Security Information and Event Management Introduction to envision: The Information Management Platform for Security and Compliance Operations Success
|
|
|
- Alaina French
- 8 years ago
- Views:
Transcription
1 Security Information and Event Management Introduction to envision: The Information Management Platform for Security and Compliance Operations Success Copyright 2008 EMC Corporation. All rights reserved. Chris Bloom, RSA, The Security Division of EMC
2 Today s Agenda The Evolving Landscape Around Security & Compliance How RSA envision Turns Log Data Into Actionable Information The RSA envision Difference Copyright 2008 EMC Corporation. All rights reserved. 2
3 Challenge: Changing Threat Profile Attacks occur over long periods of time TJX - Credit card data compromised over 17-month period at retailer Insiders perpetrating more and bigger thefts Fidelity National - Database administrator at investment organization stole 2.3 million consumer records and successfully sold them Cybercrime has become a $105B business that now surpasses the value of the illegal drug trade worldwide (David DeWalt, McAfee CEO, September 2007) Copyright 2008 EMC Corporation. All rights reserved. 3
4 Challenge: Compliance More Proscriptive, Complex and Expensive Than Ever Specific mandates e.g. PCI, partner contracts etc. very prescriptive (thou shalt encrypt data at rest etc.) Best practice based mandates e.g. EUDPD, HIPAA, SOX thou shalt exert best practice when thou dealest with my data However, leaves exact details of how and what open to interpretation. Mandatory disclosure e.g. State privacy laws Don t specify what has to be done, but If you lose my data you must inform us about it Copyright 2008 EMC Corporation. All rights reserved. 4
5 Challenge: Infrastructures and organizations are getting ever more complex IT environments are seldom single, monolithic entities Invariably a complex mass of conflicting technologies Ill-defined priorities All managed by a matrix organization It s difficult to get visibility into the IT environment What is out there? What activities are taking place? What will stop working when I make a change? What impact will that have on the business? Copyright 2008 EMC Corporation. All rights reserved. 5
6 Challenge: Explosive Growth of Security Data information growth information uses information regulations more growth: Estimated 58% CAGR for security information over next five years (ESG, 2006) more types: firewalls, VPNs, hosts, applications, storage more uses: Security Operations, Compliance, Risk Management, Application Performance, IT Operations information types more regulations: Sarbanes-Oxley, PCI, Basel II, GLBA, HIPAA, FISMA, etc. (more coming!) Copyright 2008 EMC Corporation. All rights reserved. 6
7 Today s Agenda The Evolving Landscape Around Security & Compliance How envision Turns Log Data Into Actionable Information The RSA envision Difference Copyright 2008 EMC Corporation. All rights reserved. 7
8 Logs Are a Goldmine of Data Unix Router Database Application Firewall Intrusion Prevention System Log File File Server Program installed User account created Failed login Copyright 2008 EMC Corporation. All rights reserved. 8 Unauthorized access attempt Database design change
9 RSA envision Turns Log Data into Information Baseline Correlated Report Realtime Alerts Forensics Analysis Interactive Query Integrated Incident Mgmt. Analyze SIEM Log Mgmt Manage Collect Collect Collect UDS Windows Server Netscreen Firewall Cisco IPS Juniper IDP Microsoft ISS Trend Micro Antivirus Device Device RSA envision Supported Devices Legacy Copyright 2008 EMC Corporation. All rights reserved. 9
10 RSA envision: Purpose-Built Platform Non-Intrusive, Extensible, Easy to Deploy Security event & operations info. No data filtering Parallel architecture ensures alert performance Easy to deploy appliance packaging PARALLEL PROCESSES No agents required Flexible XML UDS engine Copyright 2008 EMC Corporation. All rights reserved. 10 Customizable work environments Fully customizable compliance & security reports
11 RSA envision and LogSmart IPDB All the Data with Consistently High Performance Limitations of Relational Database Not designed for unstructured data (log) Data Loss Requires processing (filter, normalize, parse) Unpredictable consumption: collection bottleneck impacts use of data (e.g. alerts) Data Explosion Relational Database Unpredictable Alerts Data Loss: events are lost due to selective collection or system bottleneck Data Explosion: indexes & related data structure information is added (can result in <10x data) Copyright 2008 EMC Corporation. All rights reserved. 11
12 RSA envision and LogSmart IPDB All the Data with Consistently High Performance Data Loss Data Explosion Relational Database Unpredictable Alerts Parallel analysis Limitations of Relational Database Not designed for unstructured data (log) Requires processing (filter, normalize, parse) Unpredictable consumption: collection bottleneck impacts use of data (e.g. alerts) Data Loss: events are lost due to selective collection or system bottleneck Authenticated Data Explosion: indexes & related Compressed data structure information is added (can result in <10x data) Encrypted LogSmart IPDB Copyright 2008 EMC Corporation. All rights reserved. 12
13 Manages the Lifecycle of Security Information ILM User Defines Log Retention Policies RSA envision Automatically Enforces Policies Online Policy (~ 15 months) Retention Policy Store Retain Capture Compress Secure Retire Online in Nearline EMC Celerra EMC Centera Copyright 2008 EMC Corporation. All rights reserved. 13
14 Scales from Single Appliance to Global Deployment A-SRV D-SRV NAS D-SRV LC NAS LC Chicago WW Security Operations London European Headquarters A-SRV D-SRV D-SRV Mumbai Remote Office LC NAS LC A-SRV: Analysis Server D-SRV: Data Server LC: Local Collector New York RC: Remote Collector WW Compliance Operations Copyright 2008 EMC Corporation. All rights reserved. 14
15 Presents Information in Easily Digestible Format Dashboards >1100 reports for regulatory compliance, security, and IT & network operations Copyright 2008 EMC Corporation. All rights reserved. 15
16 Integrates Seamlessly with EMC Storage Online Storage >ST31XX Direct Attached >RSA envision DAS2000 >Single Appliance >1TB-2.5TB >2.75TB >RSA envision NAS3500 >Based on EMC Celerra > Multi-Appliance > Enterprise Class >3.5TB 7TB >Celerra Family Integrated Network Attached >Enterprise Class >5TB + >With Celerra Gateway: >EMC Clariion Family >EMC Symmetrix Family >Enterprise Class >5TB + Longer Retention Storage >Centera Content Addressed Storage Systems External Network Attached Storage Recommended for all RSA envision LS cluster deployments, Required for High Availability Copyright 2008 EMC Corporation. All rights reserved. 16
17 Options for Smallest to Largest Deployments 300, EPS LS Series ES Series # DEVICES ,000 Copyright 2008 EMC Corporation. All rights reserved. 17
18 Today s Agenda The Evolving Landscape Around Security & Compliance How envision Turns Log Data Into Actionable Information The RSA envision Difference Copyright 2008 EMC Corporation. All rights reserved. 18
19 Advantage: Best-in-Class Functionality All the Data Ability to Collect, Manage & Analyze All the Data Single Global View Event Source Support Non-invasive Deployment Interoperable & Extensible All the Time Cradle to Grave ILM High Availability Infrastructure Uninterrupted Scalability High and Consistent Application Performance Low TCO Strong Customer Focused Organization Copyright 2008 EMC Corporation. All rights reserved. 19
20 Advantage: Maximum Efficiency and Low TCO Data Storage Advantage GBs Per Day Collection Rate Advantage (EPS) , ,000 8, ,000 6, ,000 4, ,000 2,000 1, EPS 5000 EPS 10,000 EPS Events Per Second (EPS) 0 System Performance RDBMS LogSmart IPDB RDBMS LogSmart IPDB Copyright 2008 EMC Corporation. All rights reserved. 20
21 Advantage: Independently Acknowledged Industry Leader Copyright 2008 EMC Corporation. All rights reserved. 21
22 Advantage: Unparalleled Demonstrable Scalability Organization Driver Locations Events Devices Security Configuration Control Access Control Enforcement Privileged User Monitoring K/ Sec 20B/ Day 76.8T/ Year 30,000 Compliance & Security Real-Time Monitoring False Positive Reduction Access Control Enforcement K/ Sec 15.5B/ Day 5.6T/ Year 20,000 Compliance SAS 70 Compliance K/ Sec 38.8T/ Day 148T/ Year 28,000 Compliance & Security Log Management Monitoring Firewalls For Audits 4 80K/ Sec 6.9B/ Day 2.5T/ Year 4,000 Compliance Internal Audit 3 95K/ Sec 8.2T/ Day 2.9T/ Year 17,000 Copyright 2008 EMC Corporation. All rights reserved. 22
23 Advantage: Unparalleled Client Base Over 1300 Clients Energy & Utility Retail & Hospitality MSSP Healthcare Fortune 500 Financial Services Copyright 2008 EMC Corporation. All rights reserved. 23
24 Summary Logs are a gold mine of information for Improving security Demonstrating compliance Streamlining IT operations RSA envision turns log data into information Readable reports Actionable alerts At-a-glance dashboards RSA envision is widely accepted as the leading SIEM solution Unparalleled demonstrable scalability Independently validated leadership Invaluable install base Copyright 2008 EMC Corporation. All rights reserved. 24
25
26 Today s Agenda The Evolving Landscape Around Security & Compliance How RSA envision Turns Log Data Into Actionable Information The RSA envision Difference Copyright 2008 EMC Corporation. All rights reserved. 26
27 Challenge: Changing Threat Profile Attacks occur over long periods of time TJX - Credit card data compromised over 17-month period at retailer Insiders perpetrating more and bigger thefts Fidelity National - Database administrator at investment organization stole 2.3 million consumer records and successfully sold them Cybercrime has become a $105B business that now surpasses the value of the illegal drug trade worldwide (David DeWalt, McAfee CEO, September 2007) Copyright 2008 EMC Corporation. All rights reserved. 27
28 Challenge: Compliance More Proscriptive, Complex and Expensive Than Ever Specific mandates e.g. PCI, partner contracts etc. very prescriptive (thou shalt encrypt data at rest etc.) Best practice based mandates e.g. EUDPD, HIPAA, SOX thou shalt exert best practice when thou dealest with my data However, leaves exact details of how and what open to interpretation. Mandatory disclosure e.g. State privacy laws Don t specify what has to be done, but If you lose my data you must inform us about it Copyright 2008 EMC Corporation. All rights reserved. 28
29 Challenge: Infrastructures and organizations are getting ever more complex IT environments are seldom single, monolithic entities Invariably a complex mass of conflicting technologies Ill-defined priorities All managed by a matrix organization It s difficult to get visibility into the IT environment What is out there? What activities are taking place? What will stop working when I make a change? What impact will that have on the business? Copyright 2008 EMC Corporation. All rights reserved. 29
30 Challenge: Explosive Growth of Security Data information growth information uses information regulations more growth: Estimated 58% CAGR for security information over next five years (ESG, 2006) more types: firewalls, VPNs, hosts, applications, storage more uses: Security Operations, Compliance, Risk Management, Application Performance, IT Operations information types more regulations: Sarbanes-Oxley, PCI, Basel II, GLBA, HIPAA, FISMA, etc. (more coming!) Copyright 2008 EMC Corporation. All rights reserved. 30
31 Today s Agenda The Evolving Landscape Around Security & Compliance How envision Turns Log Data Into Actionable Information The RSA envision Difference Copyright 2008 EMC Corporation. All rights reserved. 31
32 Logs Are a Goldmine of Data Unix Router Database Application Firewall Intrusion Prevention System Log File File Server Program installed User account created Failed login Copyright 2008 EMC Corporation. All rights reserved. 32 Unauthorized access attempt Database design change
33 RSA envision Turns Log Data into Information Baseline Correlated Report Realtime Alerts Forensics Analysis Interactive Query Integrated Incident Mgmt. Analyze SIEM Log Mgmt Manage Collect Collect Collect UDS Windows Server Netscreen Firewall Cisco IPS Juniper IDP Microsoft ISS Trend Micro Antivirus Device Device RSA envision Supported Devices Legacy Copyright 2008 EMC Corporation. All rights reserved. 33
34 RSA envision: Purpose-Built Platform Non-Intrusive, Extensible, Easy to Deploy Security event & operations info. No data filtering Parallel architecture ensures alert performance Easy to deploy appliance packaging PARALLEL PROCESSES No agents required Flexible XML UDS engine Copyright 2008 EMC Corporation. All rights reserved. 34 Customizable work environments Fully customizable compliance & security reports
35 RSA envision and LogSmart IPDB All the Data with Consistently High Performance Limitations of Relational Database Not designed for unstructured data (log) Data Loss Requires processing (filter, normalize, parse) Unpredictable consumption: collection bottleneck impacts use of data (e.g. alerts) Data Explosion Relational Database Unpredictable Alerts Data Loss: events are lost due to selective collection or system bottleneck Data Explosion: indexes & related data structure information is added (can result in <10x data) Copyright 2008 EMC Corporation. All rights reserved. 35
36 Manages the Lifecycle of Security Information ILM User Defines Log Retention Policies RSA envision Automatically Enforces Policies Online Policy (~ 15 months) Retention Policy Store Retain Capture Compress Secure Retire Online in Nearline EMC Celerra EMC Centera Copyright 2008 EMC Corporation. All rights reserved. 36
37 Scales from Single Appliance to Global Deployment A-SRV D-SRV NAS D-SRV LC NAS LC Chicago WW Security Operations London European Headquarters A-SRV D-SRV D-SRV Mumbai Remote Office LC NAS LC A-SRV: Analysis Server D-SRV: Data Server LC: Local Collector New York RC: Remote Collector WW Compliance Operations Copyright 2008 EMC Corporation. All rights reserved. 37
38 Presents Information in Easily Digestible Format Dashboards >1100 reports for regulatory compliance, security, and IT & network operations Copyright 2008 EMC Corporation. All rights reserved. 38
39 Integrates Seamlessly with EMC Storage Online Storage >ST31XX Direct Attached >RSA envision DAS2000 >Single Appliance >1TB-2.5TB >2.75TB >RSA envision NAS3500 >Based on EMC Celerra > Multi-Appliance > Enterprise Class >3.5TB 7TB >Celerra Family Integrated Network Attached >Enterprise Class >5TB + >With Celerra Gateway: >EMC Clariion Family >EMC Symmetrix Family >Enterprise Class >5TB + Longer Retention Storage >Centera Content Addressed Storage Systems External Network Attached Storage Recommended for all RSA envision LS cluster deployments, Required for High Availability Copyright 2008 EMC Corporation. All rights reserved. 39
40 Options for Smallest to Largest Deployments 300, EPS LS Series ES Series # DEVICES ,000 Copyright 2008 EMC Corporation. All rights reserved. 40
41 Today s Agenda The Evolving Landscape Around Security & Compliance How envision Turns Log Data Into Actionable Information The RSA envision Difference Copyright 2008 EMC Corporation. All rights reserved. 41
42 Advantage: Best-in-Class Functionality All the Data Ability to Collect, Manage & Analyze All the Data Single Global View Event Source Support Non-invasive Deployment Interoperable & Extensible All the Time Cradle to Grave ILM High Availability Infrastructure Uninterrupted Scalability High and Consistent Application Performance Low TCO Strong Customer Focused Organization Copyright 2008 EMC Corporation. All rights reserved. 42
43 Advantage: Maximum Efficiency and Low TCO Data Storage Advantage GBs Per Day Collection Rate Advantage (EPS) , ,000 8, ,000 6, ,000 4, ,000 2,000 1, EPS 5000 EPS 10,000 EPS Events Per Second (EPS) 0 System Performance RDBMS LogSmart IPDB RDBMS LogSmart IPDB Copyright 2008 EMC Corporation. All rights reserved. 43
44 Advantage: Independently Acknowledged Industry Leader Copyright 2008 EMC Corporation. All rights reserved. 44
45 Advantage: Unparalleled Demonstrable Scalability Organization Driver Locations Events Devices Security Configuration Control Access Control Enforcement Privileged User Monitoring K/ Sec 20B/ Day 76.8T/ Year 30,000 Compliance & Security Real-Time Monitoring False Positive Reduction Access Control Enforcement K/ Sec 15.5B/ Day 5.6T/ Year 20,000 Compliance SAS 70 Compliance K/ Sec 38.8T/ Day 148T/ Year 28,000 Compliance & Security Log Management Monitoring Firewalls For Audits 4 80K/ Sec 6.9B/ Day 2.5T/ Year 4,000 Compliance Internal Audit 3 95K/ Sec 8.2T/ Day 2.9T/ Year 17,000 Copyright 2008 EMC Corporation. All rights reserved. 45
46 Advantage: Unparalleled Client Base Over 1300 Clients Energy & Utility Retail & Hospitality MSSP Healthcare Fortune 500 Financial Services Copyright 2008 EMC Corporation. All rights reserved. 46
47 Summary Logs are a gold mine of information for Improving security Demonstrating compliance Streamlining IT operations RSA envision turns log data into information Readable reports Actionable alerts At-a-glance dashboards RSA envision is widely accepted as the leading SIEM solution Unparalleled demonstrable scalability Independently validated leadership Invaluable install base Copyright 2008 EMC Corporation. All rights reserved. 47
48
Eoin Thornton Senior Security Architect Zinopy Security Ltd.
RSA envision: Transform your Security Operations A Technical overview & demo of RSA envision The Information Log Management Platform for Security and Compliance Success Eoin Thornton Senior Security Architect
An Introduction to RSA envision The Information Log Management Platform for Security and Compliance Success. September, 2009
An Introduction to RSA envision The Information Log Management Platform for Security and Compliance Success September, 2009 Changing Threats and More Demanding Regulations External attacks Malicious insiders
An Introduction to SIEM & RSA envision (Security Information and Event Management) January, 2011
An Introduction to SIEM & RSA envision (Security Information and Event Management) January, 2011 Brian McLean, CISSP Sr Technology Consultant, RSA Changing Threats and More Demanding Regulations External
RSA Solution Brief. RSA envision. Platform. Compliance and Security Information Management. RSA Solution Brief
RSA Solution Brief RSA envision Compliance and Security Information Management Platform RSA Solution Brief Actionable Compliance and Security Intelligence RSA envision technology is an information management
QRadar SIEM 6.3 Datasheet
QRadar SIEM 6.3 Datasheet Overview Q1 Labs flagship solution QRadar SIEM is unrivaled in its ability to provide an organization centralized IT security command and control. The unique capabilities of QRadar
Enabling Security Operations with RSA envision. August, 2009
Enabling Security Operations with RSA envision August, 2009 Agenda What is security operations? How does RSA envision help with security operations? How does RSA envision fit with other EMC products? If
End-to-end Solutions to Enable Log Management Best Practices
White paper End-to-end Solutions to Enable Log Management Best Practices Deploying a Comprehensive Security Information and Event Management Platform Executive Summary More and more organizations today
RSA Solution Brief. Platform. The RSA envision. A Single, Integrated 3-in-1 Log Management Solution. RSA Solution Brief
RSA Solution Brief The RSA envision Platform A Single, Integrated 3-in-1 Log Management Solution RSA Solution Brief The RSA envision Platform at a Glance The RSA envision platform gives organizations a
Clavister InSight TM. Protecting Values
Clavister InSight TM Clavister SSP Security Services Platform firewall VPN termination intrusion prevention anti-virus anti-spam content filtering traffic shaping authentication Protecting Values & Enterprise-wide
Compliance and Security Information Management for PCI DSS Requirement 10 and Beyond
RSA Solution Brief Compliance and Security Information Management for PCI DSS Requirement 10 and Beyond Through Requirement 10, PCI DSS specifically requires that merchants, banks and payment processors
Tech Brief. Choosing the Right Log Management Product. By Michael Pastore
Choosing the Right Log Management Product By Michael Pastore Tech Brief an Log management is IT s version of the good old fashioned detective work that authorities credit for solving a lot of crimes. It
White paper. Storing More Intelligently: Tiered Storage Solutions for Security Data
White paper Storing More Intelligently: Tiered Storage Solutions for Security Data Until recently, storage management has been the purview of IT staff, not compliance or security professionals. But as
How To Buy Nitro Security
McAfee Acquires NitroSecurity McAfee announced that it has closed the acquisition of privately owned NitroSecurity. 1. Who is NitroSecurity? What do they do? NitroSecurity develops high-performance security
Security Information Lifecycle
Security Information Lifecycle By Eric Ogren Security Analyst, April 2006 Copyright 2006. The, Inc. All Rights Reserved. Table of Contents Executive Summary...2 Figure 1... 2 The Compliance Climate...4
RSA envision. Platform. Real-time Actionable Security Information, Streamlined Incident Handling, Effective Security Measures. RSA Solution Brief
RSA Solution Brief RSA envision Platform Real-time Actionable Information, Streamlined Incident Handling, Effective Measures RSA Solution Brief The job of Operations, whether a large organization with
with Managing RSA the Lifecycle of Key Manager RSA Streamlining Security Operations Data Loss Prevention Solutions RSA Solution Brief
RSA Solution Brief Streamlining Security Operations with Managing RSA the Lifecycle of Data Loss Prevention and Encryption RSA envision Keys with Solutions RSA Key Manager RSA Solution Brief 1 Who is asking
NitroView. Content Aware SIEM TM. Unified Security and Compliance Unmatched Speed and Scale. Application Data Monitoring. Database Monitoring
NitroView Unified Security and Compliance Unmatched Speed and Scale Application Data Monitoring Database Monitoring Log Management Content Aware SIEM TM IPS Today s security challenges demand a new approach
RSA Solution Brief. RSA envision LogSmart Internet Protocol Database. RSA Solution Brief
RSA Solution Brief RSA envision LogSmart Internet Protocol Database RSA Solution Brief The global enterprise puts tough demands on a security information & event management (SIEM) system. It must capture
NitroView Enterprise Security Manager (ESM), Enterprise Log Manager (ELM), & Receivers
NitroView Enterprise Security Manager (ESM), Enterprise Log Manager (ELM), & Receivers The World's Fastest and Most Scalable SIEM Finally an enterprise-class security information and event management system
Configuring Celerra for Security Information Management with Network Intelligence s envision
Configuring Celerra for Security Information Management with Best Practices Planning Abstract appliance is used to monitor log information from any device on the network to determine how that device is
Log Management How to Develop the Right Strategy for Business and Compliance. Log Management
Log Management How to Develop the Right Strategy for Business and Compliance An Allstream / Dell SecureWorks White Paper 1 Table of contents Executive Summary 1 Current State of Log Monitoring 2 Five Steps
Effective Use of Security Event Correlation
Effective Use of Security Event Correlation Mark G. Clancy Chief Information Security Officer The Depository Trust & Clearing Corporation DTCC Non-Confidential (White) About DTCC DTCC provides custody
Peter Dulay, CISSP Senior Architect, Security BU
CA Enterprise Log Manager 12.5 Peter Dulay, CISSP Senior Architect, Security BU Agenda ELM Overview ELM 12.5: What s new? ELM to CA Access Control/PUPM Integration CA CONFIDENTIAL - Internal Use Only Overview
Enterprise Security Solutions
Enterprise Security Solutions World-class technical solutions, professional services and training from experts you can trust ISOCORP is a Value-Added Reseller (VAR) and services provider for best in class
ITECH Net Monitor. Standards Compliance
If you rely on your IT infrastructure to maintain data integrity and protect your business from financial losses, it s a good idea to invest in a full fledged network monitoring program and achieve compliance
How To Achieve Pca Compliance With Redhat Enterprise Linux
Achieving PCI Compliance with Red Hat Enterprise Linux June 2009 CONTENTS EXECUTIVE SUMMARY...2 OVERVIEW OF PCI...3 1.1. What is PCI DSS?... 3 1.2. Who is impacted by PCI?... 3 1.3. Requirements for achieving
RSA envision Platform. Sales Guide
RSA envision Platform Sales Guide Legend Contents Business Drivers Identifying Customers Discovery Questions Positioning Statements Presentation of Solution Objection Handling How to Quote Other guides
Vulnerability. Management
Solutions.01 Vulnerability Management.02 Enterprise Security Monitoring.03 Log Analysis & Management.04 Network Access Control.05 Compliance Monitoring Rewterz provides a diverse range of industry centric
White paper. Log Management Best Practices. The Foundation for Comprehensive Security Information and Event Management
White paper Log Management Best Practices The Foundation for Comprehensive Security Information and Event Management Executive Summary Log (event) management is the collection, analysis (real-time or historical),
How To Protect Your Virtual Infrastructure From Attack From A Cyber Threat
VMware Integrated Partner Solutions for Networking and Security VMware Integrated Partner Solutions for Security and Compliance VMware vcloud Networking and Security is the leading networking and security
CHANGING THE SECURITY MONITORING STATUS QUO Solving SIEM problems with RSA Security Analytics
CHANGING THE SECURITY MONITORING STATUS QUO Solving SIEM problems with RSA Security Analytics TRADITIONAL SIEMS ARE SHOWING THEIR AGE Security Information and Event Management (SIEM) tools have been a
RSA SIEM and DLP Infrastructure and Information Monitoring in One Solution
RSA SIEM and DLP Infrastructure and Information Monitoring in One Solution David Mateju RSA Sales Consultant, RSA CSE david.mateju@rsa.com Adding an information-centric view Infrastructure Information
Security Controls What Works. Southside Virginia Community College: Security Awareness
Security Controls What Works Southside Virginia Community College: Security Awareness Session Overview Identification of Information Security Drivers Identification of Regulations and Acts Introduction
Scalability in Log Management
Whitepaper Scalability in Log Management Research 010-021609-02 ArcSight, Inc. 5 Results Way, Cupertino, CA 95014, USA www.arcsight.com info@arcsight.com Corporate Headquarters: 1-888-415-ARST EMEA Headquarters:
Payment Card Industry Data Security Standard
Symantec Managed Security Services support for IT compliance Solution Overview: Symantec Managed Services Overviewview The (PCI DSS) was developed to facilitate the broad adoption of consistent data security
Real-Time Database Protection and. Overview. 2010 IBM Corporation
Real-Time Database Protection and Monitoring: IBM InfoSphere Guardium Overview Agenda Business drivers for database security InfoSphere Guardium architecture Common applications The InfoSphere portfolio
www.clickndecide.com Click&DECiDE s PCI DSS Version 1.2 Compliance Suite Nerys Grivolas The V ersatile BI S o l uti on!
Business Application Intelligence White Paper The V ersatile BI S o l uti on! Click&DECiDE s PCI DSS Version 1.2 Compliance Suite Nerys Grivolas December 1, 2009 Sales Office: 98, route de la Reine - 92100
syslog-ng Product Line
www.balabit.com syslog-ng Product Line syslog-ng Description www.balabit.com IT environments constantly generate important data in log messages syslog-ng Collects Filters Classifies Normalizes Stores Transfers
Achieving Regulatory Compliance through Security Information Management
www.netforensics.com NETFORENSICS WHITE PAPER Achieving Regulatory Compliance through Security Information Management Contents Executive Summary The Compliance Challenge Common Requirements of Regulations
Simplified IT Compliance Frameworks to Reduce Costs and Strengthen Security
Copyright 2008 EMC Corporation. All rights reserved. Simplified IT Compliance Frameworks to Reduce Costs and Strengthen Security Dave Simmons EMC Corporation Why is Information Security So Difficult? because
VMware Integrated Partner Solutions for Networking and Security
VMware Integrated Partner Solutions for Networking and Security VMware Integrated Partner Solutions for Networking and Security Networking and Security are complex, dynamic areas, and VMware recognizes
RSA Security Solutions for Virtualization
RSA Security Solutions for Virtualization Grzegorz Mucha grzegorz.mucha@rsa.com Securing the Journey to the Cloud The RSA Solution for Virtualized Datacenters The RSA Solution for VMware View The RSA Solution
How To Secure A Database From A Leaky, Unsecured, And Unpatched Server
InfoSphere Guardium Ingmārs Briedis (ingmars.briedis@also.com) IBM SW solutions Agenda Any questions unresolved? The Guardium Architecture Integration with Existing Infrastructure Summary Any questions
Protect the data that drives our customers business. Data Security. Imperva s mission is simple:
The Imperva Story Who We Are Imperva is the global leader in data security. Thousands of the world s leading businesses, government organizations, and service providers rely on Imperva solutions to prevent
3 rd InfoCom Security, Athens, 10 Arpil 2013
3 rd InfoCom Security, Athens, 10 Arpil 2013 Kostas Kolokotronis Manager, Security Architecture Services CISSP, PCI DSS QSA 2001-2013 Encode S.A. All rights reserved. Encode logo & Extrusion Testing is
Juniper Security Threat Response Manager (STRM) Mikko Kuljukka COMPUTERLINKS Oy
Juniper Security Threat Response Manager (STRM) Mikko Kuljukka COMPUTERLINKS Oy Customer Challenges Dispersed Threats IT Overload IT information overload Flood of logged events from many point network
RSA envision to RSA Security Analytics. Successful Migration in a Managed Environment
RSA envision to RSA Security Analytics Successful Migration in a Managed Environment Nathan Sherlock, VP of Managed Services 2 Reasons to Migrate from envision to SA Easier to move from envision to RSA
How To Protect Data From Attack On A Computer System
Information Management White Paper Understanding holistic database security 8 steps to successfully securing enterprise data sources 2 Understanding holistic database security News headlines about the
Detect & Investigate Threats. OVERVIEW
Detect & Investigate Threats. OVERVIEW HIGHLIGHTS Introducing RSA Security Analytics, Providing: Security monitoring Incident investigation Compliance reporting Providing Big Data Security Analytics Enterprise-wide
Symantec Security Information Manager 4.7.4 Administrator Guide
Symantec Security Information Manager 4.7.4 Administrator Guide Symantec Security Information Manager 4.7.4 Administrator Guide The software described in this book is furnished under a license agreement
How To Manage Log Management
: Leveraging the Best in Database Security, Security Event Management and Change Management to Achieve Transparency LogLogic, Inc 110 Rose Orchard Way, Ste. 200 San Jose, CA 95134 United States US Toll
EMC Security for Microsoft Exchange Solution: Data Loss Prevention and Secure Access Management
EMC Security for Microsoft Exchange Solution: Data Loss Prevention and Applied Technology Abstract Securing a Microsoft Exchange e-mail environment presents a myriad of challenges and compliance issues
THE FIRST UNIFIED DATABASE SECURITY SOLUTION. Product Overview Security. Auditing. Caching. Masking.
THE FIRST UNIFIED DATABASE SECURITY SOLUTION Product Overview Security. Auditing. Caching. Masking. 2 The First Unified Database Security Solution About the products The GreenSQL family of Unified Database
White Paper. Protecting Databases from Unauthorized Activities Using Imperva SecureSphere
Protecting Databases from Unauthorized Activities Using Imperva SecureSphere White Paper As the primary repository for the enterprise s most valuable information, the database is perhaps the most sensitive
Obtaining Value from Your Database Activity Monitoring (DAM) Solution
Obtaining Value from Your Database Activity Monitoring (DAM) Solution September 23, 2015 Mike Miller Chief Security Officer Integrigy Corporation Stephen Kost Chief Technology Officer Integrigy Corporation
Cisco ASA 5500 Series Firewall Edition for the Enterprise
Взято с сайта www.wit.ru Solution Overview Cisco ASA 5500 Series Firewall Edition for the Enterprise Threats to today s networks continue to grow, with attacks coming from both outside and within corporate
Caretower s SIEM Managed Security Services
Caretower s SIEM Managed Security Services Enterprise Security Manager MSS -TRUE 24/7 Service I.T. Security Specialists Caretower s SIEM Managed Security Services 1 Challenges & Solution Challenges During
Current IBAT Endorsed Services
Current IBAT Endorsed Services Managed Network Intrusion Prevention and Detection Service SecureWorks provides proactive management and real-time security event monitoring and analysis across your network
Feature. Log Management: A Pragmatic Approach to PCI DSS
Feature Prakhar Srivastava is a senior consultant with Infosys Technologies Ltd. and is part of the Infrastructure Transformation Services Group. Srivastava is a solutions-oriented IT professional who
IBM QRadar Security Intelligence April 2013
IBM QRadar Security Intelligence April 2013 1 2012 IBM Corporation Today s Challenges 2 Organizations Need an Intelligent View into Their Security Posture 3 What is Security Intelligence? Security Intelligence
LogInspect 5 Product Features Robust. Dynamic. Unparalleled.
LogInspect 5 Product Features Robust. Dynamic. Unparalleled. Enjoy ultra fast search capabilities in simple and complex modes optimized for Big Data Easily filter and display relevant topics, eg: Top 10
Cisco Advanced Services for Network Security
Data Sheet Cisco Advanced Services for Network Security IP Communications networking the convergence of data, voice, and video onto a single network offers opportunities for reducing communication costs
The Need for Real-Time Database Monitoring, Auditing and Intrusion Prevention
Whitepaper The Need for Real-Time Database Monitoring, Auditing and Intrusion Prevention May 2007 Copyright Sentrigo Ltd. 2007, All Rights Reserved The Challenge: Securing the Database Much of the effort
The Education Fellowship Finance Centralisation IT Security Strategy
The Education Fellowship Finance Centralisation IT Security Strategy Introduction This strategy outlines the security systems in place to optimise, manage and protect The Education Fellowship data and
Boosting enterprise security with integrated log management
IBM Software Thought Leadership White Paper May 2013 Boosting enterprise security with integrated log management Reduce security risks and improve compliance across diverse IT environments 2 Boosting enterprise
Cautela Labs Cloud Agile. Secured. Threat Management Security Solutions at Work
Cautela Labs Cloud Agile. Secured. Threat Management Security Solutions at Work Security concerns and dangers come both from internal means as well as external. In order to enhance your security posture
Discover & Investigate Advanced Threats. OVERVIEW
Discover & Investigate Advanced Threats. OVERVIEW HIGHLIGHTS Introducing RSA Security Analytics, Providing: Security monitoring Incident investigation Compliance reporting Providing Big Data Security Analytics
Log Management Standard 1.0 INTRODUCTION 2.0 SYSTEM AND APPLICATION MONITORING STANDARD. 2.1 Required Logging
Log Management Standard Effective Date: 7/28/2015 1.0 INTRODUCTION The California State University, Chico system/application log management standard identifies event logging requirements, log review frequency,
SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM)
E-SPIN PROFESSIONAL BOOK SECURITY MANAGEMENT SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM) ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMPLIANCE MANAGEMENT,PROACTIVE MONITORING,THREAT
An Oracle White Paper January 2012. Oracle Database Firewall
An Oracle White Paper January 2012 Oracle Database Firewall Introduction... 2 Oracle Database Firewall Overview... 3 Oracle Database Firewall... 3 White List for Positive Security Enforcement... 4 Black
Product white paper. ROI and SIEM. How the RSA envision platform delivers an Industry-leading ROI
Product white paper ROI and SIEM How the RSA envision platform delivers an Industry-leading ROI This paper examines the Return on Investment (ROI) that a quality security information & event management
AlienVault for Regulatory Compliance
AlienVault for Regulatory Compliance Overview of Regulatory Compliance in Information Security As computers and networks have become more important in society they and the information they contain have
LogPoint 5.1 Product Features Robust. Dynamic. Unparalleled.
LogPoint 5.1 Product Features Robust. Dynamic. Unparalleled. LOGPOINT Enjoy ultra fast search capabilities in simple and complex modes optimized for Big Data Easily filter and display relevant topics,
LOG MANAGEMENT AND SIEM FOR SECURITY AND COMPLIANCE
PRODUCT BRIEF LOG MANAGEMENT AND SIEM FOR SECURITY AND COMPLIANCE As part of the Tripwire VIA platform, Tripwire Log Center offers out-of-the-box integration with Tripwire Enterprise to offer visibility
Kevin Hayes, CISSP, CISM MULTIPLY SECURITY EFFECTIVENESS WITH SIEM
Kevin Hayes, CISSP, CISM MULTIPLY SECURITY EFFECTIVENESS WITH SIEM TODAY S AGENDA Describe the need for SIEM Explore different options available for SIEM Demonstrate a few Use Cases Cover some caveats
Net Report s PCI DSS Version 1.1 Compliance Suite
Net Report s PCI DSS Version 1.1 Compliance Suite Real Security Log Management! July 2007 1 Executive Summary The strict requirements of the Payment Card Industry (PCI) Data Security Standard (DSS) are
COMPANY PRESENTATION SOLUTIONS
2MN LTD COMPANY PRESENTATION SOLUTIONS 2MN LTD www.2mn.co.uk I A PROPOS DE 2MN Telephone: +44(0)8709192892 Email: info@2mn.co.uk Dear Sir/Madam, Support: support@2mn.co.uk Dear Sir, Madame, 1 Dear Sir/Madame,
Meeting PCI Data Security Standards with
WHITE PAPER Meeting PCI Data Security Standards with Juniper Networks STRM Series Security Threat Response Managers When it Comes to Monitoring and Validation it Takes More Than Just Collecting Logs Copyright
10 Reasons Your Existing SIEM Isn t Good Enough
Technical Whitepaper 10 Reasons Your Existing SIEM Isn t Good Enough eiqnetworks, Inc. World Headquarters 31 Nagog Park Acton, MA 01720 978.266.9933 www.eiqnetworks.com TABLE OF CONTENTS SECTION PAGE Introduction......................................................
787 Wye Road, Akron, Ohio 44333 P 330-666-6200 F 330-666-7801 www.keystonecorp.com
Introduction Keystone White Paper: Regulations affecting IT This document describes specific sections of current U.S. regulations applicable to IT governance and data protection and maps those requirements
Cisco and EMC Solutions for Application Acceleration and Branch Office Infrastructure Consolidation
Solution Overview Cisco and EMC Solutions for Application Acceleration and Branch Office Infrastructure Consolidation IT organizations face challenges in consolidating costly and difficult-to-manage branch-office
Secret Server Splunk Integration Guide
Secret Server Splunk Integration Guide Table of Contents Meeting Information Security Compliance Mandates: Secret Server and Splunk SIEM Integration and Configuration... 1 The Secret Server Approach to
LOG AND EVENT MANAGEMENT FOR SECURITY AND COMPLIANCE
PRODUCT BRIEF LOG AND EVENT MANAGEMENT FOR SECURITY AND COMPLIANCE The Tripwire VIA platform delivers system state intelligence, a continuous approach to security that provides leading indicators of breach
Building an Infrastructure That Enables Log Management Best Practices
White paper Building an Infrastructure That Enables Log Management Best Practices A Technology Strategy for Comprehensive Security Information and Event Management Executive Summary The current regulatory
Everything You Always Wanted to Know About Log Management But Were Afraid to Ask. August 21, 2013
Everything You Always Wanted to Know About Log Management But Were Afraid to Ask August 21, 2013 Logging and Log Management Logging and Log Management The authoritative Guide to Understanding the Concepts
What is Security Intelligence?
2 What is Security Intelligence? Security Intelligence --noun 1. the real-time collection, normalization, and analytics of the data generated by users, applications and infrastructure that impacts the
INCIDENT RESPONSE CHECKLIST
INCIDENT RESPONSE CHECKLIST The purpose of this checklist is to provide clients of Kivu Consulting, Inc. with guidance in the initial stages of an actual or possible data breach. Clients are encouraged
Maintaining PCI-DSS compliance. Daniele Bertolotti daniele_bertolotti@symantec.com Antonio Ricci antonio_ricci@symantec.com
Maintaining PCI-DSS compliance Daniele Bertolotti daniele_bertolotti@symantec.com Antonio Ricci antonio_ricci@symantec.com Sessione di Studio Milano, 21 Febbraio 2013 Agenda 1 Maintaining PCI-DSS compliance
The Comprehensive Guide to PCI Security Standards Compliance
The Comprehensive Guide to PCI Security Standards Compliance Achieving PCI DSS compliance is a process. There are many systems and countless moving parts that all need to come together to keep user payment
CAS8489 Delivering Security as a Service (SIEMaaS) November 2014
CAS8489 Delivering Security as a Service (SIEMaaS) November 2014 Usman Choudhary Senior Director usman@netiq.com Rajeev Khanolkar CEO SecurView Agenda What is Security Monitoring? Definition & concepts
RSA Solution Brief. RSA SecurID Authentication in Action: Securing Privileged User Access. RSA Solution Brief
RSA SecurID Authentication in Action: Securing Privileged User Access RSA SecurID solutions not only protect enterprises against access by outsiders, but also secure resources from internal threats The
CorreLog Alignment to PCI Security Standards Compliance
CorreLog Alignment to PCI Security Standards Compliance Achieving PCI DSS compliance is a process. There are many systems and countless moving parts that all need to come together to keep user payment
How To Use Cautela Labs Cloud Agile.Com
1 Correlation and analysis of security and network events in one integrated solution Cautela Labs Cloud Agile. Secured. Log Management 1 Log Management A great deal of events cross your network, servers,
White Paper Achieving PCI Data Security Standard Compliance through Security Information Management. White Paper / PCI
White Paper Achieving PCI Data Security Standard Compliance through Security Information Management White Paper / PCI Contents Executive Summary... 1 Introduction: Brief Overview of PCI...1 The PCI Challenge:
How to Develop a Log Management Strategy
Information Security Services Log Management: How to develop the right strategy for business and compliance The purpose of this whitepaper is to provide the reader with guidance on developing a strategic
Preemptive security solutions for healthcare
Helping to secure critical healthcare infrastructure from internal and external IT threats, ensuring business continuity and supporting compliance requirements. Preemptive security solutions for healthcare
Securing ephi with Effective Database Activity Monitoring. HIMSS Webcast 4/26/2011. p. 1
Securing ephi with Effective Database Activity Monitoring HIMSS Webcast 4/26/2011 p. 1 Agenda Agenda Database Security Primer Industry Trends What Works Integrated DB Security Product Demonstration Questions
When it Comes to Monitoring and Validation it Takes More Than Just Collecting Logs
White Paper Meeting PCI Data Security Standards with Juniper Networks SECURE ANALYTICS When it Comes to Monitoring and Validation it Takes More Than Just Collecting Logs Copyright 2013, Juniper Networks,
Solutions for Health Insurance Portability and Accountability Act (HIPAA) Compliance
White Paper Solutions for Health Insurance Portability and Accountability Act (HIPAA) Compliance Troy Herrera Sr. Field Solutions Manager Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA