RSA envision Platform. Sales Guide

Transcription

1 RSA envision Platform Sales Guide

2 Legend Contents Business Drivers Identifying Customers Discovery Questions Positioning Statements Presentation of Solution Objection Handling How to Quote Other guides in this series include: Building Success with the RSA SecureWorld Partner Program, the RSA Security Value Proposition, the RSA SecurID Authentication Sales Guide, the RSA SecureID for Microsoft Windows, VPNs, Wireless and Citrix Sales Guides, the RSA SecurID Appliance Sales Guide and the RSA SecurID Competitive Sales Strategies. Introduction 4 Managing Security, Enhancing Compliance: the RSA envision Platform Solution 5 The Channel Advantage 6 Business Drivers 7 Meeting Business Needs 8 RSA envision Platform Solution Overview 9 Benefits of the RSA envision Platform 10 Identifying Customers 12 Discovery Questions 14 Positioning Statement 16 Attaching and Follow-up Opportunities 17 Presentation of Solution 18 Objection Handling 20 FAQs 21 ES-1060 Demonstration Appliances 22 How to Quote RSA envision 23 Competitive Analysis 27 Appendix A: Useful Resources 29 Presentation Materials 29 RSA SecurWorld Partner Locator 29 RSA Secured Solutions Directory and Implementation Guides 29 RSA Online 30 RSA SecurCare Online 30 Contacts 31 Americas Headquarters 31 Corporate Headquarters 31 International Headquarters 31 Local Offices 31 RSA Security Distributors

3 Introduction The, part of The Essential Guide series, delivers practical, real-world sales advice about this compliance and security information management solution. This guide helps you to identify customer requirements, to present the RSA envision platform solution to customers effectively and to close deals. The resources in these pages provide sales personnel with current information on RSA envision platform components and competing products in the market. The topics progress through a typical sales cycle, including a product overview, market drivers, product positioning, discovery questions, objection handling, price quoting and common questions. This guide gives salespeople the information and tools to create opportunities and generate greater revenues. Managing Security, Enhancing Compliance: the RSA envision Platform Solution Increasingly complex network infrastructures and a growing body of regulatory mandates pose dual challenges for enterprises striving to manage security and ensure compliance. Thousands or tens of thousands of events occurring across an organization s networks every second may be logged using traditional network management tools, but unless this raw data is analyzed and converted into actionable intelligence, security risks may go undetected and regulatory compliance requirements may not be adequately met. The RSA envision platform provides a comprehensive information management framework for compliance and security. It directly addresses the need to log network events and produce meaningful intelligence from this data. In doing so, the RSA envision platform improves the efficiency of IT departments, strengthens the ability of security personnel to recognize and respond to internal and external data security threats and helps ensure compliance with state and federal regulations and industry standards that mandate accountability. The RSA envision platform is the only information management platform for comprehensive and efficient transformation of event data into actionable compliance and security intelligence. The solution is deployed as a standard server and storage solution to collect logs from network devices, servers, applications and storage devices. Adding additional appliances in response to a rise in data traffic or expansion of the network infrastructure can be accomplished simply and efficiently. Increases in data traffic an inevitable byproduct of businesses relying more and more on the Internet for operations add to the difficulty of managing and contending with growing volumes of files and ensuring that sensitive data is safeguarded. The platform approach to log management, used by this solution, scales effectively to more demanding enterprise requirements even when those requirements entail managing massive volumes of data and transactions. Adopted by many of the world s leading enterprises, the RSA envision platform provides value far beyond simply capturing and logging raw data. By effectively leveraging network data, extracting intelligence and useful information from data patterns and events, the RSA envision platform addresses security, compliance and business operation challenges thereby providing a comprehensive compliance and security information management lifecycle solution. 4 5

4 The Channel Advantage Business Drivers RSA Security helps ensure that, as a channel partner, you can satisfy your customers requirements through successful planning and implementation. Customers deploying this solution across their organization can quickly maximize their ROI and improve the productivity and efficiency of business processes. Partners can achieve maximum success selling RSA envision platform components by leveraging the following factors: HH Because the solution focuses on enterprise requirements, sales typically lead to larger revenues as organizational needs grow and networks expand. HH The complete solution often leads to complementary product sales of additional RSA Security products. The solution provides abundant opportunities for strategic planning and deployment HH services. The RSA envision platform effectively addresses a number of challenges that impact business around the world. The key drivers include: H H Growing Network Complexity: Logging events and monitoring activities on the sprawling, high-volume networks that characterize modern organizations places a large burden on IT staff members and in-house security professionals. Piecemeal solutions and end-point approaches fail to address the scope of the problem or provide an effective resolution for tracking, logging and extracting intelligence from a vast sea of data activity. Administrative and IT budgets required to counter this challenge are rising and many organizations are feeling overwhelmed as they struggle to contend with threat management while concurrently monitoring network activities for security policy compliance. H H Heightened Network Security Concerns: As organizations increasingly rely on the Internet, web services, and mobility applications for conducting daily business operations, the risk vectors for data theft and fraudulent activity rise in concert with the sophistication of computer hacking techniques. Given the expanding infrastructure risks, businesses and organizations need tools to keep business operations secure. Risks can be mitigated by monitoring potentially threatening user accesses and activities, detecting baseline anomalies and issuing appropriate alerts, and keeping track of real-time events across the universe of device types in use within the organization. H H Regulatory Mandates: In the current climate of privacy concerns and regulations highlighting accountability and data protection, achieving compliance with regulatory mandates is a vital concern of businesses everywhere. Penalties for failing to protect an individual s personal data or failing to verify and authenticate users accessing sensitive network data can result in steep fines or even the imprisonment of corporate officers. A number of recent regulations and industry standards adopted in the U.S. and around the world (including HIPAA, Sarbanes-Oxley, EU Data Protection Directive and Gramm-Leach- Bliley) aim toward improving user authentication, protecting data access and maintaining clear audit trails. Because of these regulatory requirements, many organizations are re-assessing the end-to-end security of their infrastructure and considering enterprisecaliber solutions. This solution targets log management, security operations and regulatory compliance issues, giving businesses a strong, scalable tool for improving business operations and strengthening their security. The following section highlights the ways in which this solution meets vital business needs. 6 7

5 Meeting Business Needs RSA envision Platform Solution Overview The RSA envision platform addresses primary business needs in the following ways: H H Centralizes and streamlines data logging and management: The demands on IT departments and requisite budgets can be significantly reduced through the capabilities of the RSA envision platform, providing greater visibility into business operations, compliantfriendly tracking of individual network activities and analytical tools that can be configured to generate alerts when potential security breaches or illicit network activities are detected. Integration with other RSA products, such as RSA SecurID, helps create an intelligent framework to protect data assets and network resources. H H Strengthens data security by identifying potential threats: The security event management features of the RSA envision platform help security staff members identify and respond to developing risks involving network access and file movements. Through the solution features that support the generation of actionable intelligence based on tracked and correlated security events, RSA envision improves the efficiency and effectiveness of security practices. H H Provides reporting and analysis tools to help meet regulatory requirements: Security information management features of RSA envision are ideally suited for organizations of all sizes, including large organizations with sizable networks. The information management and data retention features aid in complying with reporting requirements mandated by SOX, GLBA, PCI and other current legislation. By providing extensive, system-wide recording and tracking of data events and transforming this data into a form that simplifies regulatory compliance, organizations can avoid fines and penalties while ensuring data integrity for customers, vendors, and stakeholders. The RSA envision platform collects and manages All the Data across an organization s network resources, delivering practical, intelligent analysis of events for enterprise log management, compliance and security. As an appliance-based solution, the RSA envision Platform offers an effective alternative to software, eliminating hidden costs in pricing models, simplifying deployment and providing consistent, predictable performance and results. 8 9

6 Benefits of the RSA envision Platform The RSA envision solution offers these advantages to organizations: H H Exceptional scalability: the open architecture and modular hardware components of the RSA envision platform achieve a very high level of scalability, capturing thousands of data events per second. The scalability of the solution allows even the largest enterprises to successfully capture, monitor and analyze data in a consistent, predictable way. H H Favorable Return on Investment: By avoiding the hidden costs of software-only solutions (additional hardware investments, management expenses, storage costs and so on), the RSA envision platform delivers strong business value and a rapid Return on Investment (ROI). H H Fast deployment: The appliance-based RSA envision platform solution can be attached to the network and configured in a very short period of time, typically in the range of two hours. Software-based solutions set up for a similar appliance may take anywhere from a day to a week to become fully operational. H H Industry-leading reliability: The controlled, secure environments represented by the RSA envision platform appliances, running a hardened and locked version of Microsoft Windows, deliver a very high degree of reliability. Appliances are immune to third-party driver conflicts, bugs, worms, viruses and similar threats to data integrity and consistent operation. H H Unique IP-based database advantages: To rapidly capture and analyze IP-based data and information, the solution relies on an innovative database approach: Internet Protocol Database (IPDB). IPDB provides unique data advantages and storage benefits that unlock many of the capabilities of this solution for real-time operations. Many RSA Security and EMC products work together effectively so that customers can deploy complete solutions that encompass all of their security, network management, information management and compliance requirements. For example, the RSA envision platform complements RSA SecurID technology to give partners the opportunity to strengthen compliance and network management with the proven benefits of two-factor authentication. This solution also complements EMC s vision for information-centric security and is integrated with EMC Celerra, CLARiiON, Symmetrix and Centera. The RSA envision platform solution consists of these elements: H H RSA envison platform appliance: Each RSA envision platform appliance is a controlled secure environment, featuring a locked-down and hardened version of the Microsoft Windows operating system and the envision software application pre-installed. This controlled environment ensures that the usual threats to system operation including bugs, viruses, and worms are effectively eliminated, ensuring safe, reliable performance. Several different models of the RSA envision platform appliance allow organizations to select the level of equipment corresponding with the number of devices and the volume of data events to be captured and processed in real-time. H H Internet Protocol Database: The innovative, patent-pending RSA Internet Protocol Database (IPDB) is tailored to efficiently collect and protect All the Data from any IP device on the network. This database lets customers construct a robust log management platform with the ability to monitor and correlate high volumes of data events and extract intelligence through sophisticated analytics. Storage requirements for data collected are minimized through compression techniques and performance is enhanced through a unique approach that works efficiently with unstructured data formats. H H Built-in tools: The built-in tools and features of the RSA envision platform provide the flexibility to collect, analyze and view data in numerous ways and to configure behaviors to suit the security and compliance requirements of many different types of organizations. Among the tools and features included: advanced vulnerability and asset management features, task triage and ticketing system integration, watchlist alerting and reporting, event explorer and extensive features for maximizing availability. RSA is a market-proven leader in transforming enterprise-wide data into compliance and security information. The RSA envision platform is built on an architecture equal to the demands of high-traffic network operations, collecting and protecting All the Data that drives each customer s business

7 Identifying Customers The RSA envision platform solution suits deployments in mid-size to large organizations, as well as global enterprises where extremely high data traffic on the network is typical. Primary industries include: HH Financial services HH Outsourcers and managed service providers HH Retail and hospitality services HH Healthcare industry HH Energy and utility industry HH Public sector and non-governmental organizations Organizations that are concerned with security and information management for improved protection of data resources, regulatory compliance, and enhanced business operations generally respond favorably to the features and capabilities of the RSA envision platform. Strongly regulated industries such as finance, government, pharmaceutical, and healthcare face substantial regulatory mandates and compliance requirements, which can be met with a properly deployed RSA envision platform solution. Typical prospects for the RSA envision platform have these characteristics: HH A wide range of computing device types accessing network resources HH Large volumes of critical applications and sensitive data in use HH Complex network infrastructures requiring substantial IT management HH Stringent compliance requirements at state, federal and international levels Key indicators that an organization can effectively take advantage of the RSA envision platform are: H H No unified system in place for monitoring and analyzing network events: Organizations that lack a centralized, unified means for collecting and analyzing network data events risk potential security breaches internal as well as external and often devote excessive time to trying to interpret and make decisions on uncorrelated data collected by non-intelligent logging tools. Streamlining data collection and extracting key intelligence from it can greatly simply business operations, strengthen security and reduce IT costs. H H Existing network logging tools do not adequately meet regulatory mandates: More stringent regulations involving accountability, authentication and auditing of network activities have emerged in recent months, creating a need for companies to reassess the effectiveness of their existing piecemeal or less comprehensive solutions to logging and monitoring. Raw information may be collected, but often the intelligence component is lacking, making it difficult to view or evaluate the data, or to present it in a way that meets mandatory requirements. H H Costs of IT administration: Inefficient, non-centralized approaches to security information and event management (SIEM) can drive up the costs of IT administration, requiring manual intervention for many processes that should be automated. Increasingly, organizations are recognizing the importance of managing compliance and security event log data more effectively from the time the event data are generated to the time it no longer needs to be retained (according to regulatory guidelines)

8 Discovery Questions The RSA envision platform is well suited to organizations of all sizes, but it is ideal for a medium to large enterprise sale. You can effectively focus a sales engagement by addressing the security and compliance functions and asking basic qualifying questions. Inquiring about a customer s current environment and existing security and compliance strategies is often a good place to start the discussion. Ideally, you can lead the discussion toward the goal of selling a combined solution that addresses the security and compliance needs of multiple stakeholders in the organization and that includes development and implementation services, the core product and an appropriate EMC storage platform. Potential decision makers for the RSA envision solution typically fit into three categories: H H Executives: Have considerable influence; concerned with shareholder values, revenue issues and regulatory compliance. H H Managers: Have influence over budget and project implementations; concerned with customer relationships, cost controls and business objectives. H H Operations personnel: Focused primarily on implementation strategies, resources and technology issues. Selling effectively to these three categories of buyers requires asking questions to highlight the individual s concerns and offering solutions in terms that address the challenges faced by the organization. Focus the discussion on the key motivations identified for each buyer. Effective questioning strategies target each individual s most important concerns. For example, when talking with an executive, the following questions can help lead the sales discussion: Have you found a satisfactory way to monitor and track network data events across your infrastructure for compliance and security? Are your network data resources protected against emerging security threats Are your security investments working? Can you easily prove it? Do you need to make your compliance reporting more effective while consuming fewer resources? Do you have a compliance initiative in effect that mandates improved accountability and data retention? The following questions focus on concerns of the typical manager: Given your current capacity and existing configuration for storing security information, for how long a period can you retain the data? What do you estimate it costs your IT group each year to log and manage data events? What systems are in place to monitor access control, privileged users and configuration controls? Do you feel that your company s critical applications and data are sufficiently protected against external threats? Can you analyze all of the data logged in real-time and apply it to forensic situations? For operations personnel, these questions may help determine a fit: How will your organization create a compliance program in a cost-effective manner? Are their multiple departments or groups collecting security audit information? Do additional groups have a need to collect this information? When a security threat is identified, are you able to cross-reference it with the rest of the network? How do you keep up with real-time monitoring, threat detection and malicious code detection without being overwhelmed by false positives? Are you able to add proprietary applications to extend the collection of source devices in use on the network? Do you need to produce frequent compliance reports or reports for many different audiences? Using these sample questions to stimulate discussions with potential buyers based on their demonstrated concerns helps discover the underlying business needs and buyer motivations. This, in turn, can suggest the most compelling points to focus the sales presentation

9 Positioning Statement Attaching and Follow-up Opportunities Faced with increasingly complex network environments, emerging data security threats and stringent compliance requirements, many organizations are turning to comprehensive information lifecycle management solutions, looking for tools that support best practices for security information and event management. Given the complexities of planning and implementing solutions in this area, appliance-based solutions designed around an open architecture model have significant advantages in terms of cost, reliability, scalability and installation. HH The RSA envision platform offers clear advantages in a number of areas, providing SIEM capabilities that directly address key customer requirements. Presented as part of a solution sales approach, this platform: HH Provides a scalable log management platform that enables compliance and security, and delivers business intelligence to enhance operations HH Offers a comprehensive, open-architecture approach to SIEM that integrates effectively with existing network equipment and supports high-volume data environments HH Expands the value of data on the network, analyzing All the Data to support a rich, information-centric security strategy In this context, the RSA envision platform helps customers eliminate redundant silos of information and create a unified framework that spans the enterprise, turning raw data into actionable intelligence. Properly trained partners and RSA can offer customers additional services to accompany the product sale of RSA envision platform components, including: HH Universal Device Development HH Sure Start HH Report and Alert Developer HH Compliance Assessment and Enablement HH Security Assessment and Enablement As part of an overall network security strategy, and to strengthen the compliance and security aspects of network access and use, other complementary products offering some opportunity for the additional sales include: H H Addition of RSA SecurID: Authentication is a prime aspect of compliance regulations, as well as a best-practice approach to network security. RSA SecurID provides industry-leading two-factor authentication for compliance and improved security. H H Addition of Use of a Certificate Authority: Customers using certificate authorities, such as RSA Digital Certificate Solutions, have an ongoing need for the protection of certificates and keys. RSA Smart Cards and RSA USB Authenticators ensure protection of each user s private keys. H H RSA SecurID Tokens: Customers looking for tighter security than passwords can provide will be interested in using multi-factor authentication. For new customers this will lead to sales of RSA SecurID tokens and software licenses. For existing RSA customers, it may mean an expansion of the number of tokens in use. This RSA envision solution provides a proven framework for strengthening enterprise security and ensuring compliance. Your customers can also leverage existing RSA Security investments, such as RSA SecurID tokens or RSA Keon digital certificates, combining a comprehensive range of security tools within an framework

10 Presentation of Solution The RSA envision platform is built around a solid framework of information management capabilities recognizing that transforming event data into actionable compliance and security intelligence is a fundamental necessity for modern businesses and large-scale organizations. With proven performance, exceptional scalability, an innovative database tuned for handling IP-generated data and best-in-class analytical tools, the RSA envision platform equips companies for success in compliance and security operations. The RSA envision platform responds to the need for security and compliance intelligence at a system level and provides greater overall return on investment. For these reasons, RSA envision platform technology leads the industry in effective, proven SIEM solutions and has been successfully deployed in hundreds of organizations worldwide. Figure 1 illustrates the platform capabilities for this solution. Solution: RSA envision An Information Management Platform for Compliance & Security Operations As a full-featured, scalable, enterprise-class solution, the business value of RSA envision is realized in large-scale deployments where data event logging typically reaches thousands to tens of thousand of events per second. However, with the selection of the appropriate envision appliance, this solution can be cost effective in much smaller deployments where event occurrences range from the tens to the hundreds of instances per second. Industries that have particularly strict regulatory compliance concerns such as the insurance, financial, and government sectors can rely on integration with RSA SecurID to ensure an even more comprehensive security solution. Complete solutions in the security realm should encompass access and transaction control throughout the organization s infrastructure, as well as ensuring a clear audit trail and definitive logging of all event activity. The RSA envision platform fits well in environments where customers have a strong need to centralize and unify logging and information management activities in response to a desire for improved security, more efficient operations through greater data visibility, and enhanced regulatory compliance. Server Engineering Business Ops Compliance Audit Ris Management Security Ops Des top Ops Networ Ops Application Database Access Control Configuration Control Malicious Software Policy Enforcements User Monitoring & Management Environmental & Transmission Security Access Control Enforcement SLA Compliance Monitoring False Positive Reduction Real-time Monitoring Unauthorized Network Service Detection More Any enterprise IP device - Universal Device Support (UDS) No filtering, normalizing or data reduction Security events & operational information No agents required 18 19

11 Objection Handling FAQs The following are typical objections you might encounter while attempting to sell the RSA envision platform. Responses to these objections are included to help you keep the prospect in your sales pipeline and close the deal. We have dedicated teams in place that perform monitoring, reporting, and similar analytical activities. The RSA envision platform is a robust enterprise system that can make these activities more efficient, more responsive, and less resource-intensive. Better configuration management can also enhance your ability to meet regulatory compliance mandates. We don t need a system like this. Changing regulatory frameworks and increased incidents of data security breaches and network intrusions make it essential for every enterprise to have a security strategy that includes comprehensive real-time monitoring, intelligent logging and verifiable compliance management. We already have a system that collects and correlates events from our network devices. Event management and real-time alerting are basic features of many similar solutions, but the RSA envision platform puts greater emphasis on compliance reporting capabilities, as well as providing sophisticated real-time and forensic tools for analyzing and responding to logged event data. A platform like this will be too expensive for our organization. The capabilities of the RSA envision platform can be leveraged across multiple groups, including security, IT operations, business operations, and compliance. External specialist resources are generally not necessary to operate and maintain the platform components, which helps minimize ongoing costs. Adhering strictly to regulatory mandates can also help avoid costly fines and penalties, as well as potential loss of company reputation if data breaches go undetected. The reporting requirements in our organization are very unique and specialized. The RSA envision platform features very flexible custom reporting capabilities in addition to standard reporting functions that address the most common regulatory requirements. Even complex reporting requirements can be handled efficiently. Does the RSA envision platform integrate easily with storage systems from other vendors? The solution provides integration with NAS systems from Network Appliance (NetApp), as well as full integration with DAS- and NAS-based EMC storage systems, such as CLARiiON, Celerra, Symmetrix (with the Celerra Gateway) and Centera. EMC offers the Design and Implementation for Security Information Management service to help organizations configure the RSA envision platform with EMC storage systems. Do agents have to be installed for use with envision? The unique architecture and data collection techniques employed by envision do not require the use of agents or traditional data-filtering tools. Efficient storage of captured IP data and intelligent application of analytical tools are key to delivering real-time event information to decision makers. Will RSA envision work with security products from other vendors? RSA Security s solutions lead the industry when it comes to interoperability with other vendors products and systems. Widespread product interoperability means that the solutions can be easily incorporated into heterogeneous environments, allowing businesses to get up and running and become productive faster. What other RSA Security components work in combination with the RSA envision platform? Components that work well with this solution include two-factor authentication using RSA SecurID, RSA Security USB authenticators, RSA Smart Cards, RSA Digital Certificate solutions and RSA ClearTrust web access management. Is it difficult to deploy the RSA envision platform solution? Because of the appliance-based design and pre-testing of components, RSA envision can be set up and deployed in minimal time. Once powered up and attached to the network, it typically requires about two hours to begin logging and monitoring data events. What kind of device and application compatibility features are available? For maximum interoperability, RSA envision platform uses an open architecture framework, ensuring support for a wide range of applications, devices and storage systems. Universal Device Support includes native support for over 150 devices, with additional device support easily available. The extensible RSA envision platform log management functions can also be integrated with other SIEM components and analytical tools

12 ES-1060 Demonstration Appliances How to Quote RSA envision RSA SecurWorld Solutions Partners can purchase RSA envision ES-1060 demonstration appliances for a special price. These appliances can be used for education, training, demonstrations and pilot project deployments at customer sites. Partners are allowed to resell each demo ES-1060 unit once. RSA SecurWorld Solutions Partners can order ES-1060 kits through the My Accounts section of the RSA SecurWorld Partner Portal or through RSA SecurWorld Authorized Distributor. Maintenance on these kits is 75 percent of standard cost for Solutions Partners; Access Partners cannot purchase demonstration units. For best practices in terms of setting up, managing, and reusing the demo kit for different evaluations and live demonstrations, contact the Global Reseller Technical Account Manager for RSA Security. The current contact in this position is Dan Breslin breslin_dan@rsa.com Cost: USD RSA envision platform components can be obtained through the network of RSA SecurWorld distribution partners. For the most current pricing information, refer to the RSA SecurWorld Partner Program online price lists ( asp?id=2773) or contact your distributor directly. A complete quote for an RSA envision platform solution typically includes the following components: HH One or more appliances and associated hardware. HH Additional storage devices. For ES Series appliances, additional storage devices are optional if the estimated event activity and data retention requirements exceed built-in storage capacities. For LS Series appliances, NAS devices are required. HH Software, including Event Explorer software (to be sold only to customers who are purchasing or already own an RSA envision appliance) HH Maintenance HH Professional services Note: All RSA envision platform orders are currently shipped from the USA. Partners situated in EMEA or AP will incur additional delivery charges, based on charges to the distributor. If deliveries are made directly to a reseller or a customer, the delivery cost is charged to that reseller or customer. Follow these steps to construct a quote for a customer: Step 1: RSA envision platform hardware Determine the appropriate device or devices. a) How many network devices does the customer want to support and how many events per second do those devices generate? 22 23

13 How to Quote RSA envision The following table shows the rated capacities of the ES- and LS-series appliances: Table 1. Rated capacities of RSA envision platform appliances Model EPS Level Device Count Storage (standard usable) ES GB 12 months ES GB 6 months ES GB 2 3 months ES TB (DAS-2000) 12 months ES TB (DAS-2000) 7 8 months LS-L TB (NAS-3500) 15 months LS-L610 10, TB (NAS-3500) 7 8 months Projected Data Retention (maximum EPS and devices) Note: For all LS Series configurations, approval is required by the corresponding RSA envision Field Account Manager or RSA envision platform Sales Engineer. The complex nature of LS Series configurations makes it essential that the functionality and feasibility of selected components are appropriate to the customer s configuration and deployment plans. Step 2: Storage Requirements Does the customer need additional storage devices, based on length of data retention and anticipated events per second? Hint: For low-end appliances, such as the ES-560 model, the onboard storage is typically sufficient to support 100 devices at moderate data activity levels. For mid-range devices up to the ES-7560, additional NAS or DAS devices are generally recommended. For LS Series appliances, adding NAS is a requirement. Note: The Storage Calculator tool, an Excel workbook that is included on the RSA envision Platform Sales Training CD, provides detailed modeling of customer environments to calculate online and near-line storage requirements. Table 2. Simultaneous Event Explorer users Model ES-560 ES-1060 ES-2560 ES-5060 ES-7560 LS-A60 Max. Event 1/5 2/5 3/5 4/5 5/5 5/15 Explorer Users Note: The maximum number of Event Explorer users is not applicable to these models: LS-D60, LC-L605, LS-L610, LS-R601, and LS-R602. Hint: The number of maintenance licenses purchased must equal the number of software licenses purchased. For example, customers who purchase 3 Event Explorer licenses must also purchase 3 maintenance licenses for Event Explorer. Step 4: RSA SecurCare Determine the Type of Maintenance Coverage. a) There are two types of maintenance coverage: 1. RSA SecurCare Standard Maintenance 8:30am 5:30pm, Monday-Friday 2. RSA SecurCare Premium 24 hours x 7 days x 365 days Hint: Standard maintenance is priced at 17 percent of the appliance list price per year. Part numbers should be expressed in the format: SSP-[APPLIANCE]-12M. Premium maintenance is priced at 27 percent of the appliance list price per year Part numbers should be expressed in the format: PSP-[APPLIANCE]-12M. Note: The RSA SecurCare contract must match the user level of the RSA envision platform license. It is valid for 12 months. Step 5: Professional Services Calculate the costs of any professional services the customer will need. The chart on the next page shows the services that may be required based on the existing customer environment: Step 3: Determine the appropriate number of license seats for each of the software packages to be purchased, including Event Explorer. The number of simultaneous Event Explorer users included and the maximum for each appliance type is shown in the following table

14 How to Quote RSA envision Competitive Analysis A number of other companies offer competitive SIEM solutions, each of which has its own unique advantages and disadvantages, as discussed in this section. eep No es es Existing indows 00 Migration Replace Hardware Migration External Storage Migration New Sure Start Installation ArcSight: Solutions from ArcSight offer advanced analytics and sophisticated functionality. The ArcSight Discover module automates analysis of malicious threats and compliance violations, simplifying security and regulatory concerns. The user interface, which provides numerous ways to graphically view data, provides an effective way to correlate and assess large volumes of data events in significant detail. The architecture, however, uses a relational database back-end and employs agents. To maintain data analysis in near real-time, data must be heavily normalized and filtered. The complexity of planning and deployment is also substantial, often requiring several weeks of work and a great deal of hardware. This solution is also one of the most expensive SIEM solutions on the market. IBM Consul: Consul has been available on the market for 20 years and focuses on mainframe expertise, compliance reporting features and privileged user monitoring and auditing capabilities. It is pitched as being highly scalable, but because the product is RDBMs based, it does not scale very well. This solution is very expensive to purchase and to deploy, requiring a great deal of professional services support. The solution also lacks real-time processing and relies on a silo approach for implementations, making it ineffective at enterprise-wide security operations or large-scale data analytics. Integration is problematic, the user interface is unfriendly and the installed base is minimal. es Enhanced Availability Engagemen t LogLogic: Inexpensive solutions from LogLogic undercut RSA s 60 Series appliances on price. The modular architecture is based on appliances and is very easy to set up and deploy in a wide variety of configurations. No No No Tas Triage Engagement The tools included, however, have limited analytics with modest real-time correlation capabilities. Another weakness is the use of a relational database back-end using an intelligent queuing system. This approach exhibits all the performance and storage overhead associated with relational databases. Finally, LogLogic offers no threat detection or data correlation features, which weakens its usefulness for security purposes. SenSage: Unlike the other competitors, SIEM solutions from SenSage do not rely on a relational database for logging and monitoring data events. These solutions have scalability and data retention capabilities that are superior to all of the other competitors except for the RSA envision platform

15 Competitive Analysis Appendix A: Useful Resources The storage techniques used, however, consume far more storage space than what RSA requires for the same amount of information (on the order of six times more). SenSage solutions also have limited analytical capabilities, no correlation features and minimal reporting views. Competitive Summary: The RSA envision platform is designed to offer a comprehensive, enterprise-wide information management solution to transform log/event data into actionable compliance and security intelligence. As such, it is uniquely designed to collect, manage and analyze large volumes of log data that are managed centrally, but that can be deployed globally in a secure and efficient manner. Key attributes that uniquely position the RSA envision platform versus the competition are as follows: HH All the Data HH All the Time HH Proven, Secure IPDB HH Agent-less Architecture HH Industry-leading Scalability Local Data Capture with Global Data Analysis Fine Grained Role-Based Access Control HH Bullet-proof compliance HH Rapid time to value (TTM) and far lower total cost of ownership (TCO) HH Full ILM strategy HH Architected for both real-time and forensic data analysis with predictable, high-performance results HH Appliance-based approach that delivers a completely integrated solution PLUS: HH The proven strength and resources of EMC and RSA In direct comparison with the competition, the RSA envision platform has significant performance advantages because of innovative IPDB storage techniques, superior analytical capabilities, deployment advantages, strong scalability and a features-versus-cost ratio that delivers exceptional business value. This solution also excels at real-time and forensic applications and is unparalleled at providing an extensible management platform for compliance and security operations. In comparison with the other competitors, this solution provides exceptional total cost of ownership (TCO) values. Two categories of partnership exist: RSA SecurWorld Access Partners and RSA SecurWorld Solutions Partners. Each category has its own benefits and criteria, and requires that prospective partners meet the appropriate participation criteria and continue to comply with specific requirements throughout the duration of their membership. Presentation Materials The RSA SecurWorld Partner Portal offers highly effective, professionally designed presentation materials that drive home the key messages and enhance your sales efforts. Sales Presentations in Microsoft PowerPoint format highlight product benefits and provide a guided tour through the most important sales points. Customer case studies help your customers visualize how products may meet their specific requirements. Datasheets provide the details that an IT group or CTO may need to authorize purchase of RSA Security products. Leave-behinds offer a well-rounded, technically complete picture of our e-security products to help you close sales. RSA SecurWorld Partner Locator RSA SecurWorld Partners are experienced in delivering authentication and secure access solutions in nearly 50 countries. The RSA SecurWorld Partner Locator provides a tool for customers to find a partner that will meet their needs. To ensure your details are displayed correctly on the Partner Locator, please keep your Company Profile up-to-date by means of the MyAccount section of the Partner Portal. RSA Secured Solutions Directory and Implementation Guides The RSA Secured Solutions Directory has long been a valuable resource for corporate IT and IS directors looking for security products, and the general Internet user who is concerned about e-security. The directory lists vendor products that have RSA BSAFE encryption technologies included in their products and vendor products that are compatible with RSA SecurID, RSA Access Manager and RSA Digital Certificate technologies, as well as links to Implementation Guides for each individual product

16 Appendix A: Useful Resources Contacts RSA Online Americas Headquarters International Headquarters RSA Online is a comprehensive and evolving e-business solution to provide our customers and business partners with industry-leading access to order information and RSA Security s product catalog over the web. This service is provided at no additional charge to select RSA Security enterprise customers and partners. Separate registration is required. RSA Online offers: HH A personalized secure interface HH Real-time access to order-tracking and history information HH Quick and easy license lookups HH Proactive maintenance renewal notifications HH Same information used by RSA Security Customer Operations Corporate Headquarters RSA Security Inc. 174 Middlesex Turnpike Bedford, MA Tel: (800-SECURID) Fax: Local Offices RSA Security UK Ltd. RSA House Western Road Bracknell Berkshire RG12 1RT United Kingdom Tel: Fax: To locate an RSA Security office near you, visit this link: RSA Security Australia Pty Ltd Level 3, 110 Walker St. North Sydney, NSW, 2060 Australia Tel: Fax: RSA SecurCare Online RSA SecurCare Online is a free service for RSA Security customers with an active support contract, as well as resellers and partners. This web-based customer support application can help you find answers to your most pressing technical questions. You must be registered with RSA SecurCare Online to use this service. RSA Security Distributors A current list of RSA Security Authorized Distributors can be found on the RSA Security partner locator. To search for a distributor in your area visit: The information in this document is subject to change without notice. This document is believed to be accurate and reliable, but the statements contained herein are presented without express or implied warranty

17 RSA Security Inc. All rights reserved. RSA, RSA Security, SecurWorld, SecurID, SecurCare, envision platform, BSAFE, RSA Secured and Confidence Inspired are either registered trademarks or trademarks of RSA Security Inc. in the United States and/or other countries. Microsoft, Windows, Windows Server and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other products and services mentioned are trademarks of their respective companies. SW EG env 09 07