We implemented an IDS system. The ROI comes from the inbound attacks
being detected/prevented/shunned. But it's also listening to the
outbound stuff, so when we see that a customer has the flavor of the
week, we cut him off, give him a call and some friendly advice, and
everyone's happy. When we see IRC joins and port scans from a customer
server, we give him a call, advise him that he's been rooted, and offer
to assist in his recovery (can you say business opportunity, folks?).
Blocking ports is fine as long as you let people know what you're
blocking and why, offer alternative solutions and offer to unblock if
it's an absolute requirement. Often, once properly educated about the
risks, a lesser experienced admin will be excited about the opportunity
to do it the more secure way, and will begin preparations, so I've found
the "unblock" is usually temporary.
