IBM Security Operations Center Poland! Wrocław! Daniel Donhefner SOC Manager!

Transcription

1

2 IBM Security Operations Center Poland! Wrocław! Daniel Donhefner SOC Manager!

3 IBM can provide unmatched global coverage and security awareness! 4,300 Strategic outsourcing security delivery resources 1,200 Professional services security consultants 650 Field security specialists 400 Security operations analysts 10 Security research centers 10 Security operations centers 14 Security development labs IBM X-Force Expertise Managed Services Excellence 150M intrusion attempts daily 20,000+ devices under contract 46,000 documented vulnerabilities 3,700+ MSS clients worldwide 40M unique phishing / spam attacks 15B+ events managed per day Millions of unique malware samples 133 monitored countries (MSS) Billions of analyzed web pages Unique research and reports security patents

4 IBM Own Experience! IBM has one of the largest, most complex internal IT infrastructures in the world 2,000-plus major sites 170-plus countries 400,000-plus employees About 200,000-plus contractors 800,000-plus traditional endpoints About 50 percent of employees are mobile Major employee sites Customer fulfillment Manufacturing Employee Service Centers IBM Research Centers IBM Internal Data Centers

5 IBM s history with security intelligence! IBM manages individual customer SIEM environments Internet Security Services (ISS) formed IBM launches Managed Security Services MSS launches Realtime Event Distribution Infrastructure (REDI) 2004 ISS launches Cloud based SIEM 2005 IBM launches Managed SIEM ArcSight 2006 IBM acquires ISS and IBM migrates 450 outsourcing customers to MSS/ISS 2010 IBM launches Cloud SIEM with PCI support, IP Reputation and Suspicious Host Reporting 2012 IBM launches standard Managed SIEM 2012 IBM buys Q QRadar adds Big Data IBM has over 20 years in security outsourcing and 10 years experience in security log management and event correlation using various platforms & solutions

6 Our solutions address the full security intelligence timeline! What are the external and internal threats? Are we configured to protect against these threats? What is happening right now? What was the impact? Prediction & Prevention Risk Management Vulnerability Management Configuration Monitoring IBM X-Force Threat Intelligence Compliance Management Reporting and Scorecards Reaction & Remediation SIEM Log Management Incident Response Network Anomaly Detection Packet Forensics Database Activity Monitoring Data Loss Prevention 6

7 And this experience has resulted in recognition from the marketplace! Security Consulting Managed Security Services IBM has the largest client base of the participants... Clients praised the flexibility, knowledge, and responsiveness while also noting the company s excellent documentation. Organizations looking for a high-quality vendor that can do it all and manage it afterwards should consider IBM. Source: Forrester Research Inc. Forrester Wave TM : Information Security Consulting Services, Q And Forester Wave: Managed Security Services providers Q1, Full report can be accessed at

8 Global Security Operations Center! Atlanta, USA! Boulder, USA! Hortolandia, Brazil! Costa Rica! Saudi Arabia! Bangalore, India! Brussels, Belgium! Wroclaw, Poland! Brisbane, Australia! Tokyo, Japan! Security Operations Centers Security Research Centers Security Solution Development Centers Institute for Advanced Security Branches

9 SOC Poland! Facility fully operational! Official opening in Sep 2012! Service operative since November 2011!

10 Managed Security Services! Monitoring! Security Events! Management! Security Devices! In The Cloud (excl. MSIEM)! Security Event Logs! Vulnerability Scanning! Asset Based! Global! Standardized! SLA driven!

11 Definition of a Security Incident! Threat Analysis! A high-risk attack, network misuse or other network traffic pattern that violates a customer s Security Policy for acceptable network use.! Security Investigation! Security Alerts generated by AI Engine through Correlation Rules and investigated by Threat Analysts using the Unified Console / QRadar! SLA bound Incident Escalation! Escalation! Advisory! Interactive follow-up!

12 Security Intelligence: integrating data across IT silos to create actionable information! Security Devices Servers & Hosts Network & Virtual Activity Database Activity Application Activity Configuration Info Vulnerability Info Event Correlation Logs IP Reputa1on Flows Geo Loca1on Activity Baselining & Anomaly Detection User Ac1vity Database Ac1vity Applica1on Ac1vity Network Ac1vity Offense Identification Credibility Severity Relevance User Activity High Priority Offenses Extensive Data Sources Deep + Intelligence = Excep5onally Accurate and Ac5onable Insight

13 Device Management! Remote Management of Security Devices! Firewalls! IDS/IPS Sensors! Unified Threat Management (UTM) Appliances! QRadar! VMS appliances! SLA bound Outage Monitoring! Troubleshooting and Issue Resolution! SLA bound Policy Management! Proactive Health Checks!

14 SOC 24/7/365 Global Coverage! Global Management System 1 st Shift 2 nd Shift 3 rd Shift Atlanta Brussels Brisbane Brisbane Boulder Toronto Hortolandia India India Southfield Tokyo Poland

15 Supported Security Platforms Best Of Breed!

16 SOC Methodology! Every SOC task is a ticket.! This ranges from a firewall change to a simple question.! Every single action is documented in the ticket s audit log.! Audit log is read-only, only adding is allowed.! All tickets, including full audit log is available to the customer through the portal.! Makes real time follow-up by customer possible.!

17 Contact the SOC 24/7! Portal Ticketing System! Telephone! Global ! local numbers available! ! Chat! Webbased, through Portal! Security Service Manager! Will be assigned!

18 Thank you!