How can we protect our company from proliferating threats without compromising access or increasing our security budget?

Transcription

1 SOLUTION BRIEF: CA THREAT MANAGEMENT How can we protect our company from proliferating threats without compromising access or increasing our security budget?

2 CA Threat Management is a comprehensive and integrated solution that deals with known and unknown threats and provides easy management of multiplatform endpoint protection from a single console. Copyright 2007 CA. All rights reserved. All trademarks, trade names, service marks and logos referenced herein belong to their respective companies.

3 Overview Challenge Solution Benefits Proliferating threats are finding easy targets among increasingly diverse endpoints and mobile user populations. Viruses, worms, spyware, Trojans, rootkits and other malicious code threaten system performance and user productivity and put sensitive information, intellectual property, and even regulatory compliance at risk. Threats can t be stopped entirely, so they must be managed effectively and efficiently, and within the confines of existing IT resources. The CA Threat Management solution is a comprehensive set of tools for endpoint threat protection. Components include combined anti-virus and antispyware software, a contentfiltering gateway, and an intrusion detection and prevention system integrated with a software firewall. Designed to complement one another, these tools use common or similar web-based consoles for easy administration. They offer robust reporting capabilities and the broadest language and endpoint platform support in the industry. Consolidating threat management under a single intuitive interface, you reduce the risk of successful attacks and improve the risk profile of your entire organization. Service interruptions are avoided, critical information assets are protected and service continuity is assured. By dispensing with multiple point solutions, you reduce administrative overhead and save time and money. Having such a powerful threat management system in place can also help with regulatory compliance. CA Advantage The CA Threat Management solution is a set of best-in-class threat management products that provide comprehensive endpoint protection and use common or similar web consoles. Like other CA management products, they are designed to complement one another, share management resources and reduce administrative overhead. The solution offers the broadest available support for Windows and non-windows platforms and languages, and is backed by a CA Technology Services practice team and by CA Education. CA Threat Management is an integral part of CA s much broader enterprise security management solutions, which are a key pillar of CA s Enterprise IT Management (EITM) initiative. EITM helps you unify and simplify your entire IT management environment, using a vendor-neutral service-oriented architecture platform that supports CA and third-party products and your homegrown solutions across virtually any system platform. Next Steps For more information on how the CA Threat Management solution can help you provide comprehensive threat protection to diverse user populations and endpoint types while improving user and IT productivity, visit us at ca.com/solutions. SOLUTION BRIEF: CA THREAT MANAGEMENT 1

4 CHALLENGE Threats are Evolving and Doing More Damage In the Internet economy, the two things we can always be sure of death and taxes have been joined by a third: electronic threats. There seems to be a never-ending supply of tricksters and cybercrooks determined to vandalize or control our computer systems and networks. Simple viruses have morphed into complex, blended threats, created by individuals and organizations with far more sinister aims than widespread notoriety. And the volume of this malicious output seems to be expanding exponentially on a daily basis. A recent survey of IT executives at major corporations found a 48% increase in malware attacks in 2006, and a growing variety of threats as well. Similarly, the 2006 CSI/FBI Computer Crime and Security Survey reports that virus attacks are the source of greatest financial losses from security breaches, followed by unauthorized access; laptops and other mobile endpoints; and theft of intellectual property. Point Solutions are Inefficient and Ineffective When viruses, spyware and other malware first emerged from the electronic underground, specialized threat management products were developed for each of them. Stand-alone solutions providing host-based personal firewalls, intrusion detection systems and intrusion prevention systems at the network perimeter also appeared. Installation and ongoing administration is labor-intensive when only one product is involved; repeating the process several times is a huge IT burden. Even worse, this fragmented approach to threat management is ineffective against the newer blended threats that use complex combinations of attacks to spread. Almost any activity that involves any interaction between a client device and the outside world creates the potential for infection. The range of malicious software ready to pounce is quite broad including viruses and worms, spyware and adware, browser hijackers and browser helper objects, downloaders, droppers, keyloggers, password crackers, rootkits, Trojans and remote-access Trojans (RATs) but the lines are starting to blur. The distinctions between one type of malware and another are getting harder and harder to make as the threats borrow, combine and blend with one another. Most Threats are Unknown Traditional threat protection products are largely reactive, comparing signatures of known threats to content that users have already downloaded. While these tools are still very important components of threat management, the lion s share of threats are initially unknown, with no available signatures. Anti-virus and anti-spyware products must be complemented with more proactive technology that can monitor systems to detect anomalous behavior and misuse, and protect client endpoints against targeted application-level attacks. Businesses are also being threatened from within by employees engaging in unproductive or even criminal activities. On the Web front, these include visits to inappropriate sites, unsanctioned peer-to-peer networking and big file downloads that have nothing to do with work. Employees can also be deliberate or inadvertent conduits for the theft of sensitive information or intellectual property, and compact USB storage devices like flash memory keys and ipods serve as accessories to such crimes. A robust content security solution is imperative, both for business survival and regulatory compliance. 2 SOLUTION BRIEF: CA THREAT MANAGEMENT

5 Connect Threat Control with Broader IT Management Truly effective threat management and even overall security management cannot exist in isolation. Its value multiplies when it is implemented as part of a comprehensive IT management strategy covering many disciplines. To leverage the different management disciplines and optimize the performance, reliability and efficiency of your entire IT environment, you need tightly integrated control and management of all functions, including security, operations, applications, storage, and life cycle and systems management. SOLUTION Simplify Threat Protection with an Integrated Solution To deal effectively with the rapidly evolving threat landscape, a threat management solution should consist of tightly integrated components that provide comprehensive threat protection while forming a much broader security and enterprise IT management platform. Comprehensive Threat Management You need to take a concerted approach to security at all levels, using a flexible, well-rounded, and multilayered solution to protect endpoints both on and off the network. Malware and other threats can be managed much more efficiently and cost-effectively when you tackle them in a centralized and common manner. Great efficiencies come with combining functions like anti-virus and anti-spyware into a single product under one web-based console with a common client agent and common logging facilities and updating tools. A common architecture allows the different solution components to complement and leverage one another, and centralized management enables easy installation, software updates, streamlined policy creation and deployment. Tackling Unknown Threats For protection against zero-day attacks and other unknown threats, you need to augment signature-based products with behavior-based technologies that can detect anomalies and prevent suspicious code from running. These solutions need to be flexible enough to adapt themselves to your business processes instead of the other way around, so you can protect systems without disrupting the user population. The best solutions blend personal firewall software with intrusion detection and intrusion prevention to create a powerful, centrally managed host-based tool that protects clients on and off the network. Enterprise-class products will also offer very granular options for policy creation and enforcement. Managing the Threat Within Stick to the same simplification theme and look for a content management solution designed to handle virtually every content security issue facing enterprises today. These include spam, phishing, malicious mobile code, peer-to-peer file sharing, misuse of confidential data, intellectual property theft and inappropriate Internet use. SOLUTION BRIEF: CA THREAT MANAGEMENT 3

6 The ideal content management solutions are highly customizable. Business-driven policy engines and centralized policy management will help you create your own rules for incoming and outgoing and web access. By managing such a wide range of threats effectively through one integrated content management solution, you can protect your business against confidential data losses while improving employee productivity, helping ensure regulatory compliance and optimizing the use of IT resources. Highly Scalable and Across Diverse Client Populations A comprehensive threat management solution must scale to meet the needs of the largest global enterprises, and support environments with diverse endpoint platforms and a mixture of user languages. The solution should protect your network both at the endpoint and the gateway, enabling you to safely manage and protect against a multitude of threats known and unknown. The CA Threat Management Solution Covers All Your Bases The CA Threat Management solution meets and defeats a multitude of threats targeting your enterprise and users. This comprehensive and integrated solution employs both endpoint- and gateway-based software to provide the best endpoint protection available. Figure A illustrates how the CA Threat Management solution protects an organization from the public network down to the computing systems at the endpoint; the core remains protected, which is the intellectual property, i.e. assets that cannot be compromised. FIGURE A The CA vision for integrated threat management defines solutions for both the endpoint and the gateway. A COMPREHENSIVE THREAT MANAGEMENT PLATFORM 4 SOLUTION BRIEF: CA THREAT MANAGEMENT

7 Endpoint-Based Threat Protection The components of CA s Threat Management solution provide a multilayered defense against known and unknown threats. CA Threat Manager, CA Anti-Virus, CA Anti-Spyware and CA Host-Based Intrusion Prevention System focus on attacks from a wide variety of malware. CA Anti-Virus CA Anti-Spyware CA Threat Manager CA Host-Based Intrusion Prevention System (CA HIPS) When deployed in stand-alone mode, CA Anti-Virus provides comprehensive anti-virus security for enterprise PCs, servers and PDAs. The software combines malware protection with powerful management features that stop and remove malicious code before it enters your network. You can manage diverse client environments of any size from a single web-based console, which provides a complete view of your enterprise anti-virus situation in a convenient dashboard format. CA Anti-Spyware is a powerful solution that protects your systems from spyware, keyloggers, hacker tools, and from annoying pests like adware that can tie up system resources. The software protects confidential business information, improves PC and network performance and reduces calls to the help desk. Highly scalable, CA Anti-Spyware is managed centrally from a web-based console, and is easily deployed worldwide across client platforms. This solution uses the best-of-breed CA Anti-Virus and market-pioneer CA Anti-Spyware products and combines them under a central, web-based management console to create an integrated whole that is much more powerful than the sum of its parts. CA Threat Manager extends to both components a common agent as well as common logging facilities, reporting and updating tools. Up-to-the-minute updates can be sent to protected endpoints automatically as new viruses, spyware and other malicious code are identified. This is an innovative combination of a stand-alone firewall and a comprehensive host-based intrusion detection system (IDS) and intrusion prevention system (IPS). It delivers superior endpoint protection through centralized access control and policy enforcement, and by proactively identifying and preventing the malicious behavior characteristic of malware. The IDS stops known threats while the IPS capabilities enable you to automatically react to unknown threats and block suspicious traffic. Gateway-Based Threat Protection While protecting the endpoint is vital, it is not the only point of entry into a network. The first line of defense for any organization is the gateway. You need to make sure your employees are not visiting sites loaded with spyware, or ing sensitive company information to outsiders. CA Secure Content Manager (CA SCM) This content security gateway solution addresses all and web content threats and manages them remotely. This comprehensive and multilayered solution safeguards against the external transmission of proprietary, controlled, or confidential information. It can also prevent intellectual property leakages and assist with regulatory compliance. CA SCM enforces proper web behavior, screening outgoing traffic and URLs for business-appropriate activity, and minimizes non-productive web surfing and file downloads. CA SCM gives productivity a further boost by protecting against unwanted and unsolicited . Enhanced layers of spam filtering include sender reputation, embedded URL filtering, malformed detection and an evasion techniques dictionary. SOLUTION BRIEF: CA THREAT MANAGEMENT 5

8 BENEFITS Reduce Risks While Lowering Security Costs With CA Threat Management, you can address a wide range of computer threats, attacks and malicious code from the endpoint to the gateway, with one centrally managed solution that is cost-effective and efficient. Key benefits to be realized include: RISK MITIGATION By reducing the threat of various attacks, you greatly improve the risk profile of your entire organization. Lowered IT risks translate to lowered corporate risks, which can have a significant impact on your company s overall market and financial position. Instead of needing multiple solutions and several technicians to combat viruses and spyware and managing updates for several different security solutions we now have a single staff member taking care of our entire node user network. With CA Threat Manager r8, we have been able to reduce operational costs by more than 10 percent while fully protecting our critical systems. ASSET PROTECTION Your business operations depend upon computer and network systems, web applications, and critical system files and repositories. These IT resources must be protected from unauthorized access and malware attacks since an attack on them is an attack on the business itself. COST REDUCTION By greatly reducing the threat of successful attacks, you can reap significant financial benefits. Users and the IT staff become more productive because they spend less time dealing with attacks. Meanwhile security administration is much more efficient, because administrators and help desk personnel spend a lot less time in reactive mode, dealing with the aftermath of a successful attack. SERVICE CONTINUITY Computer attacks can and in fact often seek to have a dramatic impact on the availability of critical enterprise IT services. The result can vary from an employee losing an hour of productivity while cleaning up an infected machine, to the catastrophic loss of a multi-million dollar financial transaction because a key application is shut down. REGULATORY COMPLIANCE End-to-end security of the entire corporate IT infrastructure is a fundamental part of business regulations today. Auditors are looking for strong, effective IT controls that can detect, remediate and monitor the existence of software attacks of all kinds. Given the growing complexity of both the attacks and the IT environment, comprehensive and integrated threat management is essential for regulatory compliance. Chuck Slenker Systems Engineer at Hartford Hospital, one of the largest Medical Centers in New England 6 SOLUTION BRIEF: CA THREAT MANAGEMENT

9 CA ADVANTAGE Drawing upon its renowned expertise and long-standing leadership in vendor-neutral enterprise IT management, CA has created a set of threat management tools that unify and simplify threat protection while playing an integral role in CA s broader enterprise security portfolio. CA stands alone in its ability to support multivendor, multitechnology infrastructures, and addresses the management needs of everything from mainframes, data centers and network operations centers to distributed computing and mobile devices. From Security to Integrated IT Management Threat Management and the rest of CA s security solutions comprise a core pillar in CA s EITM vision. EITM is charged with unifying and simplifying the deployment, use and integration of not only all management solutions and tasks, but also the tasks and processes that surround IT management. EITM provides comprehensive, integrated management of every aspect of IT in the context of your particular business. It takes IT management to an unprecedented level, pulling the components of Threat Management into a concentrated whole that is worth much more than the sum of its parts. You can reduce risks, manage costs, improve service and align IT investments with business priorities. A 2007 ROI study by IDC reveals significant savings from the use of CA s EITM solutions across five key functional areas. The payback period averaged a short 8.6 months, and the ROI averaged 398%, reports IDC. These results clearly demonstrate the direct benefits realized by the CA EITM software products. The most significant benefit generated by the CA management products is the automation of IT tasks and the subsequent increase in IT automation, reports IDC. 1 REALIZE VALUE WITH CA EDUCATION As part of our service offerings, CA Education a preferred source for IT management and best practices training can help you realize the greatest value from your Threat Management investments. We assess your training needs, create the right plan with the required course offerings, and optimize training through advanced learning programs and industry certifications. The cornerstone of CA Education is the Unified Learning Approach, which features five important steps: 1. Determine business goals and IT requirements 2. Determine an organization competency level required to achieve these goals considering people, process and technology requirements 3. Assess individual staff competency levels using CA software and IT best practices in Education Needs Assessment 4. Evaluate and measure staff post-training knowledge and skills 1 Source: IDC, Achieving Business Value and Gaining ROI with CA s EITM Software, #205383, January, 2007 SOLUTION BRIEF: CA THREAT MANAGEMENT 7

10 NEXT STEPS If you re finding that: Battling the onslaught of viruses, spyware and other malware in reactive mode, using multiple point solutions that each have to be managed and updated separately, is too costly, ineffective and potentially dangerous. Traditional anti-virus and anti-spyware solutions are no longer enough to protect your client devices against targeted zero-day application-level attacks. You don t have enough control over incoming and outgoing message content to block spam and web messaging threats, or to keep sensitive information and intellectual property from leaving the company illegally. Then take a look at the CA Threat Management solution. It integrates best-in-class products into a unified and easily managed solution for comprehensive and cost-effective protection against known, unknown and blended threats. To learn more, and see how CA software solutions enable organizations to unify and simplify IT management for better business results, visit ca.com/solutions. 8 SOLUTION BRIEF: CA THREAT MANAGEMENT

11 CA, one of the world s largest information technology (IT) management software companies, unifies and simplifies complex IT management across the enterprise for greater business results. With our Enterprise IT Management vision, solutions and expertise, we help customers effectively govern, manage and secure IT. SB05TM-01E MP Learn more about how CA can help you transform your business at ca.com