enVision安全信息和事件集中管理20P

1、rsa envision安全信息和事安全信息和事件集中管理件集中管理您將如何收集和保護(hù)這些對(duì)于您的系統(tǒng)安全至關(guān)重要的數(shù)據(jù)？今天的企業(yè)今天的企業(yè)數(shù)據(jù)如山、人員眾多、設(shè)備龐雜、信息難以管理、企業(yè)信息安全面對(duì)多種挑戰(zhàn)數(shù)據(jù)如山、人員眾多、設(shè)備龐雜、信息難以管理、企業(yè)信息安全面對(duì)多種挑戰(zhàn)router logsids/idp logsvpn logsfirewall logsswitch logswindows logsclient & file server logswireless access logswindows domain loginsoracle financial logssan

2、 file access logsvlan access & control logsdhcp logslinux, unix, windows os logsmainframe logsdatabase logsweb server activity logscontent management logsweb cache & proxy logsva scan logsunauthorizedservice detectionip leakageconfiguration controllockdown enforcementfalse positive reduction

3、access control enforcementprivileged user managementmalicious code detectionspyware detection real-time monitoringtroubleshootinguser monitoringsla monitoring解決方案: rsa envision完整的安全信息和事件管理平臺(tái) 合規(guī)運(yùn)行合規(guī)運(yùn)行安全運(yùn)行安全運(yùn)行access controlconfiguration controlmalicious softwarepolicy enforcementsuser monitoring &

4、 managementenvironmental & transmission securityaccess control enforcementsla compliance monitoringfalse positive reductionreal-time monitoringunauthorized network service detectionmoreall the data日志管理日志管理any enterprise ip device universal device support (uds)no filtering, normalizing, or data r

5、eductionsecurity events & operational informationno agents requiredserver engineeringbusiness ops.compliance auditapplication & databasenetwork ops.risk mgmt.security ops.desktop ops.報(bào)表報(bào)表關(guān)聯(lián)預(yù)警關(guān)聯(lián)預(yù)警事件管理事件管理日志管理日志管理.資產(chǎn)識(shí)別資產(chǎn)識(shí)別.調(diào)查分析調(diào)查分析基線基線用于合規(guī)和安全運(yùn)行用于合規(guī)和安全運(yùn)行l(wèi)ogsmart ipdblogsmart ipdb vs 傳統(tǒng)的 rdb關(guān)系型數(shù)

6、據(jù)庫(kù)data explosion加密壓縮并行分析認(rèn)證unpredictable alertsdata lossl-2rsa envision:logsmart ipdb 的優(yōu)勢(shì)顯著的優(yōu)勢(shì)顯著rsa envision單機(jī)設(shè)備到分布式解決方案eps5001000250050001000030000# devices7500300,000 100 200 400 750 1250 1500 2048 30,000es 系列l(wèi)s 系列rsa envision與emc存儲(chǔ)產(chǎn)品集成ipdb compliance dataallthedatacelerraclariionsymmetrixcenteracu

7、rrentfutureenvision安全事件和運(yùn)行數(shù)據(jù)。數(shù)據(jù)無(wú)任何過(guò)濾并行結(jié)構(gòu)確保告警性能無(wú)需任何agent。靈活的uds開(kāi)發(fā)引擎客戶化的工作環(huán)境完全可定制化的合規(guī)和安全報(bào)表易于部署-封裝 非侵入式, 可擴(kuò)展, 易于部署無(wú)需安裝任何代理，廣泛的第三方產(chǎn)品支持 syslog, syslog ng snmp formatted log fileslcomma/tab/space delimited, other odbc connection to remote databases push/pull xml files via http windows event logging api ch

8、eckpoint opsec interface cisco ids pop/rdep/sdee超過(guò)超過(guò)900張用于強(qiáng)制合規(guī)張用于強(qiáng)制合規(guī)和安全運(yùn)行的報(bào)表模板和安全運(yùn)行的報(bào)表模板儀表盤儀表盤rsa envision將數(shù)據(jù)轉(zhuǎn)換成可用信息和智能 報(bào)表模板: 900+預(yù)置報(bào)表模板實(shí)時(shí)關(guān)聯(lián)分析之基線管理severity levels calculationseverity levels calculationscore over time65586798786864575348625559545754615758605550524810%7%18%81%2%14%16%3%-5%19%28%04050

9、60708090100123456789101112time (in minutes)score value-100102030405060708090% differencecurrent scorescore baseline% difference10% higher than score baseline = guarded25% higher than score baseline = elevated50% higher than score baseline = high75% higher than score baseline = severe 關(guān)聯(lián)分析案例：未知蠕蟲病毒發(fā)現(xiàn)

10、correlation rule name: w32.blaster wormthe goal of this rule is to detect blaster worm variants as well as other malicious code by analyzing network traffic patterns.關(guān)聯(lián)關(guān)聯(lián)分析舉例分析舉例 蠕蠕中病毒發(fā)現(xiàn)中病毒發(fā)現(xiàn)關(guān)聯(lián)分析案例：sql注入式攻擊correlation rule name: sql injection attackthe goal of this rule is to detect information thef

11、t from e-commerce websites through the exploitation of the trusted connection between the web server and the database. jp morgan chase案例介紹案例介紹rsa envison solutionsecurity envision 的部署提供了的部署提供了 24x7 全球關(guān)聯(lián)事件的審計(jì)和實(shí)時(shí)的監(jiān)控與告警全球關(guān)聯(lián)事件的審計(jì)和實(shí)時(shí)的監(jiān)控與告警compliance 通過(guò)實(shí)施全球領(lǐng)先的通過(guò)實(shí)施全球領(lǐng)先的envision解決方案去收集和保護(hù)所有的運(yùn)行數(shù)據(jù)，保障了法規(guī)遵從和解決方

12、案去收集和保護(hù)所有的運(yùn)行數(shù)據(jù)，保障了法規(guī)遵從和內(nèi)部、外部規(guī)范審計(jì)的完善執(zhí)行內(nèi)部、外部規(guī)范審計(jì)的完善執(zhí)行:-sox-sas-70-glbascale & integration 經(jīng)過(guò)與經(jīng)過(guò)與 jpmc信息系統(tǒng)架構(gòu)部門的通力合作信息系統(tǒng)架構(gòu)部門的通力合作, network intelligence 產(chǎn)品成功的部產(chǎn)品成功的部署和集成了所有的署和集成了所有的it設(shè)備和系統(tǒng)設(shè)備和系統(tǒng):-1 million network ports-40 large midrange systems -800 firewalls-200,000 desktop systems-400 network ids s

13、ervers-80 mainframes-40,000 distributed servers美國(guó)三大金融服務(wù)機(jī)構(gòu)之一，美國(guó)三大金融服務(wù)機(jī)構(gòu)之一，3000多個(gè)分支機(jī)構(gòu)遍及全球多個(gè)分支機(jī)構(gòu)遍及全球50多個(gè)國(guó)家多個(gè)國(guó)家the challenge：security 無(wú)法全盤審視企業(yè)全球的信息安全狀況;手工分析所消耗時(shí)間和金錢不可估量compliance 無(wú)法完整的獲得系統(tǒng)源數(shù)據(jù),也就無(wú)法很好的執(zhí)行符合公共法規(guī)以及內(nèi)外部審計(jì)規(guī)范的要求scale&integration 由于無(wú)法全面的收集和匯總系統(tǒng)數(shù)據(jù)，導(dǎo)致無(wú)法及時(shí)準(zhǔn)確地掌握全球的系統(tǒng)運(yùn)行狀況a-srv:analysis serverd-srv: data serverlc: local collectorrc: remote collectornastokyoapacheadquartersd-srvlclclcnasbangalore24 hour security management centera-srvd-srvd-srvlcnasa-srvd-srvcolumbus (oh)24 hoursecurity