwidth has grown since the Sourcefires were installed and we have now exceeded their threshold for monitoring  They are approaching end of life support with the manufacturer, therefore updates for new vulnerabilities will not be applied 2

Proposed Solution  HP Tipping Point appliances are the Sony Corp preferred model  They are higher capacity appliances so can monitor the SPE network effectively  They are also the latest spec, so will ensure we have ongoing vendor support for the foreseeable future  This is the Sony standard for IDS and IPS inside the Sony network 3

Financial Summary 4

Benefits Category$ BenefitDescription Cost Avoidance/ Reduction $589,884 o 5 Year Total Benefits – lease costs and 5 year maintenance costs saved from Sourcefire appliances ($1,981,810 in total over 5 years) Risk AvoidanceN/A o HP Tipping Points are higher capacity appliances o Sourcefire appliances are approaching end of life support with the manufacturer and will not receive new vulnerability updates Intangible Benefits N/A o HP Tipping Points align with Sony standard for IDS monitoring o IPS capability 5

Competitive Analysis  Other Sony entities are also deploying HP Tipping Point’s as IDS monitors at key network boundaries as they are GSIRT/Sony Corp’s preferred appliance 6

Project Timeline FY1 AprilMayJuneJulyAugSeptOctNov Installation, configuration & return of Sourcefire appliances Obtain funds Procurement, project planning Requirements & analysis Closure 7

Appendix 8

Resource Information (SAMPLE) 9

Security, Risk, and Compliance Considerations  HP Tipping Points align with Sony Corp/GSIRT standards for IDS monitoring  Sourcefires will not update for new vulnerabilities once they are end of vendor support so Tipping Point’s will insure SPE against this risk  Tipping Point’s will monitor more of the SPE bandwidth than the Sourcefires  Risk of scope increase as Infosec have requested coverage of the WAN and behind Palo Alto firewalls 10