Posts Tagged ‘Compliance’
Posted by Michael Applebaum in Risk Management, Security Intelligence, Threat Management
Building on the momentum of our latest QRadar SIEM and QRadar Log Manager release just two weeks ago, we are excited to announce a new release of QRadar Risk Manager that adds several highly anticipated enhancements. As a refresher, QRadar Risk Manager is the member of the QRadar Security Intelligence Platform that provides pre-exploit configuration monitoring and attack simulation. These proactive capabilities help identify security gaps and prevent security breaches and compliance violations before they occur, providing a perfect pairing to the advanced analytics, detection and reporting of QRadar SIEM.
The new configuration monitoring and management capabilities make it easier than ever to strengthen perimeter security and improve network visualization:
Normalized rule and security device comparison allows users to compare rules and object groups across the same security device type (historical comparisons, for example), as well as across differing device types. For example, users can compare the configuration of all of their Internet firewalls, regardless of brand, helping them ensure that all firewalls are configured consistently. QRadar Risk Manager provides views that quickly and easily identify which rules have been added and deleted, highlighting object group changes between devices.
Topology visualization enhancements improve the overall usability of the product by allowing users to hover over interfaces to quickly view connection and interface details. This saves time by removing the need to “drill down” to view this information. This release also provides the ability to quickly save and retrieve saved searches, plus comprehensive path filtering options that include the ability to filter on multiple criteria. The release further adds improved path visualization capabilities, including arrows that indicate path direction and hover options that display partially allowed path information (such as specific ports). Users can also drill down from a hover window to view firewall rules that enable a given path, with a single click.
Firewall rule counting and event association is a powerful feature that associates firewall “accept” and “deny” events with specific firewall rules. Users can now report on most, least and never used rules, aiding in firewall optimization by identifying and eliminating rules that are no longer needed. The ability to drill down from a rule to specific firewall events that triggered it aids with rule forensics, such as detecting what traffic has been allowed by a rule, and where the traffic originated. This helps diagnose traffic issues and assists in determining the impact of rule changes before those changes are made. Liberal rules, such as “any port” and “any destination,” can be easily restricted without the fear of blocking critical traffic.
Shadowed rule detection is a highly requested feature that allows detection of rules that are “over-shadowed” by previous rules that contradict or render them ineffective. This feature reduces excessive firewall overhead and unforeseen security exposures. QRadar Risk Manager now allows users to identify and report on shadowed rules, allowing them to be easily fixed. A hover-over interface also allows the user to instantly view shadowed rule information without the need to drill down.
Firewall rule searching enhancements now allow users to search on time intervals, include or exclude different rule types, and refine results based on rule usage. Results may be sorted by a variety of options, including device rule order.
We are very excited about this release and the many other capabilities planned for the next few months. For more information about QRadar Risk Manager and QRadar SIEM, we invite you to read the white paper “Five Practical Steps to Protecting Your Organization Against Breach.”
And if you are at IBM Pulse, be sure to stop by the Security and Compliance section of the Solution Expo to say hello and learn more!
Posted by Melissa Stevens in Compliance, Cybersecurity, Q1 Labs, Risk Management, Security Intelligence, SIEM, Threat Management
Ever wonder what the “big deal” is with QRadar Security Intelligence? Watch this short video featuring Chris Poulin to understand what sets QRadar apart from other security inteligence solutions, and why thousands of customers large and small have chosen the QRadar Security Intelligence platform to meet their IT security needs. Learn how QRadar helps customers:
- Detect threats others miss
- Consolidate data silos
- Detect insider threats
- Predict risks against your business, and
- Exceed regulation mandates.
Posted by Melissa Stevens in In the Industry, Log Management, SIEM
“… deployment is not the hard part, at least for modern SIEMs; the trick is deriving continuous value from SIEM and customizing it to your evolving needs.”
Are you seeing real value from your SIEM deployment? Have you gone beyond compliance and started defining use cases your SIEM can help solve? Read this post by Chris Poulin, CSO at Q1 Labs, to understand the phases of a SIEM deployment and how to get the most out of your technology investment.
This article was originally published by Chris Poulin in Security Week on October 18, 2011 in their Experts column. You can read the full post here.
***
Typical SIEM deployment conversation:
Vendor: Ms Customer, now that you’ve purchased our shiny new SIEM, complete with new SIEM smell, what use cases would you like to implement?
Customer: Um, well, I don’t know. What should we do with it?
Vendor: Well, what would you like to do with it?
Ad infinitum…
The reality is most SIEM and Log Management deployments are purchased to satisfy a compliance need: PCI, HIPAA, NERC, FISMA, GPG 13 – the list goes on. And while log management and reporting, which comprise the lion’s share of technical controls prescribed by most regulations and compliance documents, are important, a properly deployed SIEM can add tremendous value to an organization’s security program. Customers know that applying SIEM to the single task of compliance is like stamping a check box with a sledgehammer, but many don’t have a good sense of SIEM’s full potential, so they look for the vendor or VAR to provide guidance.
SIEM, on the other hand, is highly context dependent. Okay, that’s a bit of a lie. There are a number of general use cases that can be applied to just about all customers: botnet detection, excessive authentication failures, traffic from darknets, IDS alerts that a particular attack is targeting an asset that the VA scanner confirms is vulnerable to that exploit. Vendors typically provide these as out-of-the-box content in the form of rules (with alerts), dashboard widgets, reports, and saved searches. Sales reps point to this as proof of how easy it is to deploy their SIEM. Taken literally, that’s true: deployment is not the hard part, at least for modern SIEMs; the trick is deriving continuous value from SIEM and customizing it to your evolving needs.
Continue Reading at SecurityWeek.com
Posted by Michael Applebaum in Compliance, Risk Management, Security Intelligence, SIEM, Threat Management
This is part 4 of an ongoing series of posts that answer “Six Things You Always Wanted to Know About Security Intelligence but Were Afraid to Ask.”
With a firm understanding of Security Intelligence (SI) in hand, let’s get down to brass tacks and review the benefits organizations are gaining from their SI deployments. Here are several real-world examples:
Improved Compliance
Like it or not, regulatory compliance – for PCI DSS, HIPAA, NERC CIP, SOX and many others – is a major driver of security initiatives. Although compliance doesn’t guarantee a secure environment, compliance will always get attention and budget because of the potential penalties for failure. Complying with relevant mandates is just the start of enhancing one’s security posture, but it’s an important first step. Security Intelligence aids both regulatory and internal policy compliance by logging and proactively monitoring diverse information across the enterprise in real time, providing accountability, transparency and measurability. It delivers practical value through automated reporting and easy searching of logs, flows and much more.
David Blackburn of California ISO, the electrical grid operator for 80 percent of California, notes, “Compliance was the chief driver in our purchasing a SIEM [solution]. We have many tools that monitor and analyze, but there was no centralized logging capability that [could] analyze those logs and give us good information quickly.” Hear more about how California ISO uses Security Intelligence for NERC CIP compliance in this video.
Faster Detection and Remediation of Threats
In the post-perimeter world, focusing solely on prevention is a noble but losing proposition. Boundaries are porous – think mobile computing, social media and cloud computing – and there’s a heightened risk of insider theft, leading to what Forrester calls a “zero-trust” environment. Security Intelligence solutions address this reality by helping businesses detect and remediate breaches faster. They have become adept at finding the needle in the haystack, by correlating massive data volumes in real time. This includes events from network & security devices, servers, applications, directory servers; network activity flows with Layer 7 visibility; asset information; configuration data; vulnerability information; and more. (If you think SIEM solutions have already been doing this for years, think again.) SI solutions also aid in remediation by identifying which assets and users were potentially affected by a compromise, and by capturing application content for forensic activities.
Adobe Systems senior network security manager Leon Fong discusses the benefits Adobe received from Security Intelligence in this video. He explains that QRadar detected threats other security products missed:
“Within 2 months [of deploying the solution], the conficker worm starting hitting our network. I noticed that we were getting a lot of heavy TCP port 445 traffic being denied by our firewalls. The next day, the traffic grew 10-fold. I had to notify our antivirus team that this needed to be looked into. Soon after, McAfee sent a note of this worm being prevalent. In this case, the SIEM solution [QRadar] found the problem before McAfee was able to.”
Reduction of Insider Fraud, Theft and Data Leakage
External attacks garner most of the headlines, but insider threats can be even more damaging – compromising invaluable intellectual property and even jeopardizing national security. We’re all familiar with WikiLeaks, but few organizations have come to grips with the true risk of insider threats. Would you know if an employee was sending key product plans to a competitor, anonymously publishing confidential information, or accessing financial information that could be used for insider trading? With Security Intelligence solutions, organizations can identify and mitigate those inside threats and many more, by detecting the following:
- Unauthorized application access or usage
- Data loss such as sensitive data being transmitted to unauthorized destinations
- VoIP toll fraud
- Application configuration issues such as privileged access exceptions
- Application performance issues such as loss of service or over-usage
A multi-billion-dollar branded consumer products firm recently used its SI solution to detect an attempted data exfiltration by a trusted employee for financial gain. The company’s executives suspected its intellectual property was being leaked but couldn’t identify the source. When they applied flow-based network activity monitoring to the situation, they were able to quickly track down the data leakage and stop the employee. With application content capture, they could even drill down and view the specific emails sent by the employee through his personal email account to the third party. This prevented the problem from snowballing and potentially causing millions of dollars in damage to the firm.
Pre-Exploit Risk Reduction
Sure, I just finished explaining how you can’t focus only on threat prevention in a post-perimeter, zero-trust world. But that doesn’t mean you have to give up on prevention either. No one is ripping out all their firewalls or IDS/IPS products. Likewise, you shouldn’t overlook some of the more cutting edge approaches to pre-exploit risk reduction. Three ways SI solutions are helping customers prevent compromises today are by:
- Automatically monitoring device configurations (e.g., firewalls) and alerting on policy violations
- Prioritizing the multitude of vulnerabilities reported by vulnerability scanners
- Performing predictive threat modeling and simulation of network changes
These may sound familiar, but modern SI solutions surpass yesterday’s point products by applying greater intelligence to a broader set of inputs. Network activity flows, for example, provide a more complete view of the effectiveness of security device rules than configuration data by itself. As my colleague Brian Mehlman writes, “[Configuration data alone can] miss situations where a configuration is thought to be adequate but for some reason still allows potentially risky network traffic to propagate.” Similarly, knowledge of network topologies can “minimize false positives common among vulnerability scanners and … [prioritize vulnerabilities] that can be easily exposed because of the way the network is configured.”
A major electric energy transmission company uses QRadar Risk Manager to perform centralized device configuration monitoring and auditing, thus reducing the risk of security breaches. Because the solution monitors multiple vendors’ security products and uses flow analytics (QRadar QFlow) to paint a rich picture of exposures, the company believes it has significantly strengthened its security and risk posture. The fact that its risk management capability is part of a broader Security Intelligence solution also reduces training and staffing requirements.
Simplified Operations and Reduction of Effort
Lastly, SI solutions are applying intelligent automation to simplify security operations and reduce the burden on security and network professionals. IANS just published a study of the Return on Security (ROS) achieved by two large customers, and the findings were compelling. In addition to estimated risk reduction benefits of $13.5 million, the objective benefits (net of all solution costs) were estimated at $550,000. These stem from greater efficiencies and elimination of tedious manual tasks. Again, these were the benefits reported by the customers based on actual experience. The full report can be accessed here.
How do these benefits compare to what you’ve received from security solutions? We welcome comments about your own real-world experiences.
Posted by Heather Howland in Security Intelligence, SIEM
SIEM has come a long way over the years, evolving from a relatively simple point solution, to a more intelligent, integrated and automated enterprise IT security solution. We thought it would be interesting – and fun – to put together an infographic to try and make sense of it all.
Why bother creating an infographic on SIEM? It has an interesting history. SIEM was originally plagued by a somewhat painful implementation process, difficult to integrate data sources, limited scalability, and an intensely manual reporting process requiring analysts to do the heavy lifting. Reporting and analytics have greatly improved along with scalability, collection, and integration of third party data sources. Not only does this evolution make day-to-day life easier for IT Security professionals, but it decreases breach response time, remediation time, and the total cost of a breach.
In fact, this infographic is about more than just SIEM. It’s about the evolution of SIEM, expanding into adjacent solutions, to add essential contextual data and achieve total security intelligence. Considering recent announcements by other vendors, security intelligence has become more than just a popular term. As one of my colleagues explained in his post last month, security intelligence is “a holistic approach to viewing and managing the security and risk posture of an organization.”
How did we do? Let us know in the comments below if we left anything out. Of course, as the industry progresses, so will this Infographic. We are excited to see how SIEM, and security intelligence, further evolves.
The latest on Cyber Security