Security Threat Management

Attack sophistication is at an all time high. Web application vulnerabilities, uncontrolled mobility and simple mis-configurations create ever-present threats. Online attacks motivated by organized crime and malicious activity by privileged users defy corporate and consumer defenses.

Intellitactics simplifies and automates security threat management with threat detection and threat evaluation. Intellitactics overcomes today’s management challenges:

  • Analysts can’t respond to every threat in the same way
  • Threat and attack types are constantly changing and require automated analysis to keep ahead of bad actors
  • Prevention doesn’t always work leaving only effective response
  • Response time windows are getting smaller

Automated threat detection and threat evaluation play a critical role in improving the effectives of enterprise security. Intellitactics Security Manager (ISM) features consolidation of disparate events to enable analysis and escalation of high risk events resulting in actionable alerts. Early detection and risk based notification used with actionable alerts, prioritized by risk, enable proactive threat management. In the event of a security incident, security operations has instant access to risk relevant information to accelerate response.

Not every organization is ready to implement an enterprise security threat management product. Implementing the event management appliance, SAFE LP, serves as a logical first step – whether you are managing 3 million or 300 million events everyday.

Security Threat Management: Actionable Alerts

Actionable alerts, the important extrapolation of alerts from events, and the prioritization of these alerts using a risk scoring model is the foundation of an effective threat management process. Effective and efficient threat management depends on automation. Intellitactics offers the industry’s only actionable alerts. Other products alert on certain types of events – or alert when the event count for a type of event exceeds a specified number over time.

The security operations function facilitates regular collection and storage of logs. Parsed logs, or events, help security operations to uncover hidden information in the logs. In a similar way, actionable alerts eliminate false positives represented by too many security events. Security events, when considered alone may be discarded as insignificant. Correlating disparate events and enriching alerts to provide additional contest result in actionable alerts. Enrichment includes providing the context of asset classification, results of vulnerability scans, user ids and other enterprise data. This rich collection of information improves evaluation and the effective quality and speed of action taken.

Security Threat Management: Effective Security Operations

Defensive measures include enterprise awareness and embedded security; however, the heart of enterprise threat management is the security operations function. Security operations depend on automated threat detection and evaluation and rapid incident response. IT organizations define internal policies, implement corresponding controls and then monitor and audit security and network devices, operating systems, databases, applications and users. Efficient monitoring, analysis and reporting improve effectiveness of network security and insider surveillance.

While the security operations function is essential, sharing accountability throughout the IT staff is not uncommon. Staffing ranges from the traditional 24/7 SOC to other organizational models. Some of these are:

  • Monitoring done by individual technology owners like in the example of a security accountable manager of Proxy servers. This individual is responsible for investigation and threat evaluation and subsequent actions.
  • The virtual SOC, comprised of security analysts, receive via email, pager or service management system (ticketing system) automated notifications or alerts on risk relevant events and become investors and responders.
  • Existing NOC, where operators monitor security events along with network and systems events, using the enterprise operations console. In the case of security, the operators are tasked with assigning pre-incident alerts to the appropriate administrator or analyst.

Intellitactics provides products for every organization – from the automated virtual SOC to the manual dispatch performed by the in-place NOC.

Learn more about our Security Threat Management solutions