Asia Pacific Security Information and Event Management (SIEM) Market CY P March 2011

Transcription

1 Asia Pacific Security Information and Event Management (SIEM) Market CY 2010 March 2011

2 Table of Contents Market Definition for Asia Pacific Security Information and Event Management (SIEM) Market CY Market Overview 12 Market Engineering Analysis 18 Revenue Forecasts 23 Geographical Analysis 26 Demand Analysis 35 Competitive Landscape 40 Strategic Recommendations About Frost & Sullivan

3 List of Figures SIEM Market: Market Drivers Ranked in Order of Impact (Asia Pacific), SIEM Market: Market Restraints Ranked in Order of Impact (Asia Pacific), SIEM Market: Competitive Structure (Asia Pacific), SIEM Market: Competitive Landscape Analysis (Asia Pacific), SIEM Market: Trends in Descending Order of Impact (Asia Pacific)

4 List of Charts SIEM Market: Market Engineering Measurements (Asia Pacific), SIEM Market: Revenue Forecasts (Asia Pacific), SIEM Market: Percent of Revenues by Geographic Region (Asia Pacific), SIEM Market: Growth Analysis by Geographic Region (Asia Pacific), SIEM Market: Vertical Demand Analysis (Asia Pacific), SIEM Market: Horizontal Demand Analysis (Asia Pacific),

5 Market Overview 12

6 Market Overview Key Highlights The Asia Pacific (APAC) Security Information and Event Management (SIEM) market witnessed a healthy growth momentum in 2010, compared to Market revenues in the segment grew xx.x percent from 2009, reaching a total market size of US $xx.x million in The CAGR during the forecast period is expected to hit xx.x percent, as enterprises began to recognize the value and importance that SIEM was able to contribute to their security posture. It is clear that whilst there is a growing relevance and need for a technology like SIEM, current market perceptions towards the technology remain confused in light of the technology s ongoing evolution. The first-generation SIEM technology was mainly designed to reduce the false positives generated by IDS/IPS devices and identify the most critical external threats by using rule-based correlation. In this way, the first-generation SIEM solutions were merely focusing on a subset of firewall and IDS/IPS events that were in violation of policy and helped to detect real attacks. Although the earlier SIEM solutions were effective in solving the big challenge of sorting through excessive false alerts and protect companies from external threats, theses solutions were costly and generally time-intensive and complex in terms of maintenance and management. The second and latter generations of SIEM technology offered capabilities beyond the detection of external threats; these more advanced platforms were also able to provide periodic reports of user activities and create forensics reports, with an emphasis on monitoring user activities rather than simply guarding against external threats. The lack of a clear market position of SIEM, a fact that is further exacerbated by the vendors unilateral approach in positioning the technology segment, as well as the interchangeable usage of terms such as SIEM, Security Information Management (SIM) and Security Event Management (SEM), means that the market remains highly fragmented, with both customers and vendors alike having different versions of what SIEM truly stands for. More importantly perhaps, the growing spotlight on what is essentially an ill-defined market has actually impeded the adoption rate of SIEM solutions across the APAC region. 13

7 Market Overview (Contd ) In this research service, we have sought to derive a clear definition of SIEM technology, whilst making clear the various myths and erroneous market positioning that have plagued the technology segment. Indeed, the notion of SIEM technology that we have adopted in this study is clearly defined across three main principles, namely, i) ability to collect, transport and store data/log information, ii) ability to aggregate and correlate the unstructured data into intelligence and iii) provide a real-time approach towards security event detection, reporting and remediation. Among these principles, correlation has emerged as the defining characteristic of SIEM technology in the later generations. Correlation establishes relationships between log entries/events that are generated by devices, systems or applications. A major benefit of correlation is that correlation filters out duplicate and redundant data in order to reduce event noise and allow administrators to address high priority issues immediately with the right information to make informed remediation decision. More importantly, correlation is able to intelligently assess the numerous and different threats that are encroaching upon the various access points and potential security loopholes across an enterprise s entire IT setup. In addition, SIEM technology requires the use of a centralized platform whereby all logs/information/events are collected, stored and analyzed across all possible locations and scenarios. The role of a centralized information engine is critical in providing consistency and ensuring all security loopholes are being catered to properly in a SIEM setup. With technology convergence largely characterizing the evolution in the IT security arena, it is no surprise to see growing enterprise demand for a solution providing SIEM capabilities. In many ways, the security intelligence and extensive coverage offered by SIEM across multiple domains and devices puts SIEM in a good position to emerge as a tool for convergence and ensure security synergies are being properly achieved in midst of more security and IT platforms converging together. 14

8 SIEM Flowchart Unstructured Information Collect Collect Transport Centralize SIM Aspect: With an Emphasis of Storage Capacity Aggregate Normalize Store Analyze Correlate Detect SEM Aspect: With an emphasis of Real-Time Manner Present Report Structured Knowledge 15

9 SIEM Approach Technology Collection Reporting Aggregation Visibility SIEM Centralization Storage Detection Correlation 16

10 Development of SIEM Technology First-generation SIEM technology was designed to reduce the false positives which caused by IDS/IPS and help surface the most critical external threats by using rule-based correlation. Second-generation SIEM technology not only detected external threats, but also provided periodic reports of user activities and create forensics reports, with an emphasis on monitoring user activities rather than external threats. Third-generation SIEM technology is being driven by more sophisticated threats, such as cyber-terrorism and insiders, which requires SIEM solutions to be aware of users/identities and detect suspicious or anomalous user behaviors. In other words, the objective is to always provide proactive visibility into threats. 17