IBM Proventia Management SiteProtector SP2001

Overview:

Managing your security infrastructure is never an easy task, but when you're trying to manage multiple devices, security vendors and compliance regulations, it can seem impossible. IBM Proventia® Management SiteProtector^TM system offers a simpler, cost-effective way to manage security solutions and ease regulatory compliance by providing a central management point to control security policy, analysis, alerting and reporting for your business.

Highlights:

• Reduces the cost and complexity of security management through central control of diverse network and host security devices
• Enhances risk communication through event analytics and flexible, customizable reporting
• Leverages existing investments by integrating with current systems
• Provides flexibility to expand to support additional types and functions of security offerings

Managing your security operations from a central point

Managing your security infrastructure is never an easy task, but when you're trying to manage multiple devices, security vendors and compliance regulations, it can seem impossible. Over time, the cost and complexity of securing your organization can rise substantially, without a corresponding decrease in your exposure to security risks and noncompliance. Valuable resources are continually diverted from revenue-gathering projects while your IT staff spends hours on day-to-day administration.

IBM Proventia Management SiteProtector^TM system offers a flexible, one-stop security management system to command and control a broad array of network security agents and devices required to monitor and measure your exposure to vulnerabilities and demonstrate regulatory compliance. It can reduce the burden of your IT security team by unifying the management of IBM security platform offerings across gateways, networks, servers and desktops, as well as select third-party security solutions. Backed by, and integrated with IBM Internet Security Systems^TM (ISS) X-Force research and development team with its tools, online security information and security updates, the SiteProtector system can help minimize your overall risk and increase efficacy of your security team with maximum cost efficiency.

Easing the cost and complexity of security management

The SiteProtector system helps reduce operational costs by automating and simplifying tasks such as setting policies, applying updates, scanning and enabling protection. From a single interface, you can monitor events and manage all of your IBM ISS technologies, including network and host intrusion prevention, scanning, desktop security and multifunction security. With just one system to deploy, learn and maintain, one vendor to turn to for support and one management console to control your security infrastructure, this innovative solution can help you reduce the costs and complexity associated with security management and free your IT staff to focus on other critical projects.

You can organize your security devices within the SiteProtector system and create custom-defined groupings for an enterprisewide risk perspective of assets, threats and vulnerabilities. The SiteProtector system includes advanced features to help you correlate and prioritize near real-time vulnerability and threat information to help you quickly assess the information that's most critical or relevant to your environment—enabling IT staff to focus on your greatest risks. You can also use the SiteProtector system to increase the priority level of alerts and reduce console and database clutter by discarding details of unsuccessful attacks. The SiteProtector system facilitates a robust roles and permissions model to help you delegate responsibilities among various team members. Site administrators can use a Web browser from virtually any location to grant selected users the ability to perform certain functions. For example, administrators may allow some users to see and operate security devices located in a certain geography, while limiting others as read-only users without the ability to change security policy.

Evaluating and communicating your risk posture

The SiteProtector system can help you quickly identify and communicate potential threats, and assess your security posture by enabling you to:

• Identify risk
• Perform threat mitigation
• Reduce burdensome maintenance
• Perform event monitoring and analysis
• Set security policy
• Discover vulnerabilities

Easy-to-use, customizable reporting capabilities let you sort information by virtually any parameter and provide auditors and regulators with critical information. The SiteProtector system also allows you to make timely adjustments to policies. Guided analysis capabilities help transform even the new security analyst into a knowledgeable expert, taking the guesswork out of event analysis and aiding your security analyst with logical investigation paths to quickly get to the cause of an issue.

A broad array of reports—both predefined and customized—within the SiteProtector system can allow you to identify and document:

• Staff who can access the system
• Ticketing activities
• Policy, audit, assessment, administration and compliance management
• Vulnerability and configuration management
• Information about overall compliance levels, resolutions, current threats and trends
• Detailed information on compliance at the asset, operating system and line-of-business levels

SiteProtector reporting capabilities not only help ease compliance measures, but they can also provide specific details regarding security breaches. Reports on asset security, vulnerability remediation and trends provide an enterprise view of improvements to your security posture over time and help enable intelligent, cost-effective decisions regarding your network. A forced versioning feature within the SiteProtector policy editor helps enable automated tracking and logging of policy history to further reduce the burden of change-control compliance.

Integrating with existing systems to leverage your investments

The SiteProtector system can provide seamless integration with existing security solutions to leverage your existing investments, including:

• Microsoft Windows Active Directory
• Support of Microsoft SQL Server database clusters
• VMware ESX 3.5
• Remedy ticketing integration
• Support of two-factor authentication

In addition, your own IT department or other vendors can programmatically enable their applications to leverage the SiteProtector data repository.

Expanding to support evolving requirements

The SiteProtector system can scale to meet expanding requirements of today's dynamic enterprise, enabling you to broaden your security by incrementally adding other types of security products, including network and host intrusion prevention systems (IPSs) and multifunction devices. You can also expand in depth by adding more security devices within a single function. You can scale in both of these dimensions—as well as add policies into your security system—with virtually no increase in operational cost.

Because the SiteProtector system offers a consistent interface that employees can quickly become familiar with, you can nearly eliminate the need for staff to learn new systems when you add new protection—easing the deployment of new protection devices, management of device updates and administration of management policies. The SiteProtector system includes a year of updates, patches and basic technical support.

Proventia Management SiteProtector System Solution:

Extending security management capabilities to ease reporting

Heightening security threats and compliance requirements can translate into multiple management systems to learn, patterns to analyze and reports to create. Over time, the cost and complexity of managing security can rise substantially, without a corresponding decrease in exposure to security risks and noncompliance.

IBM Internet Security Systems™ (ISS) offers a flexible, one-stop security management solution that can scale as your needs evolve. From a single interface, IBM Proventia Management SiteProtector™ system helps you command the security devices and policies required to monitor your exposure to vulnerabilities and accurately report your security posture. Greatly expanded analyzing and reporting capabilities can enable you to customize templates, analyze threat patterns and quickly generate proof of compliance. And in the event of a hardware failure, superior resiliency capabilities can help you maintain policies and settings.

Highlights:

• Helps simplify security management and generate cost efficiencies
• Enhances communication of security and regulatory risk
• Designed to provide immediate and strong resilience in case of a disaster

Simplifying security while improving cost-effectiveness

By consolidating management of your entire security infrastructure, the SiteProtector system extends the reach and ability of a single administrator to perform numerous functions on multiple devices from one console—including allowing you to add devices as your needs grow. In addition to helping you save time and money on security management, the SiteProtector system enables you to perform more complex security analyses and reports to enhance your business intelligence. For example, you can create a specific analysis of critical information based on any number of filters, and then immediately convert it into a report to share internally or prepare it for auditors.

The SiteProtector dashboard provide sat-a-glance status on current threat events, their severity, their sources and your overall system health, as shown in Figure1.

Figure 1. At-a-glance status of your overall system security from a single console

Enabling flexible, customizable reporting to enhance communication
The business intelligence and reporting toolkit (BIRT) allows you to literally do more with less: more detailed and extensive reporting creation and design with far less effort. Carefully designed around the user experience to empower security teams to quickly, easily and recurrently meet compliance requirements, BIRT functions as an open user community where reports can be posted, modified and shared to leverage the intelligence gathered from and the creativity of the user community. The SiteProtector reporting solution combined with the BIRT community provides flexibility and customization, enabling you to:

• Build your own or use default reports
• Customize the report perspective (for example, where attacks originated)
• Share report templates with the SiteProtector user community
• Re-label and describe reports for different audiences
• Select appropriate asset groups to report on
• Filter and sort based on all available criteria

From the SiteProtector dashboard, you can create a custom report or use one of the default templates to create are port based on any number of criteria, such as top events as shown in Figure2.

Figure 2. Reader friendly reports help simplify proof of compliance by a single click

You can create detailed reports to analyze your security posture and use the intelligence to proactively defend your system against attacks. Figure 3 shows part of a report that indicates the top 10 specific sources of attack.

Figure 3. Graph from a detailed report that leverages business intelligence

Providing resiliency and robust growth capability

For security and compliance officers who need the highest level of resiliency, the SiteProtector system provides an effective means to help quickly recover policies and settings in case of a hard-ware failure or other disaster—and the flexibility to evolve as needs change. SiteProtector can automatically transfer the latest configuration settings to a secondary instance with minimal down-time. In addition, SiteProtector pre-allocates disk space to archive security events using a structured file format that enables easy migration, storage, backup and recovery. As your security or compliance requirements expand, SiteProtector can help protect your investment through the ability to add security controls and devices as your business dictates, without increasing your total cost of ownership.

Packages:

Additional modules available separately: Remedy Ticketing Integration, SecureSync, Event Archival and Restore, Third Party Module

* to be limited by the scalability of the appliance

Technical Specifications:

Documentation:

Download the IBM Proventia Management SiteProtector System Datasheet (PDF).