OPSEC Partners

Alert Scoring Methodology

• Intellitactics applies a nine-factor risk score, computed automatically and used to rank alerts to focus precious analyst minutes on alerts with the greatest impact.
• Ranking alerts by the risk posed to the business, or alerts with the greatest impact on an organization’s ability to comply with any of the regulatory standards improves effectiveness and results. Prompt attention to high-impact alerts reduces disruption, limits risk and reduces the costs of recovery from unchecked attacks.

Product Architecture

• Intellitactics offers unparalleled scaling based on its flexible, hierarchical architecture. All of the Intellitactics services and product components can be deployed on one server or multiple servers to accommodate any enterprise configuration, with no change in the functionality available to the users.
• Includes Security Data Warehouse (SDW), a secure multi-dimensional data store that includes compressed stores for raw events (logs) and parsed events; and an optimized MySQL relational database that stores monitored and analyzed security event data. This robust architecture is completely transparent to the user.
• Intellitactics enables multiple archiving techniques for longer term, low-cost storage. The information in the SDW represents a rich source of event, alert, and incident information, with a back-end store that meets the needs of local, regional and enterprise-wide storage requirements.

Control Monitoring and Reporting

• Ability to monitor and report on control performance
• Analyzes security events against the controls selected to limit risk and maintain compliance; maps security events to controls from leading frameworks such as CoBit, ISO 17799, and NIST 800-53 (developed for the US federal government but increasingly selected by commercial companies because of its explicit detail)
• Ships with a complete catalogue of meta-controls that automatically produce control alerts and over 200 pre-defined control reports

Intelligent Data Modules

• Provide the intelligence that translates cryptic event messages from vendors into human-readable, usable information that can be used for analysis, alerting, correlation and reporting.
• Robust library of more than one hundred data modules is maintained by Intellitactics’ Security Information Services (SIS) team, and this library is continuously expanded as new products, applications and versions of products are released by the vendors.
• Built to satisfy the requirements for performing escalations of events to alerts, correlations and reports.

Security Metrics

• Intellitactics delivers practical security assurance metrics on a configurable dashboard. These metrics, key performance indicators for security, help other managers understand how they can support the security strategy and what security provides to the organization. Metrics will:
  • Persuade people to change behavior and compel others to embrace new processes
  • Demonstrate organizational effectiveness and justify current and future security investments
  • Assess the effectiveness of controls and illustrate the state of compliance

Intellitactics Security Manager securely acquires events from Check Point firewall and VPN systems through the use of the LEA (Log Export API) protocol. All Check Point events are collected in real time, normalized, and taxonomized for use in Security Manager for analysis, alerting, and reporting so that security teams can identify threats and attacks, as well as audit approved activities, within their environment.

Security events from the Check Point sources are analyzed by packaged and pre-configured correlations in Intellitactics Security Manager which automatically escalate important events to alerts.

These alerts are then scored and ranked by combining details such as asset criticality and vulnerability status with the information provided by Check Point for prioritized display to analysts and operators for quick response. Security teams can also configure their own correlation definitions in Security Manager to meet in-house requirements specific to each site.

More than 20 web-accessible reports are also packaged with Intellitactics Security Manager that highlight Check Point events and alerts, including top sources, targets, and types of firewall and VPN activity (including a focus on critical assets). In addition, Security Manager provides a report wizard, which can be used by security teams to copy or create new reports to meet environment-specific needs for analysis and auditing. All of these reports can be run on demand, scheduled, and published to an access-controlled, web-accessible repository.

Intellitactics products feature a low total cost of ownership:

• Primarily agent-less data collection places no additional burden on the system or network
• Security Data Warehouse includes an embedded and optimized relational data base that is self managing and requires no DBA. In addition, cost-effective storage of compressed raw events and high performance database for reporting and alerting is easy on the storage budget.
• Product architecture grows as requirements in a security environment grow, such as when more data sources are added or as risk policies evolve.
• ISM also features ‘security know- how’ in packaged reports, metrics and correlations that decreases time to value.
• ISM architecture adapts to hierarchical implementations on a campus, across the country or around the world.