Get to know us better! Gain valuable insights into how we think by visiting our blog, or take a look at the industry events we're frequenting on our events page. You can also geek out with us by attending one of our security management webinars, or dive head first into the products and solutions we provide in our Resource Library. There's lots to keep you busy!
In Part 1, we built the case that SIEMs are ineffective for threat hunting, based on the following reasons:
To date, SIEM vendors have not provided the market with the functions needed for producing world-class threat hunting. Again, threat hunting is a method. In order to follow this method, we have to have tools that accelerate and amplify our human work, rather than using technologies that brush aside our method in favor of operating within their paradigm. Too many threat hunting programs are sputtering because we continue to believe that the method should conform to the technology, but that gets things backwards.
Threat hunting remains an undeveloped competency for far too many organizations. When surveyed, security professionals confess an overall lack of competency to detect and respond to advanced attacks that slip through their defenses. In my experience, many organizations still rely on alerts from a SIEM (among other prevention systems). Most security teams will painstakingly build models for indicators of compromise, receive alerts from their SIEM, and “do the best they can” to eliminate the intrusion. What are the results?
How do you know if your security posture is where it needs to be? Most organizations look at standards, be it national standards, industry standards or their own corporate standards. They may also look at their industry’s best practices. But if you aren’t looking at your risk vulnerability, you are likely not looking at the entire spectrum of your network’s security posture.
El nuevo paradigma de la automatización es la “Administración del Ciclo de Vida”
Te mostraremos cómo FireMon Intelligent Policy Automation utiliza la tecnología de automatización e inteligencia para reducir el esfuerzo e incrementar la eficacia en cada etapa del proceso de cambios.
Enhancements to FireMon’s industry-leading Intelligent Policy Automation framework reduce time and mistakes associated with firewall policy changes OVERLAND PARK, KS and DALLAS, TX – January 31, 2017 – FireMon, the global leader in Network Security Policy Management (NSPM), today announced an extension of its Intelligent Policy Automation framework to now include automated policy implementation for Palo Alto Networks® devices. FireMon introduced its Intelligent Policy Automation framework last year. The framework is designed to reduce the manual effort and unnecessary security risk associated with complex network implementations by ensuring processes are in place to make the correct change as quickly as possible. By focusing on the correctness of the change, the IPA framework has reduced the time it takes customers to complete a change by more than 90% while also maintaining their security posture, and often lowering the overall level of risk. Unlike other automation solutions in the space, the integration of FireMon’s Immediate Insight security analytics solution enables customers to actively monitor for new threats and modify policies accordingly using the IPA framework. In this update, now available to FireMon customers, Palo Alto Networks users can automatically push firewall rule changes to the Panorama™ centralized security management system. Previously, users made these changes manually. This new extension results in further time savings and accuracy when implementing new policy access. Customers with Panorama will gain the ability to centrally manage their multi-device environments within FireMon Security Manager to:
"FireMon is proud to continue to develop its products to work with the widest range of security products in order to reduce complexity and manual tasks undertaken by enterprise IT security teams," said Jeremy Martin Vice President of Product Development, FireMon. "This latest product extension means that Palo Alto customers will benefit from increased efficiency; and by using App-ID and User-ID in policy management, it is possible to see the device impact and do a proper risk validation assessment of rule changes – a crucial component to effective management of enterprise security."
FireMon solutions deliver continuous visibility into and control over network security infrastructure, policies, and risk. Using Intelligent Security Management from FireMon, today’s enterprise organizations, government agencies, and managed services providers dramatically improve effectiveness of network defenses, optimizing investments and speeding response to changing business demands. For more information, visit http://www.firemon.com.
Helping Enterprise Security Teams Improve Resource Efficiency & Reduce Overall Risk Exposure
Firewall technology has come a long way since its initial, most rudimentary forms. Next-Generation Firewalls (NGFW) are the latest development, and organizations are accelerating adoption to the new technology. But NGFWs aren’t a fix-all solution.