Recommended
More Related Content
What's hot
What's hot (20)
Similar to Cloud access unified siem
Similar to Cloud access unified siem (20)
More from hardik soni
More from hardik soni (13)
Recently uploaded
Recently uploaded (20)
Cloud access unified siem
- 1. Copyright CloudAccess, Inc. 2016, Confidential Unified SIEM Product Strategy and Positioning
- 3. Detection Prevention Awareness SIEM Unification of SIEM and Security Context Technologies delivered in a single product Security Context Technologies Management Technologies
- 4. SIEM Incident Management Risk Intelligence Storage Unification of Technologies Unified SIEM Management Security Technology
- 5. 1.SIEM 3. Sensor 2. Logger How? 3 Components Monitoring & Management Intelligent Correlation Security Dashboard Transaction Data Security Information 1. SIEM 2. Logger
- 7. Security Intelligence comes from Context information Processing PROCESSING 1. Attacks & Logs 2. Vulnerabilities & Threats 3. Inventory 4. Users 5. Network & Resources 6. Applications & Data 7. Ext. Reputation CONTEXT 1. Intelligence
- 8. Attack Inventory Vulnerability / Threat 50%30% 20% False Positive CleaningPrioritization Effective Impact Analysis 1. Intelligence SIEM products have achieved great intelligence, but they are rarely fed with the information to use it 100%
- 9. All security technologies required by Compliance Regulations Detection IDS/IPS WIDS HIDS File Integrity Prevention Vulnerability Assessment Threat Assessment Awareness Identity Inventory Resources SIEM Incident Management Risk Intelligence Storage 2. Compliance PCI 11.4 requires NIDS/ IPS deployment PCI 11.1: WIDS and Rogue AP detection PCI 11.4 requires HIDS PCI 11.5 File integrity PCI 6.2 identify new threats ISO 10.10 requires monitoring system resources PCI 1.1.5, PCI WG, ISO 7.1.1 require asset inventoty PCI 11.2 quarterly vulnerability scans FISMA, HIPAA, ISO 12.6: periodic security testing PCI 12.9 respond immediately to breach SOX, ISO, PCI SOX 304 & PCI 10.5 Secure audit trails
- 10. InventoryAttacks Threats 1 100second … … second … 300… second … Effective Security Posture and Analysis delivered in 300 seconds 3. Time
- 11. Dramatic reductions 1. Unified Licenses & Hardware 2. Integration Services 3. Maintenance & Support Up to 90% Cost Reduction 4. Cost
- 13. SIEM Incident Management Risk Intelligence Storage CloudAccess Unified SIEM vs Pure SIEM Unified SIEM Management Detection IDS/IPS WIDS HIDS File Integrity Prevention Vulnerability Assessment Threat Assessment Awareness Identity Inventory Resources Security Context
- 14. 1. Fast - Customer Security Posture from the first second 2. Stealthy – Will not break the customer’s network 3. Complete – Provide all security services in a single box Out-of-the-box full Security Visibility The Sensor Advantage
- 15. inspire SIEM in the Cloud Elastic SaaS Customer Profile
- 16. CloudAccess SaaS Web Services Elastic • Performance Scaling • Multi-tier hybrid Architectures Scaling Lowest Barrier of Entry with Elastic Scaling in Performance and Complexity Customer Premises Cloud
- 17. Hybrid Architecture Customer Premise Cloud Function Deploy Lev 1 Analysis Cloud 2 Storage Cloud | CP 3 Vulnerability Mgmt A. External B. Internal Cloud CP 4 Detection & Awareness CP
- 18. Detection & Awareness Local Vulnerability ScanTiered 2nd Level Collection Customer3 is using Local Vulnerability Scanning, CloudAccess Sensor on Customer Premise Customer2 is using Managed IDS service, CloudAccess Sensor on Customer Premise Customer1 has no on-site gear, sends logs to CloudAccess Customer4 has complete CloudAccess solution on premise, Managed by CloudAccess CloudAccess Flexible Architecture - Examples
- 20. Function Technology Identity Monitoring • Active Directory • LDAP • Authentication logs Network Auto-Discovery Topology Map Recurrent snmp scans Inventory • Passive fingerprinting • Active fingerprinting • Host agent • WMI Profiling Time-Service-Usage profiling Resource Monitoring Network Monitoring Flows Network Availability Snmp Host Resources Snmp Anomaly detection Any resource Unified Situational Awareness: Autodiscovery
- 21. PCI Requirement Solution 11.1 “Deploy a WIDS/WIPS “ CloudAccess Sensor includes a WIDS/WIPS WG “Maintain an up-to-date wireless hardware inventory” Automatically done by Situational Awareness WG “Detect Rogue AP and unauthorized wireless connections” Correlate information between WIDS and Inventory 4.1.1 “Ensure strong cryptography .. WEP is prohibited” Monitored by WIDS default Out-of the-box PCI Wireless Compliance
- 22. Policy Management Visualization Compliance Reporting Detection/analytics Integration Incident Response Host Security Other Features and Enhancements Vulnerability Assessment Asset Management Network Monitoring User Management Network Discovery Dashboards Usability Performance Enhancements in all areas of function:
- 23. 1 unique Login 1 unique Asset Structure 1 unique User Structure Unified Management
- 24. SIEM
- 25. Log Management
- 27. Unified WIDS
- 28. Unified HIDS
- 31. Summary CloudAccess Unified SIEM 3.0 is a unique offering in the market Compliance, Time and Cost advantages make CloudAccess Unified SIEM 3.0 the most competitive solution CloudAccess enables broad Enterprise adoption CloudAccess Unified SIEM 3.0 changes the game for SIEM customers.
- 32. Thank You