The Lazy Genius

Security News & Brain Dumps from Xavier Ashe, a Bit9 Client Partner

Archive for October, 2012

IBM Security Access Manager for Cloud and Mobile

Posted by Xavier Ashe on October 30, 2012

The new IBM Security Access Manager for Cloud and Mobile bundle brings together market leading capabilities of IBM Tivoli Federated Identity Manager Business Gateway (TFIM-BG) and IBM Tivoli Security Policy Manager (TSPM).

IBM Security Access Manager for Cloud and Mobile provides the following key capabilities:

 

  • Helps detect and prevent user access fraud by enforcing risk-based access control
  • Reduces costs and complexity by enabling single sign-on and federation for cloud and on-premise applications
  • Improves security posture and helps demonstrates compliance through centralized policy management

IBM Security Access Manager for Cloud and Mobile extends user access protection to mobile and cloud environments using federated single sign-on, user authentication, and risk scoring based on location, device, access pattern, etc.  IBM Security Access Manager for Cloud and Mobile provides risk-based access control from mobile end points such as smartphones and tablets so that users don’t inadvertently expose your sensitive IT assets in an unsafe environment.

IBM Security Access Manager for Cloud and Mobile helps enterprises adopting cloud-based services leverage single sign-on for secure information sharing across private, public and hybrid cloud environments.  Using IBM Security Access Manager for Cloud and Mobile, enterprises can implement a powerful mediation service for Cloud, SaaS and web services, while reducing administrative costs, establishing trust and facilitating compliance.
IBM Security Access Manager for Cloud and Mobile highlights:

  • Risk-based access control for anytime/anywhere access from mobile devices
  • Cloud Single Sign-On and Federation with easy onboarding of applications
  • Centralized Policy Management and Fine-grained Access Control

Posted in IBM, Security | Leave a Comment »

New features in QRadar 7.1

Posted by Xavier Ashe on October 29, 2012

Stolen from the QRadar 7.1 Release notes:

 

  • Upgraded Operating System – QRadar 7.1 includes a substantial upgrade to the operating system. During the upgrade process on your system, the following operating system updates occur:
    • For systems that previously used the CentOS operating system, the operating system is replaced with the Red Hat Linux 6.2 operating system.
    • For systems that previously used the Red Hat Linux 5.7 operating system, the operating system is upgraded to the Red Hat Linux 6.2 operating system.

      If your system is configured with off-board storage solutions, you are required to remount your storage solutions during the upgrade process. We recommend that you carefully read the Upgrading to QRadar Release 7.1 Guide and the Reconfiguring Offboard Storage After Upgrading to QRadar 7.1 Technical Note.

  • New WinCollect Agent – QRadar 7.1 introduces WinCollect and the WinCollect agent for collecting and managing Windows-based events using the Admin tab in QRadar. For more information on WinCollect, see the WinCollect User Guide.
  • New Vulnerability Details Page on the Assets Tab – QRadar 7.1 introduces the Research Vulnerability Details window, which you can access from the Assets tab. The Research Vulnerability Details window provides information about known vulnerabilities detected by third-party scanners. Vulnerability information and identifiers are sourced from external references, such as the Open Source Vulnerability Database (OSVDB) and National Vulnerability Database (NVDB). QRadar 7.1 also includes the ability to import vulnerability data from scanners that do not store data with OSVDB or NVDB references, such as IBM Appscan Enterprise.
  • New Index Management – The Index Management feature is accessed from the Admin tab. Index Management allows you to control database indexing event properties. By enabling indexing on event properties, you can optimize the speed of your searches.
  • New Dedicated Event Collector Appliance and Supporting Store and Forward – QRadar 7.1 introduces the QRadar 1501 appliance, which is a dedicated Event Collector. This appliance is also available as the QRadar 1590 virtual appliance.
  • Using Store and Forward accessed from the Admin tab, you can now store events on your dedicated Event Collector during your business hours. These events can be forwarded to an Event Processor during periods of time when the transmission does not negatively affect your network bandwidth. For example, you can configure a dedicated Event Collector to only forward events to an Event Processor during non-business hours, such as midnight until 6 AM.
  • Updated VFlow Collector Installation Procedure – The VFlow Collector installation procedure is updated to make the process consistent with the virtual appliance installation process. For more information, see the QRadar Installation Guide.

Posted in IBM, QRadar, Security, Security Intelligence | Leave a Comment »

Videos about IBM XGS 5000, NextGen IPS

Posted by Xavier Ashe on October 8, 2012

It’s been interesting to watch the firewall and IPS space over the years.  First we had firewall vendors adding IPS features.  Then we had IPS vendors adding firewalls features.  Personally, I’ve always thought it made sense to use an IPS with firewall features because I’ve never seen a firewall with an IPS worth using.  Now application aware firewalls have proven useful, it’s time for IPS vendors to add more application awareness.  Hey look, I work for an IPS vendor 😉

IBM’s Security Network Protection XGS 5000 is a next generation intrusion prevention system, adding tons of features to IPS like web content, application and application action control, protocol analysis based intrusion prevention, URL filtering, Injection Logic Protection, Shell Code Heuristics, and virtual patch.

Marketing bullet points:

  • Help stop threats from compromising unpatched vulnerabilities without sacrificing high-speed network performance.
  • Help protect networks, servers, desktops, and business critical applications from malicious threats.
  • Conserve network bandwidth and provide insight into what users are doing on the corporate network. It helps control user bandwidth consumption by limiting or eliminating access to nonbusiness critical applications.
  • Help enforce compliance and internal corporate usage of nonbusiness critical applications such as social networking, peer to peer file transfers, instant messaging traffic, and streaming media.
  • Provide an extensible security platform that can grow as threats evolve, help consolidate network protection technologies, and help reduce the cost of deploying and managing point solutions.

You can get lots of print literature here, but who wants to read when you can watch videos on YouTube.

IBM Security NextGen IPS Use Case Videos

IBM Security NextGen IPS How to Videos

Posted in IBM, ISS, Security | Tagged: , , , | Leave a Comment »

QRadar and QRM 7.1 are Generally Available!

Posted by Xavier Ashe on October 5, 2012

The QRadar Product Management team is very glad to announce the General Availability (GA) of QRadar SIEM and Risk Manager Version 7.1.  Another major milestone of the QRadar product, QRadar 7.1 delivers several new key features to meet the needs of our current and future customers, a new appliance and new tools to provide more flexibility in deploying the QRadar solution, and great usability features to increase the visibility to more security intelligence data, as well as the ability to better optimize and tune QRadar.

The new features of QRadar SIEM 7.1 consist of:

  • Index Management:  More refined control over the creation of indexes used for searches and exposure of field and index usage statistics, enabling more efficient storage utilization and performance optimization.
  • Store and Forward: Capability of collecting and storing events by a new appliance, Event Collector (EC), in a remote location and forwarding events to an upstream Event Processor for analysis based on a pre-determined policy,  allowing effective log collection at remote network locations with unreliable network connections or bandwidth constraints.
  • Import/Export of Security Contents: Ability to export security and configuration content on a QRadar system to an external, portable format which then can be imported into another QRadar system, with a command line interface, enabling quick deployment of a new QRadar system or sharing of security contents across systems.
  • Vulnerability Details Screen – Enhanced GUI screens to display detailed vulnerability data imported from third party vulnerability scanner products, allowing customers to fully explore the nature and relevance of vulnerabilities on the hosts involved in QRadar detected incidents and offenses.
  • WinCollect: Complete centralized control of local and remote Windows event collection, with bulk adding of servers, per server troubleshooting, automated deployment and update of policy and agent itself.  Also includes tuning for different environments and support for latest capabilities like XPath queries.

The new features of QRM 7.1 consist of:

  • P2P Networks: Support for point-to-point networks, such as VPNs and serial links. This allows customers to add these links to their QRM network topology.
  • Firewall Rule Reporting: Perform comprehensive reporting on firewall rules, including shadowed, most and least used rule reports. Reports can be generated across multiple firewalls and is full integrated into the QRadar reporting engine.
  • Enhanced Policy Monitoring:  Monitor policy question passes and failures, typically required for compliance reporting. Customers can now generate reports that show that network policies have been in compliance over a given period of time, in addition to those which were not compliant.

Posted in IBM, QRadar | 2 Comments »

 
%d bloggers like this: