IBM Data Security Services for activity compliance monitoring and reporting log analysis management

Transcription

1 Improving your compliance posture and reducing risk through log analysis management IBM Data Security Services for activity compliance monitoring and reporting log analysis management Highlights Provide centralized and Leverage market-leading demonstrable automated log technologies, services expertise collection and storage from and proven methodologies to heterogeneous sources deploy and manage an integrated security solution Address demands of regulators and auditors by establishing Benefit from lower total clear audit trails for incident cost of ownership, acceleraresponse, reducing the risks ted deployment and simpliassociated with security incidents and data breaches an extensible platform and fied management through scalable solutions Monitor and audit the actions taken by privileged users, helping prevent costly damages or outages due to inadvertent mistakes or malicious actions Increasing internal security risks and compliance requirements are escalating costs You rely on privileged users to manage business critical data and the associated systems. At the same time, the constant threat of user error or maliciously handled privileges create an environment ripe for security risk. Manifested security risk may result in significant monetary losses, a tarnished brand or loss of reputation. The human factor privileged users in action burdens corporations in a way that hackers or other external threats cannot, as they reside within your own network. Just the same, overly limiting access rights in an effort to secure data also limits an organization s ability to function and collaborate. Securing data in response to the human factor is only part of the challenge. The pressures of addressing regulatory compliance and internal security directives also push an organization toward effective and accountable security measures. The necessary solution addresses compliance requirements while enforcing the responsible use of sensitive data throughout your

2 enterprise giving you visibility into your user activities and auditfriendly reporting. Applying best practices and methodologies for log analysis management and compliance reporting Organizations must protect data throughout its lifecycle while in use, in motion and at rest. Sharing and portability increases the value contribution of an organization s data yet exposes it to potential security infractions. However, information at rest is also a target and is a key piece of a data security strategy. Therefore, effective organizations promote a collaborative business model that ensures data is protected at all stages in the information lifecycle. Increasingly, the combination of log management and user activity monitoring is required for regulatory compliance and to compete in today s market. As part of a focus on security throughout the information lifecycle, IBM s log analysis management solution enhances collaboration while mitigating risk. IBM implements log analysis management and compliance reporting solutions with your needs in mind to: Establish an enterprise asset management framework for your organization. Deploy market-leading technology using a proven implementation methodology. Translate and enforce corporate and regulatory data management policies. Provide compliance-focused reporting and alerting on noncompliant user activity in support of your security posture. Define and deliver reliable management and support services. IBM Data Security Services addresses the challenges associated with deploying a comprehensive solution by managing cost and scope, accelerating implementation, leveraging IBM s information security expertise and eliminating the need for additional headcount. Centralizing enterprise-wide log analysis management Your business faces the challenges of managing a massive amount of log data as required for audit purposes. Collecting, storing and analyzing this data can take a significant amount of time and expertise. Organizations with limited IT resources, time and manpower have difficulty effectively managing this information. It is a good business practice to minimize the security risk to information in proportion to the importance of such information to the business. Driven by the fact that compliance requirements must be fulfilled in order to meet legal and regulatory obligations: Organizations want to be able to react on indicators that suggest a future status of non-compliance. Organizations want to identify what causes a status of noncompliance in order to avoid it in the future and thus reduce overall risk. IBM Data Security Services can help companies maximize the benefits of log analysis management and compliance reporting to: Identify risks and opportunities to increase efficiency. Help meet legal and regulatory obligations. Support an organization s data security strategy. IBM can design and deploy a solution to collect, store and analyze log data across your enterprise for both compliance and investigative use. Log data is analyzed and compared with security policies; if suspicious activities are detected, the solution can automatically trigger appropriate actions and alerts. As part of this comprehensive solution, IBM can provide ongoing monitoring, reporting and support services to help better manage your risks and information assets. IBM s security specialists are specifically trained to implement a critical layer of defense for information protection, thereby helping to accelerate your compliance efforts and reduce the risk of accidental or intentional tampering. Automating, monitoring, investigating and reporting on user activity across the enterprise to support compliance Data Security Services and IBM Tivoli Compliance Insight Manager software provide a single framework, robust log collection capability and sophisticated interpretation and reporting engines. The solution automates security-audit and compliance-reporting efforts, and interprets native log data from

3 Figure 1: IBM Tivoli Compliance Insight Manager operating systems, mainframes, applications and databases. As a result, you can answer with precision: Who did What type of action on Features What? and When did he do it and Automated audit reporting through Where, from Where and Where to? a compliance dashboard and IBM can provide continuous, nonintrusive assurance and documentary flexible report distribution evidence that your data and systems are being managed in accordance Privileged user monitoring and with company policies and regula- audit on databases, applications, tory directives. servers and mainframes Enabling monitoring, audits, alerts and reports to track and mitigate Translates captured native log data potential threats into easily understood language. When regulatory and internal policies are not being followed, you need the capability to record and respond promptly. Our solution provides all the necessary components to both record and track policy violations Advanced report definition occurring within your organizations. engine allows users to create If further forensic investigations are custom compliance modules needed, historic data can be retrieved and reports. and provided in a readable format. Efficiently collect, store, By choosing our managed security investigate and retrieve logs services, IBM can complete these through automated log activities on your behalf. Additionally, management capability as part of our services, IBM includes policy templates based on customer and industry best practices including the ISO standard to give you a quick start on compliance efforts. IBM also offers tailored policy templates to help you implement security policy, compare actual user behavior with that policy and prepare for stringent security audits. By leveraging IBM expertise gained from thousands of deployments in complex environments around the world, you can be confident that your crucial events are being monitored and reported on throughout your enterprise. Value Centralizes the compliance monitoring process from the collection point, providing concise and understandable information through the dashboard and reports Unobtrusively monitors and reports on privileged user activities, allowing administrators to perform their jobs and support strong controls over user access Patent-pending W7 methodology translates all events into a single language that states Who, did What, When, Where, Where from, Where to and on What, understandable by security personnel, auditors and management. Easy-to-use interface for creating custom reports, including summary and detail reports Helps ensure the reliable and verifiable collection of native logs from virtually any platform, including sys-log and Simple Network Management Protocol (SNMP) logs, and almost any security log type.

4 Speeding deployment and reducing costs of adopting a log analysis and compliance management solution IBM understands data security at the enterprise level, through interaction with customers and utilization of data security solutions in our own internal networks. Our consultants and specialists have experience with a wide range of industry solutions and IT architectures to help you adopt a holistic log analysis and compliance reporting management solution. Our professional security services will: Conduct a Requirements and Planning Workshop to assist in assessing environment, business, compliance and IT requirements, preparing for implementation of controls and developing a holistic approach for integration. Perform Policy Design, which includes translation of regulatory and internal policies and the definition of any custom policies as required. Support the Implementation aspects of a successful deployment including: Implementation planning and project management Solution architecture and design Installation of primary components Role and privilege definition Testing of primary components Pilot deployments Product updates Project documentation Help desk deployment assistance Technical training and skills transfer Project close-out and hand-off. Ensure a single point of contact for technical assistance with a Support Desk for all log and compliance management products licensed and deployed in the solution, including escalation to IBM Tivoli for break/ fix or other business critical issues. IBM Support Desk will own and help manage, track and resolve problems related to the log analysis and compliance management solution. Managing ongoing log analysis and compliance management with IBM Managed Security Services IBM offers ongoing managed services to help you derive optimum value from your solution. Ongoing Remediation and Policy Enforcement for day-to-day operational support from an IBM hosting center to run and manage your deployed log analysis and compliance management solution; IBM helps: Provide ongoing alerting and notification of policy violations Investigate incidents and provide recommendations for remediation Manage policies and maintain solutions to keep your organization current with applicable regulations and mandates Enforce required modifications to existing policies or activate new policies as corrective action and track associated remediation efforts Help prioritize and understand risk factors of the found exceptions Ongoing Monitoring, Response and Reporting to ensure continued solution viability and effectiveness: IBM will: Provide day-to-day operational support to operate and manage the solution after deployment. Schedule and manage log collection and archival. Manage alerting and reporting. Research and investigate suspicious activity or policy deviations. Log and track issues to closure. Monitor and update software associated with the solution. IBM combines refined methods and extensive skills to help you realize the full value of your technology investment. Our services help optimize productivity, manageability and cost-effectiveness within your IT organization. Why IBM Data Security Services and IBM Tivoli Compliance Insight Manager? Together IBM Data Security services and IBM Tivoli Compliance Insight Manager couple their experience and expertise to deliver an integrated log

5 analysis and compliance management solution providing ongoing monitoring and reporting. The combination of software and services deliver an automated log analysis management solution that can significantly reduce the time, effort and cost required to capture, correlate, analyze and respond to potential security events. Our solution will help to identify and mitigate potential threats from internal users in accordance with internal and regulatory policies. With IBM Global Services experience, global reach and scale, IBM has both the skill and expertise to successfully deploy and manage a comprehensive log analysis management and compliance reporting solution on your behalf. IBM utilizes Tivoli Compliance Insight Manager software to deliver an end-toend integrated solution that supports your holistic data security strategy. With IBM, you reap the benefits of knowledgeable practitioners, proven methodologies and innovative software and services. As a result, IBM can help protect your market value with a lower degree of risk as compared to other service providers. Copyright IBM Corporation 2008 IBM Corporation New Orchard Road Armonk, NY U.S.A. Produced in the United States of America All Rights Reserved IBM, the IBM logo and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both are registered trademarks of Security Application Inc. Incorporated. Other company, product and service names may be trademarks or service marks of others. References in this publication to IBM products or services do not imply that IBM intends to make them available in all countries in which IBM operates. For more information To learn more about IBM Data Security Services for log analysis management, contact your IBM representative or visit: ibm.com/services SED03006-USEN-00