Good day. In all of our Company regions we use ISS products. All regional ISS is managed and supported by regional teems of security admins (see Figure #1). The problems of such organization are the following: - such architecture is very difficult to control from centre; we (HQ) know about situation with ISS in regions only by means of their reports, but we can't validate is it really so cool as it is specified in reports; - we have 17 regions and it's too expensive to have ISS admins (there should be at least two admins) in each region (on each site); - it's very difficult to find employee with needed skills in region, even if we organize courses for each regional admin it will not solve the problem, because to be security administrator there should be special technical background, and it's very almost impossible to find personnel with such background especially in region.
The solution here is to create one (or two - for redundancy) center of competence (CC) that will manage sensors in all regions and analyze events of all sources. Desired solution here is showed on Figure #2. Here all events are collected and stored onsite and from center of competence we just see reports in console. I think traffic Sensors - [Collector] - DB (let it be 'event stream') is big and traffic DB - [AS] - Console (let it be 'presentation stream') is not big. Also traffic Console - [AS] - Sensor is small (let it be 'management stream'). We can't allow event stream to go via thin WAN channels - that is why architecture with central DB is not possible (Figure #5). Moreover, architecture with central DB will mean that central DB will have a huge size (about 10 Tb) and it will be difficult to operate with it. Figure #3 shows possible variant, but the thing is that CC should have ability to see the whole picture from all sites, not only events corresponded to one site. I'm not sure that Console is smart enough and will allow you to be connected to number of ASs, and show events from all that ASs as one report... The last variant I want to mention is with special correlation mechanisms (CM) on each site (100% third party, because ISS unfortunately does not have such mechanisms). These CMs analyze (and somehow correlate) onsite sensor's events (let it be 'raw events') and construct new events (let it be meta-events). The number of meta-events is not very big, so it's possible to store them in central DB. But this variant has a number of difficulties: - picture in Console depends on configuration of _every_ CM; - loading of WAN channel depends on configuration of _every_ CM; - it may be need for each CM to be configured separately, because regions may have it's own specific. So, he question is whether it's possible to configure variant on figure #2 with SiteProtector only or not? Are there any resent enhancements that allow realizing scheme on figure #2? When? If no, what other third-party products (SIMS) do you recommend to use to build distributed architecture as in figure #2. Thank you. Hope you'll help me somehow. Good luck! --- Best regards, Sergey V. Soldatov. Information security department.
_______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
