Search our
entire site
Enter your search
terms below, or visit
our search page

Search case
studies only
Enter your search
terms below:

For the table
of contents and
hyperlinks to
general topics
proceed to toc

Safer Enterprises -- Internet Security Systems Tools Help Users Mine Security Information

Internet Security Systems Inc. pushes intrusion detection to the next level with new tools aimed at helping users mine the security information they collect so they can build safer enterprises.

SafeSuite Decisions, a decision-support application, is the first product in ISS's SafeSuite Enterprise line of security applications. It analyzes data on network attacks found by ISS's intrusion-detection software and other vendors' firewalls, and then reports on trends that can show where the network is at risk of an intrusion.

For example, SafeSuite Decisions can provide reports showing that a specific server on the network has been attacked frequently in the last month and is quite vulnerable-making it a much higher network security risk. SafeSuite Decisions can also correlate intrusion-detection information that shows a pattern of network attacks that point to an ill-configured router.

Decision Maker

SafeSuite Decisions helps users synthesize large amounts of data so that "IT managers can spend their valuable time making decisions, not just reviewing all this data," says Mike Lortz, product manager at ISS.

SafeSuite Decisions culls data from ISS's RealSecure intrusion-detection and response system; from the company's Internet Scanner and its System Scanner, both of which are vulnerability-detection systems; and from Check Point's Firewall-1 and Network Associates' TIS Gauntlett firewall. All of these tools generate a lot of data on the status of network security, but they do little to correlate that data.

"A product like SafeSuite will help you not only find security vulnerabilities, but will also actively manage them on an ongoing basis," says Wendy Nather, director of IT security at Warburg Dillon Read, a London investment banking division of UBS AG. "The bigger your organization, the less able you are to do anything instantaneously. Still, you need to keep checking security as new information comes out and as you take on new business opportunities. You always want to reevaluate what you're doing."

Efficient Evaluation

The decision-support application evaluates security tools and practices much more efficiently, Nather says. It provides a scalable relational database that acts as a central data store for all security data. And it has correlation and mining capabilities that can produce daily, weekly, or monthly reports.

The software includes a set of predefined reports, such as summaries of security vulnerabilities over a set period of time, rankings of problems so administrators know which problems to tackle first, and reports on the top 10 network attacks within a specified range of dates. SafeSuite also has tools that let users run and distribute the reports whenever and wherever they want to.

SafeSuite Decisions 1.0 supports Microsoft SQL Server 6.5; ISS also plans to support Oracle and Sybase relational databases. It will be available in the fourth quarter, starting at $25,000.

In other moves, ISS this week will disclose a partnership with Entrust, a leading maker of digital certificate software. Entrust will bundle its Entrust Public Key Infrastructure software with ISS's System Scanner, which is designed to help customers uncover vulnerabilities in their systems.

TABLE OF CONTENTS