Cybersecurity & Compliance Priorities For Canadian – US Business Operations
-->
A complete SIEM* with built-in, essential security tools for complete threat detection, incident response, and compliance management. Correlate and analyze the following security event data from across your network: log management, event correlation, incident response, and reporting. In addition, Unified Security Management (USM) provides unified, coordinated security monitoring, simple security event management and reporting, continuous threat intelligence and multiple security functions.
Phase | 1 | 2 | 3 | 4 | 5 |
---|---|---|---|---|---|
Managed Security Information and Event Management | |||||
Security, Border network, and DMZ device logs |
|
||||
Threat intelligence |
|
|
|
|
|
Monthly reporting |
|
|
|
|
|
Server and service availability |
|
|
|
|
|
Network intrusion detection |
|
|
|
||
Database log collection |
|
|
|
||
Vulnerability testing |
|
|
|||
Host IDS |
|
|
|||
Wireless IDS |
|
|
|||
Host configuration testing |
|
| |||
File integrity monitoring Security incident response¹ Risk mitigation |
|
| |||
Compliance reporting |
|
|
¹ Requires incident response planning and documentation.
Log collection – security, border network, and DMZ devices: Aggregate logs and events from critical security and network border devices and correlate events into actionable information.
Threat intelligence: Aggregated real time threat signatures and intelligence collected worldwide to quickly identify indicators of compromise.
Monthly reporting: Monthly asset reporting and vulnerability reporting.
Server and service availability: Monitor critical servers and services for availability.
Network intrusion detection: Catch threats targeting your vulnerable systems with signature- based anomaly detection and protocol analysis technologies. Identify the latest attacks, malware infections, system compromise techniques, policy violations, and other exposures.
Database log collection: Event logs from servers and other critical assets.
Vulnerability Scanning: Regularly scheduled vulnerability scans of networked assets.
Host IDS and file integrity monitoring: Analyze system behavior and configuration status to track user access and activity. Detect potential security exposures such as system compromise, modification of critical configuration files (e.g. registry settings,/etc./password), common rootkits, and rogue processes.
Wireless IDS: Integrates with existing Wireless Intrusion Detection systems to monitor wireless network activity.
Security incident response: Incident response plan to mitigate security events.
Vulnerability assessment: New vulnerabilities emerge daily as your IT landscape changes, introduced by configuration errors, unauthorized software installs, unsecure endpoint devices, and much more. To keep your network secure, continual scanning of your systems and devices to detect vulnerabilities as they arise is necessary.
Compliance reporting: Simplify the challenging requirements of monitoring and reporting compliance for PCI-DSS, SOX, GLB, CJIS, HIPAA, NERC CIP, FISMA and ISO 27001.
* Compatible customer premise equipment required