security intelligence solutions - ibm€¦ · fully integrated security intelligence • turnkey...
TRANSCRIPT
Security Intelligence Solutions
Joseph Skocich,
WW Sales Integration Executive
Q1 Labs, an IBM Company
June 2012
Know what is going on inside your enterprise with QRadar
1
Security Intelligence
--noun 1. the real-time collection, normalization, and analytics of the
data generated by users, applications and infrastructure that impacts the IT security and risk posture of an enterprise
Security Intelligence provides actionable and comprehensive insight for managing risks and threats from protection and
detection through remediation
What is Security Intelligence?
2
The Security Intelligence Leader
Who we are:• Innovative Security Intelligence software company• One of the largest and most successful SIEM vendors• Leader in Gartner 2012, 2011, 2010, 2009 Magic Quadrant
Award-winning solutions:• Family of next-generation Log Management, SIEM, Risk
Management, Security Intelligence solutions
Proven and growing rapidly:• Thousands of customers worldwide• Five-year average annual revenue growth of 70%+
Now part of IBM Security Systems:• Unmatched security expertise and breadth of integrated
capabilities
3
IT Security is a board room discussion
Business results
Sony estimates potential $1B long term impact –$171M / 100 customers*
Supply chain
Epsilon breach impacts 100 national brands
Legal exposure
TJX estimates $150M class action settlement in release of credit / debit card info
Impact of hacktivism
Lulzsec 50-day hack-at-will spree impacts Nintendo, CIA, PBS, UK NHS, UK SOCA, Sony …
Audit risk
Zurich Insurance PLc fined £2.275M ($3.8M) for the loss and exposure of 46K customer records
Brand image
HSBC data breach discloses 24K private banking customers
*Sources for all breaches shown in speaker notes
4
Solving a security issue is a complex, four-dimensional puzzle
People
Data
Applications
Infrastructure
Employees Consultants Hackers Terrorists Outsourcers Customers Suppliers
Systems applications
Web applications Web 2.0 Mobile apps
Structured Unstructured At rest In motion
It is no longer enough to protect the perimeter –siloed point products will not secure the enterprise
5
Q1 Labs: Solving Customer Challenges with Total Security Intelligence
Detecting threats others miss• Arm yourself with total security intelligence
Consolidating data silos• Collect, archive and analyze data in one integrated
solution
Detecting insider fraud• Next generation SIEM with identity correlation
Predicting risks against your business• Full life cycle of compliance and risk management for
network and security infrastructures
Exceeding regulation mandates• Automated data collection and configuration audits
Detecting threats others miss• Discovered 500 hosts with “Here You Have” virus,
which all other security products missed
Consolidating data silos• 2 Billion logs and events per day reduced to 25 high
priority offenses
Detecting insider fraud• Trusted insider stealing and destroying key data
Predicting risks against your business• Automating the policy monitoring and evaluation
process for config. change in the infrastructure
Exceeding regulation mandates• Real-time monitoring of all network activity, in addition
to PCI mandates
6
Solutions for the Full Compliance and Security Intelligence Timeline
7
QRadar: The Most Intelligent, Integrated, Automated Security Intelligence Platform
8
Intelligent:Context & Correlation Drive Deepest Insight
9
Bolted Together Solution
• Scale problems• Non-integrated reporting & searching• No local decisions• Multi-product administration• Duplicate log repositories Operational bottlenecks
• Highly scalable• Common reporting & searching• Distributed correlation• Unified administration• Logs stored once Total visibility
Integrated:Unified Platform for Scale & Ease of Use
QRadar Integrated Solution
10
Automated:No need for additional staff
Analyze
Act
Monitor
Auto-discovery of log sources, applications and assetsAsset auto-groupingCentralized log mgmtAutomated configuration audits
Auto-tuning Auto-detect threatsThousands of pre-defined rules and role based reportsEasy-to-use event filteringAdvanced security analytics
Asset-based prioritizationAuto-update of threatsAuto-responseDirected remediation
11
Fully Integrated Security Intelligence
• Turnkey log management• SME to Enterprise• Upgradeable to enterprise SIEM
• Integrated log, threat, risk & compliance mgmt.• Sophisticated event analytics• Asset profiling and flow analytics• Offense management and workflow
• Predictive threat modeling & simulation• Scalable configuration monitoring and audit• Advanced threat visualization and impact analysis
• Network analytics• Behavior and anomaly detection• Fully integrated with SIEM
• Layer 7 application monitoring• Content capture• Physical and virtual environments
SIEM
Log Management
Risk Management
Network Activity & Anomaly Detection
Network and Application
Visibility
12
Fully Integrated Security Intelligence
• Turnkey log management• SME to Enterprise• Upgradeable to enterprise SIEM
• Integrated log, threat, risk & compliance mgmt.• Sophisticated event analytics• Asset profiling and flow analytics• Offense management and workflow
• Predictive threat modeling & simulation• Scalable configuration monitoring and audit• Advanced threat visualization and impact analysis
• Network analytics• Behavior and anomaly detection• Fully integrated with SIEM
• Layer 7 application monitoring• Content capture• Physical and virtual environments
SIEM
Log Management
Risk Management
Network Activity & Anomaly Detection
Network and Application
Visibility
One Console Security
Built on a Single Data Architecture
13
QRadar: The Most Intelligent, Integrated, Automated Security Intelligence Platform
• Eliminates silos• Highly scalable• Flexible, future-proof
• Easy deployment• Rapid time to value• Operational efficiency
• Proactive threat management• Identifies most critical anomalies• Rapid, complete impact analysis
14
Summary
1. Most intelligent, integrated and automated solution
2. Most sophisticated threat analytics and compliance automation
3. Rapid time to value, with low staffing requirements
4. Easily scales as deployments and security data grow
5. Established market leadership with excellent support
6. Easy to do business with, backed by best channel relationships
7. IBM’s unmatched security expertise and breadth of integrated capabilities
15
What to do next?
• Read our blog:http://blog.q1labs.com/
• Follow us on Twitter: @q1labs @ibmsecurity
• Watch our recent webcasts:http://q1labs.com/resource-center/media-center.aspx
• Download the 2012 Gartner SIEM Report http://q1labs.com/resource-center/analyst-reports/details.aspx?id=150
17
Acknowledgements, disclaimers and trademarks© Copyright IBM Corporation 2012. All rights reserved.
The information contained in this publication is provided for informational purposes only. While efforts were made to verify the completeness and accuracy of the information contained in this publication, it is provided AS IS without warranty of any kind, express or implied. In addition, this information is based on IBM’s current product plans and strategy, which are subject to change by IBM without notice. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this publication or any other materials. Nothing contained in this publication is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software.
References in this publication to IBM products, programs or services do not imply that they will be made available in all countries in which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth, savings or other results. All statements regarding IBM future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only.
Information concerning non-IBM products and services was obtained from a supplier of those products and services. IBM has not tested these products or services and cannot confirm the accuracy of performance, compatibility, or any other claims related to non-IBMproducts and services. Questions on the capabilities of non-IBM products and services should be addressed to the supplier of those products and services.
All customer examples cited or described are presented as illustrations of the manner in which some customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics may vary by customer and will vary depending on individual customer configurations and conditions. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results.
Prices are suggested U.S. list prices and are subject to change without notice. Starting price may not include a hard drive, operating system or other features. Contact your IBM representative or Business Partner for the most current pricing in your geography.
IBM, the IBM logo, ibm.com, Tivoli, the Tivoli logo, Tivoli Enterprise Console, Tivoli Storage Manager FastBack, and other IBM products and services are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol (® or ™), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at ibm.com/legal/copytrade.shtml