WIXLIB

RSA Solution Brief RSA enVision PlatformReal-time Actionable Security Information,Streamlined Incident Handling, EffectiveSecurity MeasuresRSA Solution Brief

The job of Security Operations, whether a large organization with a dedicated staffand resources, or one person with multiple responsibilities, is to keep informationassets secure by continually monitoring the organization’s IT environment,anticipate and respond to immediate threats and long-term vulnerabilities, andprovide advice and guidance on security matters to both senior management andbusiness units. To be effective, security operations professionals must draw ontools that day in and day out turn a myriad of real time events into actionabledata. They need an efficient closed-loop process for handling incidents andmitigating risk. They also need the visibility necessary to assess and fine-tune theeffectiveness of security policies, processes and resources.The RSA enVision platform collects, analyzes,correlates and alerts on log data from all eventsources across the network and IT infrastructure. Italso intelligently combines real-time threat,vulnerability, IT asset and environmental data. Thisenables organizations to respond quickly andthoroughly to high-risk security issues and pinpointthe places where problems are likely to appear. Byautomating manual processes and increasingproductivity, the RSA enVision platform deliversincreased security while reducing cost.With over 1600 production customers world-wideacross every industry, including 5 of the Fortune 10and 40% of top global banks, the RSA enVisionplatform:To be effective, securityoperations professionals mustturn a myriad of real time eventsinto actionable data.1RSA Solution Brief– Provides real-time, actionable security informationfor quick and accurate threat detection and alerting– by combining event data, asset and vulnerabilityinformation, and utilizing intelligent correlationcapabilities, security professionals prioritize andfocus on the issues that support the businessneeds.– Improves analyst productivity by streamlining theincident handling process – by providing access toreal, empirical data and offering a built-in workflow,from initial identification and prioritization of anincident, to investigation with contextualinformation, to escalation, resolution, closure andarchiving, security professionals efficiently andeffectively accelerate problem resolution.– Increases the effectiveness of security measures andresources – by giving security professionals visibilityinto their enterprise, the status of an incident , thevulnerability and risk of high-priority assets and theuse of security resources through comprehensivereporting and easy to use dash-boards, securityorganizations can focus staff on high-risk issues andadapt and adjust policies, procedures andinvestments in order to mitigate risk.

The RSA enVision Platform – What Is It?Analysts agree that the RSA enVision platform is amarket-leading solution for security information andevent management (SIEM). It gives organizations asingle, integrated 3-in-1 log management solution forsimplifying compliance, enhancing security operationsand risk mitigation and optimizing IT and networkoperations through the automated collection,analysis, alerting, auditing, reporting and storage ofall logs.Simplify compliance.Enhance security operations.Optimize network operations.Enhancing Security esData/Tools NeededRSA enVision SolutionInterface between theSecurity status “at a glance”;Graphical and tabular executive dashboards;business and Securitysecurity metricsextensive out-of-the-box reportsDesign & maintain SecurityMetrics to track effectivenessExtensive reports (security and compliance); out-of-Policy and controls; generalof policies and controlsthe-box and easy to customize dashboards; historicalOperations; set direction;justify budgetSecurityArchitectunderstanding of state ofand trend reportssecurity and complianceSecurityOversee Security OperationsResource and securitySecurity status and productivity dashboardsresources and budgets;metrics, including incidentincluding: team workload, incident rate, tasks byincident response oversightresponse statisticspriority for workload management; and vulnerabilityManagerdashboards including most vulnerable assets rankedby severity or by business ratingMonitor consoles, deviceAsset & vulnerability status,Baseline, event, asset and vulnerability data toconfiguration & vulnerabilitythreat information, real-timereduce false positives and alert, in real-time, on highmanagement, detectand long-term event data,security-risk incidents; extensive content-richSecurityincidents, respond to alerts,baseline, policy and identitycorrelation rules (e.g. SANS Top 20); automatedAnalystconduct investigations,information. NeedWatchlists (e.g. Privileged User Monitoring);manage incident resolution;collaborative incidentcollaborative closed-loop incident handling process,provide technical advicehandling process; tools tofrom incident identification and research throughfocus on high-risk incidentsresolution, closing and archivingRSA Solution Brief2

Real-time Incident DetectionCorrelation rules,filters, watchlistsComprehensive log dataIncidentDetectionEvent sourceknowledgeAsset contextSecuritySecurityAnalystArchitectReal-Time, Actionable Information forQuick and Accurate Threat Detection andAlertingThe RSA enVision platform examines and analyzesevents in real-time to detect and alert on high priorityincidents. It combines best-of-breed log managementcapabilities, advanced correlation functions andcomprehensive knowledge of threats andvulnerabilities to provide security organizations theability to efficiently and accurately “find the needle inthe haystack.”Event Data Collection – The RSA enVision platformwas purpose-built to collect event data from any andevery event source, including network, security, hostand storage devices as well as applications anddatabases. With its LogSmart IPDB (Internet ProtocolData Base) architecture, RSA enVision softwarecollects events without agents, allowing for fasterdeployment and reduced ongoing management. Itdoes not filter, reduce, normalize or alter the raw3RSA Solution BriefTimely threatinformationVulnerability dataevent information, allowing organizations to accesscomplete data and therefore to identify an incident inreal-time, investigate it, anticipate problems andconduct complete forensic analysis for internal orexternal auditors. Secure, scalable storage andindustry-leading compression rates deliver a costeffective solution.Vulnerability and Asset Management – The RSAenVision platform gives event data additional contextby combining it with data from vulnerabilityassessment tools and configuration managementsystems. This allows it to alert administrators whenvulnerabilities appear on critical systems andprioritize security alerts based upon the value of theasset being attacked and its vulnerabilities. It alsomakes a rich set of contextual data available toanalysts investigating security incidents so that theycan make better decisions about how to respond.

Advanced Correlation Rules & Watchlists – The RSAenVision platform provides a wide set of content-richcorrelation rules that define the conditions underwhich an alert or notification should be automaticallytriggered. These correlation rules can be easilyenhanced with new content, and can be tailored tocreate environment-specific conditions that will detectrisk and eliminate or reduce the window of exposure.With watchlists, organizations can easily create andupdate lists of mission critical assets, or of accepted(or forbidden) assets so that, for example, corebusiness applications, privileged users, formeremployees, spammers, known hackers, or bot-netservers can be automatically monitored. The SANS Top20 Watchlist, for instance, monitors for any exploitrelated to the SANS Top 20 list.Timely Threat Information – The RSA enVision platformimports information from IDS/IPS devices commonlyused by enterprises. These devices continually scanthe network to detect occurring threats such ashackers attacking systems or gathering informationfrom them. It also contains an embedded vulnerabilityrepository derived from the Department of HomelandSecurity’s National Vulnerability Database; it containsdetailed descriptions about current vulnerabilitiessuch as an explanation of its potential impact, thetype of loss it can cause and an indication of how anexploit may result in a confidentiality ect high-risk administrative actions onAdministrativecritical assets, like out-of-policy configurationActivitychanges to high- risk assets, or unusualprivilege delegationSuspiciousDetect unusual authentication or accessUser Activitycontrol issues, like multiple failed logons, orunauthorized system accessesHigh RiskDetect new high risk vulnerabilities on criticalVulnerabilitiesassets, or likely attacks on vulnerable hostsSuspiciousDetect unusual deviations in network behavior,Networkor network activity that violates policyActivityCriticalDetect critical errors on high-priority systemsSystem Errorsthat might result in a system outageThe RSA enVision platform thus performs theautomatic correlation of security events with what isknown about an IT asset, its priority to the businessand its relative vulnerability. In this way, itdramatically reduces false positives and alerts onhigh-risk events, enabling the security operationsteam to take immediate action on prioritizedincidents.A large global post-trade processing infrastructure companylooking for multiple logging protocols, event aggregationand correlation, real-time alerts, privileged user monitoringand focused threat detection found that enVision helpedthem “ find the needle in the haystack. [It] points us to thearea to look for the needle and sometimes it puts the needleright on top of the haystack.”RSA Solution Brief4

SecuritySecurityAnalystManagerStreamlined Incident Handling ProcessA closed-loop,collaborative processRSA enVision software provides real-time notificationof high-risk security issues that need to be handled bysecurity analysts and specialists. Whether in an email, a console alert, or a blackberry message, anotification begins the incident handling processwhere the goal is to quickly reach effective resolutionand closure.Examine all available information & supportingevidence with easy to use UI, broad searchcapabilities with contextual information includingpowerful asset and vulnerability lookupSort, categorize & prioritizeincoming incidentsAnalysisGather, document and preserveinformation and analysis of evidence;audit trail of complete investigationTriageForensicsReports onincident statusNotificationTrack & TraceTrace views to monitor activity byuser, IP address, etc.CloseEscalate and/orRemediateAccept status change fromdownstream ticketing system forcomplete closed-loop processAutomatically escalate to downstream systems (e.g.ticketing, configuration management) or to domain expert,and include all relevant annotations and log recordsRemediate: Track and document incidentresolution/remediation5RSA Solution Brief