An Introduction to enVision
Enterprise Platform for Security and Compliance
Operations
Karol Piling
Consultant - Central & Eastern Europe
RSA The Security Division of EMC
Introducing Information-centric Security
secure enterprise data
Preserve the confidentiality and integrity
of critical data wherever it resides
secure employee access
Enable secure, anytime, anywhere access
to corporate resources
secure access
secure data
customers
secure partner access
Open internal systems to trusted partners
partners
employees
secure customer access
Offer self-service channels, prevent fraud,
and enhance consumer confidence
security information management
manage security information
Comply with security policy and regulations
RSA enVision – Market Proven Leadership
Vision
Information Management Platform for transforming event, log, asset
and other data into actionable related intelligence
Market Presence Over 800 major enterprise and government accounts
Technology
Proven Patent-pending Internet Protocol Database™ (IPDB)
All the data for compliance and security success
Partners
Network
Technology
Partners
- Cisco
- Juniper
- Nortel
- Foundry
Security
- Symantec
- ISS
- McAfee
- Check Point
- RSA
Operating System
- Microsoft
- Linux / Unix
- Sun / HP
- IBM AS400/Main
Application
- MS Exchange
- Oracle
- MS SQL
Other
- Websense
- Bluecoat
- Apache
- EMC
Over 130 device partners
Accolades
“Leader, 3rd Year in a Row”
“Only vendor with all the data”
“Excellent”
“2005 Appliance bake-off winner”
“Leader”
“Largest Market Presence”
What is enVision?
enVision is a network based technology platform that
helps you
•
•
•
•
•
See into
Understand
Protect data and assets
Report on
Store records of
what happened within the network and at its edges
What is enVision?
 800+ customers
 50% of Fortune 10
 40% of top Global Banks
 30% of top US Banks
RSA enVision
Market-Proven Leadership
Energy & Utility
Healthcare
Fortune 500
Financial Services
The Enterprise Today
Mountains of data, many stakeholders
Malicious Code Detection
Spyware detection
Real-Time Monitoring
Troubleshooting
Access Control Enforcement
Configuration Control
Privileged User Management
Lockdown enforcement
Unauthorized
Service Detection
False Positive
Reduction
IP Leakage
Web server
activity logs
User
Monitoring
Switch logs
VA Scan logs
Windows
domain
logins
Windows logs
Web cache & proxy logs
SLA Monitoring
Content management logs
IDS/IDP logs
Router logs
VPN logs
Firewall logs
Wireless
access
logs
Oracle Financial
Logs
Mainframe
logs
Linux, Unix,
Windows OS
logs
Client & file
server logs
DHCP logs
San File
Access
Logs
VLAN Access
& Control logs
Database Logs
How do you collect & protect all the data necessary to secure
your network and comply with critical regulations?
Growth of Enterprise Silos
Redundant Information Management
ACCESS
CONTROL
SOFTWARE
FINANCIAL
SOFTWARE
FIREWALLS
OPERATING
SYSTEMS
WORKSTATIONS
ANTIVIRUS
SOFTWARE
INTRUSION
PREVENTION
Solution: RSA enVision
An Information Management Platform…
Server Engineering
Business Ops.
Compliance Audit
Baseline
Asset Ident.
Log Mgmt.
Risk Mgmt.
Security Ops.
Report
Compliance Operations
Access Control
Configuration Control
Malicious Software
Policy Enforcements
User Monitoring & Management
Environmental & Transmission Security
Desktop Ops.
Network Ops.
Alert/Correlation
Security Operations
Forensics
Access Control Enforcement
SLA Compliance Monitoring
False Positive Reduction
Real-time Monitoring
Unauthorized Network Service Detection
More…
All the Data
Log Management
Any enterprise IP device – Universal Device Support (UDS)
No filtering, normalizing, or data reduction
Security events & operational information
No agents required
…For
Compliance &
Security Operations
Application & Database
Incident Mgmt.
Log Management
®
with the LogSmart Internet Protocol
Database
®
LogSmart Internet Protocol Database
Security event & operations
info. No data filtering
No agents required
Flexible XML UDS engine
Parallel architecture ensures alert
performance
Raw logs (95%+ data compression)
~70% overall compression
Easy to deploy appliance
packaging
Customizable work environments
Fully customizable compliance & security reports
RSA enVision and LogSmart IPDB
All the Data™ with Consistently High Performance
Limitations of
Relational Database
• Not designed for
unstructured data (log)
• Requires processing
(filter, normalize, parse)
• Unpredictable consumption:
Parallel analysis
collection bottleneck impacts
use of data (e.g. alerts)
• Data Loss: events are lost
due to selective collection or
system bottleneck
•Authenticated
Data Explosion:
Relational Database
indexes &
related
data structure information
Compressed
is added (can result in <10x data)
Encrypted
LogSmart IPDB
RSA Envision:
The LogSmart® IPDB™ Advantage
Data Storage Advantage
Collection Rate Advantage
(EPS)
GBs Per Day
250
10,000
9,000
200
8,000
7,000
150
6,000
5,000
100
4,000
3,000
50
2,000
1,000
0
1000 EPS
5000 EPS
10,000 EPS
Events Per Second (EPS)
RDBMS
LogSmart IPDB
0
System Performance
RDBMS
LogSmart IPDB
RSA enVision Deployment
Scales from a single appliance….
Baseline
Correlated
Alerts
Realtime
Analysis
Report
Forensics
Interactive
Query
Integrated Incident
Mgmt.
Event
Explorer
Analyze
Manage
Collect
Collect
Collect
UDS
Windows
Server
Netscreen
Firewall
Cisco
IPS
Juniper
IDP
Microsoft
ISS
RSA enVision Supported Devices
Trend Micro
Antivirus
Device
Device
Legacy
RSA enVision Deployment
…To a distributed, enterprise-wide architecture
D-SRV
A-SRV
LC
D-SRV
NAS
NAS
LC
London
European
Headquarters
Chicago
WW Security
Operations
A-SRV
D-SRV
D-SRV
Bombay
Remote Office
NAS
LC
A-SRV:
D-SRV:
LC:
RC:
Analysis Server
Data Server
Local Collector
Remote Collector
LC
New York
WW Compliance
Operations
Security and Compliance Solutions
RSA enVision
Protects the Enterprise
Internal Systems &
Applications
Secure operations of all
systems and data associated
with internal network services
and applications
eCommerce
Operations
Secure operations of all
systems and data
associated with
eCommerce operations
Perimeter Network
Operations
Securely connect the
enterprise to the Internet
and other required
corporate entities
RSA enVision
A Framework for Security Operations
Security Environment
Internal Systems
& Applications
eCommerce
Operations
Perimeter
Network
Operations
Security Objective
Access Control Enforcement
Real-time Monitoring
Privileged user monitoring
Product
Capabilities
Corporate policy conformance
Troubleshoot network & security
events
Log Management
“What is happening?”
False Positive Reduction
Correlated Threat Detection
Watchlist Enforcement
Unauthorized Network Service
Detection
SLA Compliance Monitoring
= Most critical
= Highly desired
= Desired
Confirm IDS alerts
Enable critical alert escalation
Watch remote network areas
Consolidate distributed IDS alerts
External threat exposure
Internal investigations
Shutdown rogue services
Intellectual property leakage
Proof of delivery
Monitor against baselines
Asset Identification
Baseline
Report & Audit
Alert
Forensic Analysis
Incident Management
Correlation Example – Worm Detection
Correlation Rule Name: W32.Blaster Worm
The goal of this rule is to detect Blaster worm variants as well as other
malicious code by analyzing network traffic patterns.
Vulnerability and Asset Management (VAM)
Customer objective: Leverage information about enterprise assets and known
vulnerabilities to identify false-positive IDS messages and to provide content on assets
and vulnerabilities.
•
VAM will help reduce the costs associated with incident handling by providing analysts direct
insight into the state of an asset (e.g. detected vulnerabilities) and into the details of the
identified vulnerability
Features:
•
•
•
•
Enhanced collection of asset data from vulnerability assessment tools.
•
VA tools supported at 3.5.0 are ISS and Nessus.
•
NEW VA tools supported in 3.7 : McAfee Foundscan, nCircle IP360, Qualys Inc. QualysGuard
Incorporation of vulnerability data from NVD, periodically updated.
Display of asset and vulnerability data in web UI and EE.
Suppression of IDS messages in alerting, based on confidence levels determined from attributes of assets and
vulnerabilities.
•
IDS products supported at 3.5.0 are Dragon, ISS, and Snort.
•
IDS Producst supported at 3.7 are: ISS Real Secure, Cisco IDS, McAfee Intrushield, Juniper IDP [Netscreen]
3COM/Tipping Point Unity One
Vulnerability and Asset Management (VAM)
RSA enVision
A Platform for Compliance Operations
COBIT
NIST
ISO
COSO
RSA enVision
ITIL
“Companies that choose individual solutions for each regulatory
challenge they face will spend 10 times more on compliance
projects than those that take a proactive approach.”
Lane Leskela, Gartner Research Director
RSA enVision
Transformation of Data into Actionable Intelligence
Dashboards
Over 800 reports for
regulatory compliance
& security operations
Information Lifecycle Management
(ILM)
Challenge: Explosive Growth of Security Data
Extensive Data Retention Requirements
Regulation
Data Retention
Requirements
Penalties
Fines to $5M
Sarbanes-Oxley
5 years
PCI
Corporate Policy
GLBA
6 years
Fines
Basel II
7 years
Fines
Imprisonment to 10 years
Fines
Loss of credit card privileges
6 years
HIPAA
$25,000
2 years after patient death
NERC
3 years
TBD
FISMA
3 years
Fines
NISPOM
6 months to 1 year
Fines
Source: Enterprise Strategy Group, 2006
Security Information Lifecycle Management
Up to 1 Year
Capture
Compress
The
Retention Policy
Retain
Store
lifecycle
of Security
Log inData
Secure
Nearline
Online
The Lifecycle of Security Log Data
Retire
RSA enVision ILM
Maximized Data Value at Lowest Infrastructure Cost
ILM
 User Defines Log Retention Policies
 RSA enVision Automatically Enforces Policies
Online Policy (1 Year)
Capture
Compress
Secure
Retention Policy
Store
Online
EMC Celerra
Retain
in Nearline
EMC Centera
Retire
Supported Protocols
> Syslog, Syslog NG
> SNMP
> Formatted log files
>Comma/tab/space delimited, other
> ODBC connection to remote databases
> Push/pull XML files via HTTP
> Windows event logging API
> CheckPoint OPSEC interface
> Cisco IDS POP/RDEP/SDEE
B-2
RSA enVision
Stand-alone Appliances to Distributed Solutions
300,000
30000
LS Series
EPS
10000
7500
ES Series
5000
2500
1000
# DEVICES
500
100
200
400
750
1250
1500
2048
30,000
Industry Leading Scalability
Organization
Locations
Events
Devices
Driver
MSSP
INTERNAL
30,000
Security
•Configuration Control
•Access Control Enforcement
•Privileged User Monitoring
5.6T/
Year
20,000
Compliance & Security
•Real-Time Monitoring
•False Positive Reduction
•Access Control Enforcement
38.8T/
Day
148T/
Year
28,000
Compliance
•SAS 70 Compliance
80K/
Sec
6.9B/
Day
2.5T/
Year
4,000
95K/
Sec
8.2T/
Day
2.9T/
Year
17,000
34
240K/
Sec
20B/
Day
76.8T/
Year
18
180K/
Sec
15.5B/
Day
28
450K/
Sec
4
3
Compliance & Security
•Log Management
•Monitoring Firewalls For Audits
Compliance
•Internal Audit
Network Intelligence
Compliance and Security Operations
Asset Identification
Baseline
Enterprise-wide
Log Management
Platform
All the
Data
Reports
Alerts
Forensics
Incident Management
Business
Operations
Compliance
Operations
Security
Operations
Thank you!
Vulnerability and Asset Management (VAM)
Customer objective: Leverage information about enterprise assets and known
vulnerabilities to identify false-positive IDS messages and to provide content on assets
and vulnerabilities.
•
VAM will help reduce the costs associated with incident handling by providing analysts direct
insight into the state of an asset (e.g. detected vulnerabilities) and into the details of the
identified vulnerability
Features:
•
•
•
•
Enhanced collection of asset data from vulnerability assessment tools.
•
VA tools supported at 3.5.0 are ISS and Nessus.
•
NEW VA tools supported in 3.7 : McAfee Foundscan, nCircle IP360, Qualys Inc. QualysGuard
Incorporation of vulnerability data from NVD, periodically updated.
Display of asset and vulnerability data in web UI and EE.
Suppression of IDS messages in alerting, based on confidence levels determined from attributes of assets and
vulnerabilities.
•
IDS products supported at 3.5.0 are Dragon, ISS, and Snort.
•
IDS Producst supported at 3.7 are: ISS Real Secure, Cisco IDS, McAfee Intrushield, Juniper IDP [Netscreen]
3COM/Tipping Point Unity One
Vulnerability and Asset Management (VAM)
Existing VA Scanners
•
•
Open Source Nessus
ISS SiteProtector
New VA Scanners
•
•
•
McAfee Foundscan
nCircle IP360
Qualys Inc. QualysGuard
New IDS/IPS Vulnerability Mapping
References (Cont)
Supported IDS Devices
•
•
•
•
•
•
•
Dragon IDS
Snort / Sourcefire
ISS Real Secure
Cisco IDS
McAfee Intrushield
Juniper IDP [Netscreen]
3COM/Tipping Point Unity One
New Device Additions In 3.7.0
F5BigIP
MS DHCP
MSIAS
EMC Celerra CIFS
Lotus Domino
RSA Access Manager
Aventail
Qualysguard
Foundscan
nCircle