IBM Proventia Server Protection

Overview:

IBM Internet Security Systems™ (ISS) – Proventia server protection delivers multilayered intrusion prevention and detection to help protect your servers from growing methods of attack and more thoroughly manage compliance through extensive monitoring, recording and auditing capabilities.

Highlights:

• Designed to protect against multiple types of attacks, including those tunneling through encrypted Web transactions
• Combines multiple inspection technologies to offer superior protection at the deepest network levels
• Helps ensure data confidentiality and ease regulatory compliance through extensive monitoring
• Aids in reducing cost and complexity through centralized security management and extensive support for multiple operating systems
• Helps you realize the benefits of virtualization
• IBM Proventia Web Application Security: Integrated into the IBM Proventia family of network and server security products, this feature offers proactive Web application, Web 2.0 and database protection to limit potential business interruptions and exposures

Deepening your defense strategy

Every year, one in two organizations suffers a serious security breach—costing an average of $6.6 million per breach—despite having a firewall and antivirus protection in place¹. And while operating system and application patches attempt to stem the continual waves of attacks, hackers are increasingly stealing sensitive data through Web applications, as can be seen by the exponential growth in Web attacks. Internal breaches, unintentional or deliberate, are also a continuing source of potential security hazards.

Backed by IBM Internet Security Systems^TM (ISS) X-Force® research and development team, IBM Internet Security Systems – server protection delivers multilayered intrusion prevention and detection to help protect your servers from growing methods of attack and more thoroughly manage compliance through extensive monitoring, recording and auditing capabilities. IBM ISS – server protection is enabled in two proven products: IBM Proventia® Server Intrusion Prevention System (IPS) and IBM RealSecure® Server Sensor. Each supports a broad range of operating systems and provides robust security against numerous attacks, including denial of service, remote exploit, SQL injection and cross-site scripting.

¹ CSI/FBI Computer Crime & Research Survey and Ponemon / PGP: U.S. Cost of a Data Breach Study

Server Protection Solution:

IBM ISS – server protection is enabled in two proven products: IBM Proventia® Server Intrusion Prevention System (IPS) and IBM RealSecure® Server Sensor. Each supports a broad range of operating systems and provides robust security against numerous attacks, including denial of service, remote exploit, SQL injection and cross-site scripting.

Protecting servers while maintaining maximum throughput and uptime
Security is the sum of its parts. Unlike other server protection solutions, IBM ISS – server protection provides deep packet inspection as one of its six layers of security. Among their blocking capabilities, Proventia Server IPS and RealSecure Server Sensor offer:

• A firewall that puts you in control by enabling you to decrease the number of threats both from resourceful, external hackers and from internal sources who might have better aim at your vulnerabilities.
• An intrusion prevention system that utilizes multiple layers of defense to help provide accurate, preemptive protection against system, network, application-level and internal threats.
• IBM Virtual Patch® technology, which helps prevent known and unknown attacks regardless of whether a vulnerability patch has been issued.
• Buffer overflow exploit protection (BOEP) to help prevent the exploitation of known and unknown buffer overflow vulnerabilities.
• Application black and white listing, which helps you enforce the application policy to reduce the number unauthorized applications running, thereby decreasing server exposure to malicious activity.
• The ability to inspect secure Web transactions before they’re delivered to the Web application.

Protocol analysis module (PAM) technology

The IBM protocol analysis module (PAM) drives security convergence to deliver network and server protection that goes beyond traditional IPS.

IBMISS – server protection features the protocol analysis module (PAM), a deep packet inspection engine, which is core to all IBM ISS security technology. Combining multiple inspection technologies, PAM goes far beyond what other server protection solutions offer to provide comprehensive, proactive defense. Furthermore, IBM ISS – server protection integrates seamlessly with your existing IT infrastructure to pre-serve legitimate traffic flows without interruption, so you can keep your business running smoothly while shielding data with malware delivery protection.

Easing data confidentiality and regulatory compliance measures
To help you manage compliance with standards and regulations, such as the Payment Card Industry (PCI) Data Security Standard (DSS) and the Health Insurance Portability and Accountability Act (HIPAA), as well as internal security standards, IBM ISS – server protection incorporates four types of monitoring:

• System integrity monitoring alerts you of user interaction with the operating system and applications and provides information about who logged in, what actions they took and when they logged off.
• File integrity monitoring helps you meet intensive data integrity standards like Sarbanes-Oxley by monitoring user interaction with sensitive files and folders. The key use of this technology is to detect system tampering and to monitor access to sensitive data.
• Registry integrity monitoring also helps you meet data integrity standards by monitoring and recording successful and failed actions taken on registry keys, creating a forensic trail of administrative and user behavior—essential for some standards reporting—that can home in on potential vulnerability points.
• Third-party log monitoring helps keep track of events triggered by third-party applications that are potential security threats.

In addition, IBM ISS – server protection incorporates antivirus enforcement to confirm that servers are receiving the latest antivirus updates and report non-compliant servers. Proventia Server for Microsoft® Windows® is certified by NSS Labs for host intrusion prevention systems (HIPS) and PCI compliance.

Simplifying security across a broad range of operating systems
IBM ISS – server protection is designed to provide intrusion prevention and detection across a broad array of enterprise operating systems, including Microsoft Windows, Linux®, IBMAIX®, UNIX®, Solaris and HP-UX. At the same time, it gives you simple, guided control over the entire solution through the IBM Proventia Management SiteProtector® system for security devices, policies, events analysis, alerts and workflows. Through a single inter-face, you can monitor, analyze, make adjustments and generate reports—without sinking time and money into deploying and learning multiple management tools.

Optimizing IT operations through virtualization
IBM ISS – server protection is virtual-environment ready to help you achieve the return on investment (ROI) that server virtualization offers while helping to maintain security at the server and operating system levels. Virtual machine-centric protection secures intra-virtual network communications by analyzing network traffic going to and from virtual machines where the HIPS agent is installed. Another key benefit is the support of mobility by maintaining persistent protection while traveling with the virtual machine as it is moved from physical host to physical host. IBM ISS – server protection is designed to deliver continuous security, providing support for the following environments:

• VMware ESX
• Windows Server 2008 Hyper-V
• IBM Power Systems™ logical partitions and workload partitions
• Hewlett-Packard vPars and nPars
• Solaris Container

Proventia Network Software Comparison Matrix:

Uncompromising Protection for Every Layer of Your Network

Combines multi-layered technologies to protect desktops and servers from the growing threat spectrum while enabling them to keep data and applications reliable, available and confidential.

• IBM Proventia Server Intrusion Prevention System
• IBM RealSecure Server Sensor
• IBM Proventia Endpoint Secure Control

Proventia Network Software
Model:
	Endpoint Secure Control	RealSecure Server Sensor	Proventia Server
Typical Deployment	Workstations/Laptops	Servers	Servers
Maximum Recommended Nodes/Users	Client-based license	Client-based license	Client-based license
Security Content Updates	Powered by X-Force; 3rd party anti-virus, DLP & encryption capabilities available	Powered by X-Force	Powered by X-Force
Form Factor	Software	Software	Software
Capabilities Summary
Intrusion Prevention	Yes	Yes	Yes
Intrusion Detection	Yes	Yes	Yes
Antivirus (behavior-based)	Yes	No	No
Antivirus (signature-based)	Yes	No	No
Content Filtering	Yes	No	No
Protected segments	Yes (via 3rd Party Integration)	N/A	N/A
Web Application/ Database Protection	Yes	Yes	Yes
VoIP Security	Yes	Yes	Yes
Spyware Prevention	Yes	Yes	Yes
VPN	No	N/A	N/A
Hardware-Related Specifications
Monitoring or scanning interfaces	N/A	N/A	N/A
Inline protected segments	N/A	N/A	N/A
Throughput available	N/A	N/A	N/A
Concurrent sessions (rated maximum)	N/A	N/A	N/A
Maximum connection per second	N/A	N/A	N/A
High Availability/ Failover	N/A	N/A	N/A
Host Protection Featrues
Log Auditing	N/A	Yes	Yes
Application Control	Yes	No	No
Buffer Overflow Exploit Protection	Yes	Yes	Yes
Supported Operating Systems/Platforms	Windows	Windows, HP-UX, Solaris, AIX, VMware	Windows, Linux, VMware
Vulnerability Management Features
Scanning Discovery	N/A	N/A	N/A
Asset Classification	N/A	N/A	N/A
Vulnerability Assessment	N/A	N/A	N/A
Scanning Windows	N/A	N/A	N/A
Workflow Solution	N/A	N/A	N/A
Results Reporting	N/A	N/A	N/A
Mail Security Features
Spam detection rate	N/A	N/A	N/A
False positive rate	N/A	N/A	N/A
Spam and compliance analysis modules	N/A	N/A	N/A
Anti-phishing/Image-based Spam	N/A	N/A	N/A
Granular policy control	N/A	N/A	N/A
Global/group/user settings	N/A	N/A	N/A
End user access	N/A	N/A	N/A

Documentation:

Download the IBM Proventia Server Protection Datasheet (PDF).