[Dshield] Survey Summary

Johannes Ullrich jullrich at euclidian.com
Thu Mar 13 18:13:27 GMT 2003

I just tallied up the survey and would like to thank everyone 
who participated. We did sent the invitation to everyone who
signed up with DShield in the past, not just to users who
currently submit data. Out of the >30,000 invitations we sent
out, about 2700 responded. Here a few of the highlights:

57% of the survey participants submit logs. So the results are
biased towards actual submitters. Only about 10% of the people
we invited to fill out the survey do submit logs at this time.

The main reason people listed why they are not submitting 
is "didn't try/too lazy" (13%) or other (15%).

Most users submit logs from home systems (58%). Only 9% submit
logs from work. The remainder is not submitting any logs or did
not respond to the question.

The by far leading firewall type is ZoneAlarm (59%) followed by
linksys (13%) and iptables (11%).

The main reason people submit logs is our Fightback program (78%)
folloowed by participating in the Stormcenter ( 28%), the 'My Reports'
section (13%) and the daily summary emails (12%). This question allowed
for more than one answer, which is the reason why the sum is larger than

Overall, our participants are split evenly among the different 
"Techie" categories: about 20% answered "Not technical", Sys Admin
and "Computer Related". 12% rated themselves as "Infosec Professional"

Next question: country of residence
50 % US
10 % Great Britain
 7 % Canada
 4 % Netherlands
 3 % Germany
 2 % Australia
 2 % Sweden
 1 % Belgium
overall 88 Countries

80 % of participants would recommend others to submit data to
dshield (which is a higher percentage than the submitters overall :-/ )

Almost everyone participating would see it as a plus to have
manufacturers of firewalls add support for DShield. 23 % replied
with 'It would be a big plus and could make me buy a new/different firewall'.

However, only 10% of participants asked for DShield support from their
Firewall/IDS vendor. Let them know that you are interested ;-)...


jullrich at euclidian.com             Collaborative Intrusion Detection
                                         join http://www.dshield.org

More information about the list mailing list