SIEM and Vibrant:Driving the Ahead

Transcription

1 An ENTERPRISE MANAGEMENT ASSOCIATES (EMA ) Research Report Written by Scott Crawford, EMA Managing Research Director May 2012 IT & DATA MANAGEMENT RESEARCH, INDUSTRY ANALYSIS & CONSULTING

2 Table of Contents Research Summary... 1 Where Data-Driven Security is Unfolding... 2 Powering Insight... 2 Looking Ahead... 3 Vigilant: Enabling Data-Driven Enterprise Security... 4 Overview of Offerings... 4 Foundations... 4 Products and Services... 5 Company Distinctives... 6 EMA Perspective... 6

3 Research Summary Information security has long been hamstrung by obstacles unknown to many other aspects of the enterprise. Businesses may be able to measure sales performance or better understand competitive factors and customer preferences through data mining or other analytic techniques. Security, however, often wrestles with the unknown and struggles with a daunting array of exposures and threats. In a survey of 200 technology and business professionals who participate in information security efforts among organizations of 1,000 personnel or more worldwide, Enterprise Management Associates (EMA) found that: The majority (52%) say they are no more than somewhat confident they could detect an important security issue before it has an impact. Twelve percent are neither confident nor doubtful, while 7% report greater doubt than confidence. Too difficult to distinguish legitimate from malicious activity is the most frequently mentioned frustration with security practices (33% of all respondents). Twenty-eight percent of respondents are about as unsuccessful as they are successful at correlating security data to business impact. Four percent are more unsuccessful than successful. Fifty-seven percent of respondents must devote unplanned work to security incident response above and beyond normal investigative activities more than twice a month. One-third (33%) must do so at least weekly; 12% do so every day. How can security do better? There is one thing that would help immensely in answering that question: data. Accurate and timely information that illustrates how and where attacks as well as defenses succeed, highlights where they fail, and clarifies where response can best be improved. Security technologies that employ this data directly in defense. Management strategies better informed by data-driven insight. These capabilities are more within reach than ever before. The data explosion is just as real in security as elsewhere and EMA survey data suggests that organizations are doing more than seeing the opportunity. They are engaging fully in the rise of a data-driven approach to security defense and management. The need is great: Fifty-eight percent of respondents knowledgeable about security log and event data management in their organization indicated that they collect 50 gigabytes or more each day. When measured in number of logged events (assuming an average size of 300 bytes for each), this equates to more than 166 million events daily. Fifteen percent of this group collects an average of a terabyte of data or more each day. Considering that all respondents represent organizations of 1,000 employees or more 28% of whom represent enterprises of 20,000 or greater these figures may not be as astronomical as they may sound. At the same time, organizations see the potential today s approaches offer for turning this avalanche into an asset: Seventy-three percent of respondents would collect more security-related data, or a wider variety of data, if they could make use of it. Thirty-eight percent are currently expanding their investment in better security data management and analytic technologies. Another 40% plan to expand this investment in the next one to three years. Seventy-three percent of respondents would collect more security-related data, or a wider variety of data, if they could make use of it. Page 1

4 Thirty-two percent are currently expanding their investment in the expertise of their personnel in security data management and analytics. Another 44 percent plan to expand this investment in the next one to three years. Organizations of all sizes and capabilities may benefit from the investment that vendors of security technologies and services are making in data-driven security. The largest number of respondents (48%) expect security technology vendors to lead the way in expanding data-driven security more than any other entity (including enterprises and government organizations) in the next one to three years. Forty-six percent expect this leadership from providers of professional and managed security services. Where Data-Driven Security is Unfolding EMA sees the rise of data-driven security emerging in three primary domains: Data-driven tactics which differ from legacy security technologies in part by their focus on a more continuous, dynamic dependence on data sources and data analysis. Data-driven platforms for security management and strategy guidance that may be expected to expand techniques for yielding more effective insight from large amounts of many different kinds of data. Data sources to serve these interests, which can be expected to grow in their variety, as well as in the variety of ways they are made available as offerings in their own right. Security tactics are turning to data to improve the effectiveness of defense. Security technologies are deployed in thousands of organizations and on millions of systems. This gives their vendors unique insight into factors such as widely accepted software, attack prevalence, and malicious behavior. Anomalies can be spotted much more quickly against this background, enabling data-driven tactics to identify outbreaks, speed defense and limit impact. Security vendors are embracing large-scale data management platforms and advanced analytics to support these initiatives. Security management, meanwhile, can benefit from expanded capabilities for handling large data sets, which unlocks new possibilities for finding artifacts that may otherwise be overlooked. Responsive data management platforms and flexible analytics enable investigators to pursue a wider variety of what if? scenarios and branch into new directions as analysis progresses. Strategists see the potential of mining a wide variety of data to identify issues such as heightened exposures, aspects of the enterprise at highest risk, trends such as fraud, and where chains of causality can be most efficiently broken. Powering Insight What are the emerging techniques security vendors and enterprises alike are turning to in order to make the most of the opportunity? While the extent of adoption was not explored and merits further study (Are these lab or proof-of-concept deployments, or are they in production? Are they exclusive to security or shared?), the answers were surprising regardless and data management as well as security vendors may take note: Seventy-nine percent of those collecting security log or event data use Security Information and Event Management (SIEM) technologies. In addition, 50% of all respondents report that they are already employing enterprise data warehouses to at least some extent in support of security efforts. Page 2

5 Forty-nine percent of those whose primary role is in information security are using analytical databases. Twenty-six percent of all respondents report the use of NoSQL and Hadoop environments. Another 28% plan to evaluate these environments for security data management. Among the analytic tools in use among all respondents: Fifty-five percent report the use of Business Intelligence (BI) tools in some way to support security efforts. Forty-three percent indicate they use analytic platforms such as the open source R. Thirty-eight percent report using some form of risk analysis or modeling. Thirty percent use machine learning and data mining tools such as Apache Mahout. Given this variety of techniques and the scale of interest, it may not be surprising that 37% of all respondents report that they currently use service providers specifically for security data management capabilities such as Managed SIEM and security intelligence services, while another 30% plan to evaluate service providers for this purpose. Looking Ahead With the interest in the trend high and growing, data-driven security is poised to expand even farther: Major security vendors are offering services that harness Big Data, NoSQL and massively parallel architectures to improve effectiveness and provide intelligence. New offerings are arising to offer Big Data security analytics as a service, harnessing the power of these platforms for rapid and flexible analysis across large or diverse bodies of data. How is the relevant expertise in security and data analysis evolving? Interviews with practitioners where data-driven efforts are becoming well established indicate that it is often a cooperative effort. Many organizations currently embrace a working model where security subject matter experts work with data analysts experienced in quantitative methods, data mining, data visualization, or related fields. 72% of all respondents currently embrace this model to at least some extent, with 34% indicating that their security experts and data analysts work together on a regular basis. One of the challenges of data-driven security is the dilemma of data sharing. Organizations see the opportunity represented by data such as data breach investigations, but have concerns about exposing sensitive information to risk. Among the initiatives pioneering a balanced approach are the Financial Services Information Sharing and Analysis Center (FS-ISAC) and data fusion centers in government and law enforcement. Sharing is just one aspect of responsible security data management. Businesses should recognize that their data collection and management practices may lead to the custody of data that requires just as much care (if not more) than any other managed by the organization. As they embrace more data-driven efforts, organizations should be recognizing these realities now. In interviews with practitioners pursuing these initiatives; reviews of articles, books and documents that describe emerging data-driven approaches; and a survey of 200 involved professionals worldwide, EMA sees that the rise of data-driven security is more than a trend. It is becoming a mainstream factor among many enterprises. Many more organizations, regardless of size or capability, stand to benefit as data-driven security exerts a transformational influence over security technologies, services and practices emerging today, and evolving tomorrow. Page 3

6 Vigilant: Enabling Data-Driven Enterprise Security As with today s trends toward adoption of new approaches to Data-Driven Security, early adopters of Security Information and Event Management (SIEM) saw great promise in its potential. They also soon discovered its challenges. The integration of multiple technologies for effective monitoring, alerting and reporting requires a level of capability and expertise that many organizations find demanding. These challenges have led vendors to respond with richer sets of out-of-the-box capabilities intended to ease SIEM adoption, but many customers continue to lack the organizational or process maturity needed to develop an effective level of visibility into security data specific to their environments. This continues to inhibit many organizations from making the most of the SIEM investment for tackling their business risk challenges. Vigilant was founded in 2003 to provide organizations with the expertise needed to overcome these obstacles to more effective SIEM deployment. The company was one of the first to market with a co-sourcing model for managing SIEM to provide needed expertise while ensuring customer control over security data. Vigilant was also one of the first to extend the use of SIEM platforms into business risk intelligence, through work such as pioneering the development of fraud detection solutions with financial institutions through the integration of traditional security data with transactional information. Today, Vigilant is one of the most successful companies helping organizations to manage security risk through better insight into security data. The company s success has been driven in part by a visionary approach to security data management, through pioneering initiatives such as Collective Threat Intelligence, an offering that provides Vigilant customers with a consolidated, enriched threat feed that is designed for integration into a centralized security intelligence console. Vigilant was among the first to market with such an approach, which aligns security intelligence with an organization s own security data management strategy. Vigilant primarily serves large enterprises with very sensitive IT risk profiles. Its clients include more than 200 Fortune 1000-level organizations, including 25 percent of the Fortune 50 and half of the 10 largest American and European banks. Headquartered in Jersey City, New Jersey, Vigilant has a global presence with a sales footprint across the U.S., Western Europe, and South Asia. Earlier this year, the company established Vigilant Europe Ltd. as its U.K.-based entity. The company s success testifies to its reputation as a source enterprises trust for proven practices and expertise in the deployment and use of security data management technologies on-premise as well as managed services, augmented by threat intelligence feeds. Overview of Offerings Foundations Vigilant maintains a Security Intelligence Hub in its operations center, comprised of three interactive components: The Fulcrum Framework is a dynamic library that houses pre-built monitoring use cases of rules, filters, reports, dashboards, and other components that enable rapid configuration of leading SIEM platforms. The monitoring use cases are pre-mapped to a wide range of standards and regulations, as well as best practices that have emerged through Vigilant s years of project engagements. Page 4

7 The Threat Analytics Engine collects, processes, enriches and manages the output of threat intelligence to enable a single point of prioritized alerting through a wide range of security monitoring technologies. The Client Response Engine stores awareness of each customer s security monitoring program to enable reporting, incident response support, and dynamic re-instrumentation of the customer monitoring environment in response to changing threats or business priorities. These components interact to enable continual updating of the client monitoring environment as new threats are detected and analyzed (both within the client environment and in the wild ), and as new best practices emerge whether driven by emerging technologies, or advances in regulatory or other standards. Clients interact with all three components via Vigilant s Fusion client portal. Products and Services Vigilant provides a range of managed, consulting and threat intelligence services that enable organizations to realize greater value from security-relevant information and build maturity in security data management and analysis. Vigilant s Managed Services leverage the Fulcrum Framework to bring the benefit of expertise to the management of security event and activity data. Fusion for SIEM provides a flexible set of subscription services that help with a variety of SIEM and security data management challenges, from routine administration to advanced use case development. These services are distinguished by a co-sourcing model that utilizes SIEM and security data infrastructure residing on the customer s premises. Competing services often impose proprietary data collectors on the customer s environment and extract security-related data to the service provider s data center. Vigilant s co-sourcing approach improves the customer s control over their own data, enhances access and visibility, and expands continuity options in the event customers should later choose to in-source or switch to a different provider. Collective Threat Intelligence (CTI) provides global threat intelligence via enriched feeds designed for integration and correlation with an organization s internal security intelligence. Automated enrichment routines de-duplicate, correlate, normalize, validate and prioritize this information and augment it with human analysis. Collective Threat Intelligence is available as a standalone subscription, or as part of Fusion for SIEM managed services, making diverse intelligence actionable through CTI use cases in a dynamic, automated solution tailored to each customer s environment. Vigilant provides a range of consulting services to enable organizations to increase their maturity in security data management and expand capabilities. Offerings include Target Capabilities Assessment to help organizations define and achieve their security data management objectives; Security Program Planning and Management to build maturity in security strategy; Security Monitoring Build Services and security technology design and integration to help organizations deploy security information technologies more effectively; and Application Security Monitoring Enablement services that help organizations define an approach to monitoring the security of Web and other applications central to today s security strategies. Page 5

8 Company Distinctives In articulating its vision, Vigilant talks about five fronts of perpetual change both internal and external that frame the central challenge facing security and IT risk management professionals: the threat environment, the access matrix, the user base, business requirements, and IT technologies. In confronting this volatile and complex mix of factors, security teams must wade through enormous amounts of data to identify, analyze and act on what matters most in the protection of key business assets. The central challenge, according to Vigilant, is to establish agile and focused monitoring and analytic capabilities that yield actionable intelligence out of a highly dynamic, data-rich environment. Vigilant specializes in helping organizations through a process of maturing their capabilities to gather the right data and utilize it effectively. To help clients build those capabilities, Vigilant: Helps its clients build risk-driven internal security intelligence, integrating traditional security data with business information. Provides external threat intelligence, highly enriched and pre-formatted for actionable output to SIEM and other monitoring technologies. Provides a range of operational guidance and support from front-end risk alignment consulting, to ongoing management of the monitoring infrastructure, to in-depth incident analytics and threat response. Vigilant continues to invest heavily in its Security Intelligence Hub to support these capabilities. The company continually refines its ability to prioritize and contextualize threat information to improve actionability. The expanding functionality of the Vigilant client portal helps customers manage their security intelligence programs and supports a range of incident response functions. Vigilant combines automated tools and human intelligence to: Leverage years of accumulated expertise, providing a solid foundation that enables clients to build monitoring capabilities more rapidly. Enable a risk-oriented, client-centric approach, reserving project resources where most needed to customize client security data management for maximum impact. Participate in a continual learning community that supports the rapid adjustment of monitoring and intelligence capabilities as conditions change. EMA Perspective Today s enterprise faces enormous security challenges in light of an overwhelming explosion in the sheer volume and variety of threats. At one end of the spectrum, the more sophisticated adversary has the resources and capabilities to target specific exposures with high precision, carefully amassing a position of often unsuspected strength for exploiting high-value targets. At the other end, the commoditization of industrialized attacks has not only multiplied the volume of exploits, it has also raised the illicit market for malicious software and services to a virtual par with the legitimate commercial software industry, at least in terms of product packaging and the increasing availability of services to support criminal activity. This represents only the external threat. Inside the organization, businesses must maintain vigilance over how information assets are accessed and used particularly considering how attackers can exploit legitimate access privileges for malicious ends. Page 6

9 EMA believes that, without a data-driven approach to security, enterprises face obstacles in tackling these challenges that in some cases may well be insurmountable. Organizations need insight into malicious activity, as well as into their own security efforts. They need this insight to be actionable, enabling them to turn an avalanche of data into useful intelligence. They need these capabilities not only to manage security strategy, but also to harness them directly in the tactics of defense. For all these reasons, EMA sees in the rise of data-driven security a trend that is already transforming the nature of defense, and bringing new maturity to efforts to base security strategy on objective insight. Vigilant is not only focused on these imperatives, it recognizes the critical role that human interaction plays in security data management. Security data can be harnessed directly in the technologies of defense, but without investing data with meaning and context, it is effectively useless for developing strategy or prioritizing response. The problem is further compounded by the sheer volume of securityrelevant data available to organizations today, from inside the enterprise as well as from a wide variety of external sources. Vigilant recognizes that security data management is only as effective as an organization s expertise, capability and maturity in relevant disciplines of technology and practice. The company understands that many frustrations with the highly developed technologies of security information management arise not from the capability of the platform, but from the obstacles organizations face in building the right expertise. Vigilant also sees future directions of security information management predicated on the ability to integrate and rationalize large and diverse sets of fast-moving data in real time. The company s Collective Threat Intelligence initiative was one of the first to recognize the potential of this aspect of data-driven security. Organizations that recognize the value of the trend will therefore want to keep an eye on Vigilant s future directions, as it continues to advance a well-informed strategy that enables its clients to make the most of a wide and diverse spectrum of highly dynamic security data. With its development of innovative technology platforms such as Collective Threat Intelligence, as well as through its continued refinement of security information management practices, Vigilant stands out as a provider that understands both the breadth and depth of capability required to make the most of the data-driven security opportunity. About Enterprise Management Associates, Inc. Founded in 1996, Enterprise Management Associates (EMA) is a leading industry analyst firm that provides deep insight across the full spectrum of IT and data management technologies. EMA analysts leverage a unique combination of practical experience, insight into industry best practices, and in-depth knowledge of current and planned vendor solutions to help its clients achieve their goals. Learn more about EMA research, analysis, and consulting services for enterprise line of business users, IT professionals and IT vendors at or blogs.enterprisemanagement.com. You can also follow EMA on Twitter or Facebook. This report in whole or in part may not be duplicated, reproduced, stored in a retrieval system or retransmitted without prior written permission of Enterprise Management Associates, Inc. All opinions and estimates herein constitute our judgement as of this date and are subject to change without notice. Product names mentioned herein may be trademarks and/or registered trademarks of their respective companies. EMA and Enterprise Management Associates are trademarks of Enterprise Management Associates, Inc. in the United States and other countries Enterprise Management Associates, Inc. All Rights Reserved. EMA, ENTERPRISE MANAGEMENT ASSOCIATES, and the mobius symbol are registered trademarks or common-law trademarks of Enterprise Management Associates, Inc. Corporate Headquarters: 5777 Central Avenue, Suite 105 Boulder, CO Phone: Fax: Vigilant Page 7