Enterprise Security Blog

The $2500 SIEM

This isn't a misprint - for as little as $2500 per month you can take the first step that all companies with effective security have taken to comply with standards and protect critical information. Intellitactics and Quest have put together a great program - security as a service -  to get you to take the first step. 

There are many reasons that companies and agencies have deferred their SIEM projects: the budget got smaller, the project was cut, we lost the headcount, we had to cut the SIEM project to save jobs in our group, we like maintaining the log collector we built, the dog ate it (the budget that is).

How did your project get stalled, postponed or shelved indefinitely? Every project requires human capital and sometimes you're just short one set of hands. Sometimes the best person, most qualified person is engaged in another high priority project. Budgets do change. Dollars shift to other projects, budgets get smaller in one area to compensate for unavoidable increases in other areas and revenue projections that fund the budget fall short of  expectations.Unfortunately the need for effective logging and event management doesn't shift and what the company expects from you - the security team - doesn't get put on hold. 

For $2500 you get Intellitactics SAFE- the only SIEM appliance with all the capabilities on one appliance sitting right where you are. Then you decide how much you can do with your SIEM - some of the work, all the work or none of the work at night or weekends. You get a trusted partnership with Quest,a full service managed security service provider. With Quest's security as a service you can do as little or as much work as you choose by augmenting your staff with Quest - using Quest to add the most value. 

SIEM is established by SANS as an important first stepin developing an efficient and effective security startegy. It reduces the cost of compliance, mitigates risk by automating monitoring of controls that enforce policy. 

For more information on security as a service  visit www.intellitactics.com or your virtual security team visit www.questsys.com   

Picture this - Intellitactics NEW EnterpriseVue

Jeff Vince, Director of Solution Services with Intellitactics, spends more time in Fortune 100 SOCs than anyone else at Intellitactics. He relates that the job of enforcing security policy is hard and thankless. "While the security team is accountable for prevention and defense, they need every employee to be on board with the rules and regulations. Training is the obvious answer, but reminding people every day to DO what they learn in training requires continuous awareness."

That's what EnterpriseVue for ISM is designed to do. Using state of the art dashboard technology, EntepriseVue transforms gigabytes of data into graphical and tabular reports arranged on a role appropriate dashboard. The dashboard is dynamic with protected access to specific roles and responsibilities. ISM or Intellitactics Security Manager is a fully featured security information and event management (SIEM) solution that transforms millions of logs into actionable security events, automates alerting and accelerates investigation and incident response. "You can configure dashboards for the NOC, the application managers, the business line managers and other stakeholders. Everyone benefits from the ISM repository of security information, while the SOC works with security events to actively monitor control violations and attacks," explains Vince.

“Training end users on behaviors they can watch out for amongst their peers and then reinforcing that training with frequent reporting may deter the activity of a malicious insider,” is an example offered by Jeff Vince, Director of Solution Services for Intellitactics. “We encourage the SOC to run reports that keep security front of mind. We also suggest they involve other IT functions like network operations, database managers, application managers and others by providing reports they can use to make decisions and take actions to comply with policies.”

Read more about EnterpriseVue for ISM. Looking for a SIEM appliance? Intellitactics SAFE offers the same powerful, dynamic dashboard powered by the Intellitactics Security Data Warehouse - the only fully integrated repository that doesn't limit capacity to maintain performance.  

Intellitactics and Quest - security as a service

Now, QUEST- a California based service provider - is offering a NEW Managed Security Service. They'll be implementing Intellitactics SAFE appliances on the customer's premise and remotely managing logging, compliance reporting and event analysis. Their clients get all the control of ownership without the overhead.

Everyday we talk to companies that want and need to automate log reviews, threat detection and reporting requirements for multiple regulatory standards. They are all doing something, but they all want to do more. Unfortunately, the economic turmoil has created obstacles for these companies to move forward. Staffing is an issue, deploying and implementing the solution takes time, even the evaluation process required for a capitol investment requires more energy than they have. These are all good reasons to consider security as a service.

QUEST CEO Tim Burke and I were talking about what they're clients say are good reasons to engage with a security service provider. More companies are considering security as a service and by implementing Intellitactics SAFE on the Client premise - they get the best of both worlds. Quest offers redundant operation centers and SAS 70 Type II certification; the staff is highly qualified. This new security offering, featuring Intellitactics SAFE may be just the ticket for companies that need a fast start  - whether they're prepping for audtis, augmenting staff or defending against cyber criminals that stalk mid-size companies. Quest's unique service offering is a short term fix for lots of companies which will offer long term benefits.

Intellitactics Explains the Value of ONE

21 - the number of vendors offering security information and event management (SIEM) products including Intellitactics. These products offer a variety of features and functions and just as many architectural approaches to providing these product capabilities. So what is so important about ONE?

ONE is the number of appliances you'll need to enjoy a FULLY CAPABLE SIEM from Intellitactics. That means you buy and implement ONE appliance that provides TWO key capabilities: log management which is essential for compliance with regulatory standards and real time event management which is essential for threat management and security operations.

Another number to consider: 1400! That's the number of packaged reports you get with the Intellitactics SIEM products.1400 audit ready reports for every regulatory standard:  NERC, PCI, HIPAA, SOX, FISMA, GLB and for best practice control sets like CoBit, NIST and ISO.

Finally - 0 - yes ZERO is the number of DBA's you'll need and the amount of SAN storage you will need to get full value from your Intellitactics SIEM. It's also the number of times you'll wish you had bought another product and the number of calls you'll have to make complaining that you've run out of storage or connected to a device your SIEM doesn't support.

So get the ONE SIEM appliance that does it all. See the ONE every Tuesday at 2 PM EST.

Worms and Viruses - Hidden Cost of Doing Nothing

I asked Pam Casale, our CMO to share the day her job stood still.

PC:  We often are asked to help companies justify the cost of strengthening security. We help them quantify the cost of a breach, the cost of clean up and disclosure, the cost of damaging their corporate brand, even the consequences of a bad audit. Today I experienced another cost: the hours that employees lose while they deal with computers that are acting weird, moving slow after a virus or worm has taken up residence somewhere on their computer. Yes, after years of training I accidentally opened an attachment from a "trusted source" that was a bad actor in disguise. I immediately called IT and frantically ran a McAfee scan but not before I was receiving unsolicited emails from right wing politicos that i couldn't stop. Just as I was ready to get back to my "real work" I got an email from IT that I needed to download a Microsoft patch to thwart a much publicized virus. That only took minutes but caused my browser, still bruised from "trusted"email, to move at a snail's pace.This interruption costs my company nothing, since I work until I'm done. It cost me a Saturday morning.

 I am now working on quantifying the hourly cost of an office worker. 1 hour per month x (a conservative) $30/hour x 45 weeks a year x 20,000 employees = WHAT?! We tend to dismiss worms and viruses as things - but these "things" are perpetrated by people. It's hard to imagine the psyche of a person who intentionally causes others to waste so much time.

This equation makes the cost of prevention and detection seems like nothing. Our SAFE products look incredibly affordable when compared with the cost of distracting, annoying and disruptive exploits of people with nothing better to do. Maybe the stimulus package will give some of these people real jobs; a chance to turn their energies into something productive and good for the earth.

ARE YOU PUTTING SECURITY ON HOLD?

Gartner and Forrester – industry analysts – predict  that  IT spending will fare better than the economy as a whole and continue to grow on a year-to-year basis.

Revised estimates reflect a 5.4% increase on new purchases in 2008 and include a forecast of a 6% increase in IT spending in 2009.

While companies may opt to delay new projects analysts say you will continue to invest in “absolutely critical products”.

So what’s an “absolutely critical product”?  According to the analysts they are the ones that improve earnings or save a lot of money.

More companies are putting SIEM, security information and event management, in the category of absolutely critical products. You might be asking WHY? Today’s SIEM is more than logging. Choose a SIEM that transforms millions and billions of logs into security events. If you give your analysts only raw logs you can’t expect consistent, reliable or repeatable responses. But, when you give them security events you can set rules and check the validity of processes.

Put SIEM on your critical product list and read how SIEM finds the proverbial needle in the haystack in this NEW article in Network World. Check out the value that Intellitactics' customer shares with Network World readers.

Podcast: Application Security Preventing Vunerabilities with Dr. Warren Axelrod

Join me for part two of our security talks with Dr. Warren Axelrod on Software Assurance & Application Security Metrics. In part two we get into more detail about building and monitoring applications enabling you to be secure and compliant.

In part two we talk about the evolution of application security metrics and best practices companies can use to:
  - Measure the strength of application security
  - Assess & communicate how applications may withstand attacks
  - Define processes & procedures to build stronger applications and monitor
    applications for early identification of threats

While most organizations have been pre-occupied with securing the perimeter, it is the cost and consequence of insidious insider attacks on applications that is keeping security executives awake at night. It’s hard to fix what can’t be measured. Organizations wishing to control the security of their applications need to use application security metrics to be secure and compliant.

Find part one of the series with Dr. Axelrod here:
http://www.intellitactics.com/challenges

Podcast: Application Security the Real Security Challenge with Dr. Warren Axelrod

I would like to invite you to a podcast featuring Dr. Warren Axelrod talking with me about the evolution of application security and related metrics.

This is a two part podcast. In part one we talk about the next big security challenge – security at the application level. Log into this podcast to learn how to:
    - Take the first steps to expand your security strategy to applications
    - Define processes & procedures for measuring application strength
    - Create a framework for understanding the challenges of managing
      application security

Find the podcast with Dr. Axelrod here:
http://www.intellitactics.com/application

SANS Tool Talk Webcast Entitled: “Stop Data Loss & Reduce the Risk of Insider Threat”

While computer criminals pose significant risk, internal users pose a greater threat because they have trust, access, and knowledge. Intellitactics’ security event management solutions provide precision management of logs and other information from a wide array of technologies often aimed at a relatively narrow set of threats. By using these solutions to automate control monitoring, organizations can more efficiently and effectively respond to the mandates of comply and protect.

The market has been flooded with tools that claim to solve the problem, but are more expensive point solutions really the cure?  In this webcast you will learn first-hand how Intellitactics’ solutions have been proven to improve organization effectiveness and reduce risk by protecting against insider threat, data loss, and fraud.

When: Tuesday, September 9, 2008 - 1:00 PM EST (1800 UTC/GMT)

Register: https://www.sans.org/webcasts/show.php?webcastid=91999

Speaker: Paul Carman, Director of Sales Engineering, Intellitactics

Medical Identity Theft A Silent Killer?

Medical identity theft is one of the least studied of identity theft crimes but has the potential to cause the greatest harm both financially and medically to its victims. This kind of theft leaves a footprint in the victim's medical records that can haunt a victim for years because victims have limited rights and resources with which to correct their medical state.

The World Privacy Forum published the first report on Medical Identity theft in May of 2006 and preparing another report scheduled for release later this year. Their report on best practices currently targets insiders as the biggest threats to securing the medical identity of patients. They also suggest that healthcare organizations widen their risk assessments to include medical identity theft scenarios.

In October the Office of the National Coordinator (ONC) for Health Information and Technology is organizing a town hall type meeting in Washington focused on how medical identity theft should be address in digital age. The meeting will include public discussion on the matter. All information obtained at the meeting will be used as input into potential recommendations for prevention, detection and remediation of medical identity theft as well as IT best practices for the industry.

For more information on the ONC meeting in October visit: http://www.hhs.gov/healthit/privacy/identytheft.html#II

For more information on Medical Identity Theft from the World Privacy Forum visit: http://www.worldprivacyforum.org/medicalidentitytheft.html