IBM RealSecure Server Sensor

Overview:

IBM RealSecure Server Sensor helps dramatically reduce network security costs while protecting enterprise server environments and reducing down-time.

Protect critical assets from cyber-threats
IBM RealSecure Server Sensor from IBM Internet Security Systems (ISS) is designed to help protect business-critical servers from both internal and external threats. Its real-time intrusion detection and prevention helps reduce network security costs while protecting enterprise server environments and reducing downtime. RealSecure Server Sensor analyzes events, host logs, and inbound and outbound network activity on critical enterprise servers to help block malicious activity from damaging critical assets. The solution applies built-in signatures and sophisticated protocol analysis to prevent known and unknown attacks.

Highlights:

• Server Protection - Designed to protect the underlying operating system by helping to prevent attackers from exploiting operating system and application vulnerabilities.
• Web Application Protection - Provides Secure Sockets Layer (SSL) encrypted application layer intrusion monitoring, analysis, and response capability for both Apache and IIS web servers.
• Advanced Intrusion Prevention/Blocking - Monitors all traffic to and from the server or network in order to detect and prevent inbound attacks as well as block new and unknown outbound attacks such as buffer overflows, Trojans, brute force attacks, unauthorized access and network worms.
• Console and Network-Based Intrusion Protection - Provides the flexibility to detect and prevent both console and network-based attacks through log monitoring capabilities that detect malicious activity before it causes any damage.
• Broad Platform Coverage - Provides you with the flexibility to grow their server protection strategy regardless of the environment: Windows, Solaris, HP-UX, AIX and Linux.
• Windows Server 2003 and Windows 2000 Server Certified - This rigorous test is endorsed for business-critical applications by analysts and enterprise customers alike because it verifies features and functionality that make applications more robust and manageable.
• Audit policy management - Centralized management of operating system audit policy helps ensure that all critical servers have consistent and effective audit policy and allows for the management of true kernel-level auditing.
• Global Technical Support - Provides customers with a wide array of support offerings, specifically designed to meet the cost and service demands of diverse networking environments.

RealSecure Server Sensor provides automated, real-time intrusion protection and detection by analyzing events, host logs, and inbound and outbound network activity on critical enterprise servers in order to block malicious activity from damaging critical assets.

RealSecure Server Sensor applies built-in signatures and sophisticated protocol analysis with behavioral pattern sets and automated event correlation to help prevent known and unknown attacks.

Proventia Management SiteProtector - You can control, monitor and analyze your security protection systems from one central site with a minimum of staff and operational costs. This integrated system enables monitoring of intrusion activity, vulnerability assessment, event prioritization and correlation of ongoing security activity, as well as multi-site management capabilities. No other solution provides the real-time end-to-end visibility into and across the enterprise-wide security program while capitalizing on resource investments.

Advanced Event Correlation and Analysis - Provides built-in X-Force security knowledge to dynamically escalate threatening security incidents and reduce false alarms. The module instantly correlates security data from multiple sources to escalate serious threats, such as an attack on a vulnerable asset or a covert, multi-step attack.

Backed by the X-Force - X-Force is one of the most respected Internet security research groups in the industry, having researched and identified security issues in products from Cisco, Microsoft, IBM, Sun, Hewlett-Packard, Oracle, Peoplesoft, BMC, Polycom, Apache and many more. This cutting-edge research team actively turns security research into product improvements, allowing Internet Security Systems' customers to respond far more rapidly to evolving threats.

Benefits:

• Provides preemptive protection against system/network-level, application-level and internal threats
• Utilizes multiple layers of defense to combat numerous threat vectors
• Combines a server firewall with vulnerability- centric intrusion prevention and comprehensive system auditing capabilities
• Establishes security controls through customized policies to help enterprises meet and exceed internal compliance standards
• Supports regulatory compliance with preemptive protection that maps to existing infrastructure and processes
• Helps to protect at-risk systems with IBM Virtual Patch® technology before vendor- supplied patches are available
• Aids in maintaining server integrity through customizable registry and file monitoring
• Supports operating system (OS) migration paths, helping to sustain continuous protection for virtually any major operating system
• Helps to reduce system administrator workload through centralized management with IBM Proventia® Management SiteProtector™ systems
• Offers up-to-date security intelligence powered by the IBM Internet Security Systems X-Force® research and development team

Features:

Server Protection - Protects the underlying operating system by preventing attackers from exploiting operating system and application vulnerabilities.

Web Application Protection - Provides Secure Sockets Layer (SSL) encrypted application layer intrusion monitoring, analysis, and response capability for both Apache and IIS web servers.

Advanced Intrusion Prevention/Blocking - Monitors all traffic to and from the server or network to detect and prevent inbound attacks as well as block new and unknown outbound attacks such as buffer overflows, Trojans, brute force attacks, unauthorized access and network worms.

Console and Network-Based Intrusion Protection - Provides the flexibility to detect and prevent both console and network-based attacks through log monitoring capabilities that detect malicious activity before it causes any damage.

Broad Platform Coverage - Provides organizations with the flexibility to grow their server protection strategy regardless of the environment: Windows, Solaris, HP-UX, AIX and Linux.

Windows Server 2003 and Windows 2000 Server Certified - This rigorous test is endorsed for business-critical applications by analysts and enterprise customers alike because it verifies features and functionality that make applications more robust and manageable.

RealSecure Server Sensor is certified on the following platforms by VeriTest, the authorized worldwide lab to test enterprise applications for Microsoft's "Certified for Windows" program:

• Windows Server 2003 Standard Edition
• Windows Server 2003 Enterprise Edition
• Windows Server 2003 Datacenter Edition
• Windows 2000 Server
• Windows 2000 Advanced Server
• Windows 2000 Datacenter Server

Audit policy management - Centralized management of operating system audit policy ensures that all critical servers have consistent and effective audit policy and allows for the management of true kernel-level auditing.

IBM Proventia Management SiteProtector - Customers can control, monitor and analyze their security protection systems from one central site with a minimum of staff and operational costs. This integrated system enables monitoring of intrusion activity, vulnerability assessment, event prioritization and correlation of ongoing security activity, as well as multi-site management capabilities. No other solution provides the real-time end-to-end visibility into and across the enterprise-wide security program while capitalizing on resource investments.

Advanced Event Correlation and Analysis - Provides built-in X-Force security knowledge to dynamically escalate threatening security incidents and reduce false alarms. The module instantly correlates security data from multiple sources to escalate serious threats, such as an attack on a vulnerable asset or a covert, multi-step attack.

Backed by the X-Force - X-Force is the most respected Internet security research group in the industry, having researched and identified security issues in products from Cisco, Microsoft, IBM, Sun, Hewlett-Packard, Oracle, Peoplesoft, BMC, Polycom, Apache and many more. This cutting-edge research team actively turns security research into product improvements, allowing Internet Security Systems' customers to respond far more rapidly to evolving threats.

Global Technical Support - Provides customers with a wide array of support offerings, specifically designed to meet the cost and service demands of diverse networking environments.

Features and Capabilities

RealSecure Server Sensor is designed to preemptively combat threats and address vulnerabilities at the network and application levels while performing security compliance auditing.

Analyze and block network-based threats
RealSecure Server Sensor is designed to protect against network vector attacks, including worms, bot worms, Trojans and denial-of-service (DoS) attacks, through a local firewall and inline vulnerability-centric intrusion prevention. RealSecure Server Sensor includes:

• Firewall
• Advanced intrusion prevention/blocking
• Protocol analysis module (PAM)
• Centralized management

Analyze and block application-level threats
RealSecure Server Sensor’s layered intrusion prevention inspects and blocks application traffic with malicious code activity, including applications running on both Apache and Internet Information Services (IIS) Web servers. RealSecure Server Sensor provides:

• Preemptive Web application protection with Secure Sockets Layer (SSL) inspection
• HTTP/application protection
• Buffer-overflow exploit prevention*

Perform security compliance auditing
RealSecure Server Sensor helps you achieve regulatory compliance and provides centralized management of OS audit policies to protect vulnerabilities that arise from application design, development or deployment flaws. This also helps ensure that all critical servers have a consistent audit policy to protect data confidentiality and accessibility by monitoring logins, privilege escalations and other system-level activity. RealSecure Server Sensor integrates with the existing infrastructure and enables:

• Policy management and enforcement auditing
• Log monitoring
• Registry integrity monitoring
• OS auditing
• File integrity monitoring

*Available for Microsoft Windows operating sytem only

Data Loss Prevention using multi-layered preemptive protection:

Server security is a critical component of your organization’s data loss prevention strategy. RealSecure Server Sensor’s multi-layered prevention technology guards against threats from internal and external attacks. Today’s hybrid attacks and sophisticated cyber-criminals can break through conventional defenses, and no single technology is adequate to protect servers from the variety of modern threats. Powerful multi-layered protection from IBM Internet Security Systems™ (ISS) is designed to block attacks before they can cause damage and compromise sensitive data. With robust, multi-layered protection from a single agent, RealSecure Server Sensor is easier to manage than the variety of security technologies needed to combat sophisticated threats.

RealSecure Server Sensor includes the following security technologies:

• Firewall – blocks unauthorized access to ports and IP addresses, preventing IP spoofing and terminal hijacking
• Intrusion Prevention System (IPS) – uses both signature-based and protocol-based analysis to prevent known and unknown attacks
• Buffer Overflow Exploit Prevention (BOEP) – recognizes and prevents malicious code targeting memory buffer vulnerabilities (Windows)
• Web Application Protection – protects Web applications running on both Apache and IIS Web servers by inspecting Secure Sockets Layer (SSL) encrypted traffic (Windows and Solaris only)
• IBM Virtual Patch technology – automatically applies protection for vulnerabilities before vendor-supplied patches can be installed

RealSecure Server Sensor – multi-layered protection against internal and external threats.

Operating Systems:

RealSecure Server Sensor supports the following operating systems:

• Microsoft Windows NT® 4.0
• Microsoft Windows 2000 Server, Advanced Server
• Microsoft Windows Server 2003 Standard, Web and Enterprise Editions
• Sun Solaris 8, 9 and 10 (64-bit and 32-bit SPARC)
• IBM AIX® 5.1, 5.2 and 5.3 (64-bit and 32-bit POWERPC)
• HP-UX 11.0, 11.11 and 11.23 (64-bit and 32-bit PA-RISC)
• VMware ESX 2.5

Proventia Network Software Comparison Matrix:

Uncompromising Protection for Every Layer of Your Network

Combines multi-layered technologies to protect desktops and servers from the growing threat spectrum while enabling them to keep data and applications reliable, available and confidential.

• IBM Proventia Server Intrusion Prevention System
• IBM RealSecure Server Sensor
• IBM Proventia Endpoint Secure Control

Proventia Network Software:
Model:
	Endpoint Secure Control	RealSecure Server Sensor	Proventia Server
Typical Deployment	Workstations/Laptops	Servers	Servers
Maximum Recommended Nodes/Users	Client-based license	Client-based license	Client-based license
Security Content Updates	Powered by X-Force; 3rd party anti-virus, DLP & encryption capabilities available	Powered by X-Force	Powered by X-Force
Form Factor	Software	Software	Software
Capabilities Summary
Intrusion Prevention	Yes	Yes	Yes
Intrusion Detection	Yes	Yes	Yes
Antivirus (behavior-based)	Yes	No	No
Antivirus (signature-based)	Yes	No	No
Content Filtering	Yes	No	No
Protected segments	Yes (via 3rd Party Integration)	N/A	N/A
Web Application/ Database Protection	Yes	Yes	Yes
VoIP Security	Yes	Yes	Yes
Spyware Prevention	Yes	Yes	Yes
VPN	No	N/A	N/A
Hardware-Related Specifications
Monitoring or scanning interfaces	N/A	N/A	N/A
Inline protected segments	N/A	N/A	N/A
Throughput available	N/A	N/A	N/A
Concurrent sessions (rated maximum)	N/A	N/A	N/A
Maximum connection per second	N/A	N/A	N/A
High Availability/ Failover	N/A	N/A	N/A
Host Protection Featrues
Log Auditing	N/A	Yes	Yes
Application Control	Yes	No	No
Buffer Overflow Exploit Protection	Yes	Yes	Yes
Supported Operating Systems/Platforms	Windows	Windows, HP-UX, Solaris, AIX, VMware	Windows, Linux, VMware
Vulnerability Management Features
Scanning Discovery	N/A	N/A	N/A
Asset Classification	N/A	N/A	N/A
Vulnerability Assessment	N/A	N/A	N/A
Scanning Windows	N/A	N/A	N/A
Workflow Solution	N/A	N/A	N/A
Results Reporting	N/A	N/A	N/A
Mail Security Features
Spam detection rate	N/A	N/A	N/A
False positive rate	N/A	N/A	N/A
Spam and compliance analysis modules	N/A	N/A	N/A
Anti-phishing/Image-based Spam	N/A	N/A	N/A
Granular policy control	N/A	N/A	N/A
Global/group/user settings	N/A	N/A	N/A
End user access	N/A	N/A	N/A

Documentation:

Download the IBM Realsecure Server Sensor Datasheet (PDF).

Download the IBM Realsecure Server Sensor Brochure (PDF).