賽門(mén)鐵克Compliance解決方案2Agenda合規(guī)性管理方案整體架構(gòu)1客戶關(guān)注的其他問(wèn)題3現(xiàn)場(chǎng)交流和問(wèn)答4具體功能模塊介紹23Malware

policyEndpoint

policyData

Protection

policyIncident

Response

policyCreateProveMapDistributeProceduralOperationalInfrastructureVulnerability,Patch,Configuration,Permissions3rdPartyApplicationFeedsArchiveBackupVirusSpamNon-programmaticattestationofcontrolsNISTPCICOBITJ-SOXISOGLBABaselIIAreTheyInPlace?WhatShouldMyPoliciesBe?AreWeComplyingWithThem?合規(guī)管理的整體視圖4P定義策略〔量化考核〕D實(shí)施控制C評(píng)估控制A改進(jìn)控制編寫(xiě)策略討論與批準(zhǔn)分發(fā)與認(rèn)知匹配到控制項(xiàng)差距分析評(píng)估控制收集證據(jù)端點(diǎn)平安效勞器平安網(wǎng)絡(luò)平安郵件和IM識(shí)別排序響應(yīng)改進(jìn)合規(guī)管理的方法論平安事故管理〔事件管理〕安全策略應(yīng)該是什么樣的?Policy安全策略被執(zhí)行了嗎?是否有效？Compliance5賽門(mén)鐵克合規(guī)解決方案的整體架構(gòu)數(shù)據(jù)庫(kù)合規(guī)策略管理全球主動(dòng)預(yù)警系統(tǒng)及知識(shí)管理系統(tǒng)—合規(guī)管理效勞器系統(tǒng)配置信息操作系統(tǒng)和數(shù)據(jù)庫(kù)的注冊(cè)表、配置文件和運(yùn)行程序等系統(tǒng)日志信息操作系統(tǒng)、數(shù)據(jù)庫(kù)、網(wǎng)絡(luò)設(shè)備、安全產(chǎn)品、應(yīng)用系統(tǒng)日志系統(tǒng)控制信息關(guān)鍵文件、程序、權(quán)限的篡改防護(hù)及審計(jì)信息內(nèi)容合規(guī)信息網(wǎng)絡(luò)、終端和存儲(chǔ)設(shè)備上的敏感信息的分布和使用日志收集層合規(guī)展現(xiàn)報(bào)表KPI視圖和工作流第三方系統(tǒng)ITILNOC分析層展現(xiàn)層6Agenda合規(guī)性管理方案整體架構(gòu)1客戶關(guān)注的其他問(wèn)題3現(xiàn)場(chǎng)交流和問(wèn)答4具體功能模塊介紹27SymantecEnterpriseSecurityManagerSymantecESM使企業(yè)能夠基于行業(yè)標(biāo)準(zhǔn)法律法規(guī)公司的策略去：定義測(cè)量/評(píng)價(jià)報(bào)告 信息系統(tǒng)在平安策略及平安最正確實(shí)踐方面的兼容性ESM可以答復(fù)：“企業(yè)的平安狀況是怎樣的〞自1993發(fā)布以來(lái)，在全球市場(chǎng)上廣受歡送。8ESM優(yōu)勢(shì)—基于業(yè)界標(biāo)準(zhǔn)的平安策略

ESM內(nèi)置標(biāo)準(zhǔn)ISO/IEC17799:2000(BS7799Part1)ISO/IEC17799:2005RevisedSANSTop20CISBenchmarkforSolarisCISBenchmarksforWindows2000Server&WorkstationNSAforMSExchangeServerESMPhase1,2,3abc規(guī)章Sarbanes-OxleyActSection404(COSO,COBIT)SOXforOS/400BaselIICapitalAccord(ISO17799:2000)BaselIICapitalAccord(ISO17799:2005)FISMA(NIST800-53Draft)VISACISPPCIDSSNERCStandard1200GLBA(Gramm-Leach-BlileyActof1999)HIPAA9基于標(biāo)準(zhǔn)的策略10詳盡的漏洞信息針對(duì)每個(gè)漏洞的技術(shù)細(xì)節(jié)描述幫助理解并解決問(wèn)題11對(duì)操作系統(tǒng)的審計(jì)12內(nèi)置網(wǎng)絡(luò)評(píng)估模塊發(fā)現(xiàn)并報(bào)告網(wǎng)絡(luò)設(shè)備或主機(jī)上的漏洞而無(wú)須安裝Agent(e.g.firewalls,routers,etc.)13應(yīng)用系統(tǒng)平安審計(jì)功能包含數(shù)百項(xiàng)針對(duì)特定應(yīng)用的檢查支持?jǐn)?shù)據(jù)庫(kù)Oracle7.4.3-9.2onUNIXMSSQLServeronWindowsDB2UDBforanyplatform(networkbased)支持WebServersMicrosoftIISApacheNetscape/iPlanet支持防火墻CheckPoint14平安策略

StandardsISO17799HIPAAGLBA…ControlsPasswordsPermissionsServicesFiles…基于策略基準(zhǔn)對(duì)系統(tǒng)設(shè)定和配置進(jìn)行詳盡的檢查-Windows-UNIX-Linux-Netware-VMS-AS/400-Database-Web詳盡的一致性報(bào)告(TechnicalControlsandStandards)Servers應(yīng)用平臺(tái)評(píng)估策略的實(shí)現(xiàn)15易于使用的評(píng)估流程View

ResultsSchedulethePolicyRunCustomizeModulesAdd

ModulesCreateaPolicy16ESM—廣泛的操作系統(tǒng)平臺(tái)支持Tier-1Tier-2Tier-3ESMSystemsAuditedWindowsWindowsServer2003WindowsServer200364-BitWindowsServer2008WindowsVistaWindowsWindowsNT4.0ServerandWorkstationwithSP6aWindows2000Professional,Server,AdvancedServerVMSOpenVMS7.1,7.2,7.3(alpha–ESM5.1only)VMwareESX3.03.5UNIXSolaris2.8,2.92.10HP-UX11i(11.11),11.23,11.31AIX5.1,5.2，5.3,6.1UNIXSolaris2.7HP-UX10.20,11.0AIX4.3.3UNIXSolaris2.51,2.6AIX4.3.1HPTru64/OSF-14.0D-5.1ASGIIRIX6.2,6.3,6.4SequentDYNIX/ptx4.4.2AT&T/NCRUNIX3.2(ESM5.1only)LinuxRedHatEnterpriseLinuxES2.1,3.0(x86),ES4,AS4,WS4.SUSELinuxStandard&EnterpriseServer8,9,10.0(x86)LinuxRedHatLinux8,9IBMiSeriesOS/400OS/400V5R1,V5R2,V5R3LinuxRedHatLinux6.2,7.0,7.1,7.2,7.3AT&T/NCR3.2NetWareNetWare5.1,6.0,6.5NetWareNetWare4.2,5.0(ESM5.xonly)17WhySymantecCriticalSystemProtection?維持系統(tǒng)的策略依從加固系統(tǒng)入侵檢測(cè)入侵防護(hù)減少管理復(fù)雜程度提升產(chǎn)品的管理能力防止零日攻擊加固日志系統(tǒng),日志轉(zhuǎn)發(fā),和日志監(jiān)控對(duì)無(wú)法立即安裝補(bǔ)丁程序或鎖定的系統(tǒng)提供防護(hù)企業(yè)級(jí)的報(bào)表功能通過(guò)簡(jiǎn)單，集中的策略創(chuàng)立管理系統(tǒng)降低企業(yè)用于資產(chǎn)保護(hù)的本錢(qián)目的提供懷有惡意的內(nèi)部用戶攻擊系統(tǒng)未知攻擊針對(duì):內(nèi)存文件系統(tǒng)注冊(cè)表操作系統(tǒng)應(yīng)用終端用戶違背企業(yè)平安策略預(yù)防18保護(hù)企業(yè)中的關(guān)鍵業(yè)務(wù)主機(jī)數(shù)據(jù)中心數(shù)據(jù)庫(kù)效勞器互聯(lián)網(wǎng)應(yīng)用效勞器Web效勞器郵件效勞器后臺(tái)辦公系統(tǒng)定制的應(yīng)用系統(tǒng)公司內(nèi)部文件效勞器打印效勞器遠(yuǎn)程訪問(wèn)網(wǎng)關(guān)分布式系統(tǒng)高風(fēng)險(xiǎn)的客戶端移動(dòng)用戶高管的臺(tái)式機(jī)保存機(jī)密的系統(tǒng)訪問(wèn)關(guān)鍵任務(wù)的系統(tǒng)缺少物理平安訪問(wèn)的系統(tǒng)信息終端(觸摸屏)19SCSP的功能小結(jié)防止零日攻擊加固系統(tǒng)維持策略依從減少管理復(fù)雜程度減少系統(tǒng)宕機(jī)時(shí)間降低去除攻擊確保業(yè)務(wù)的持續(xù)性不依賴于基于特征的策略附軟件提供多種保護(hù)策略控制特權(quán)用戶默認(rèn)策略即可有效保護(hù)系統(tǒng)和各種應(yīng)用可信的平安系統(tǒng)系統(tǒng)平安策略的強(qiáng)制貫徹SCSP效勞器版和客戶端版本的采用相同的平安策略跨平臺(tái)統(tǒng)一管理降低管理員負(fù)擔(dān)20賽門(mén)鐵克日志審計(jì)和管理平臺(tái)的框架結(jié)構(gòu)Windows主機(jī)日志信息收集應(yīng)用系統(tǒng)日志平安產(chǎn)品日志網(wǎng)絡(luò)設(shè)備日志Unix主機(jī)日志數(shù)據(jù)合并正那么化/標(biāo)準(zhǔn)化處理實(shí)時(shí)風(fēng)險(xiǎn)分析及呈現(xiàn)關(guān)聯(lián)分析數(shù)據(jù)庫(kù)/知識(shí)庫(kù)/配置庫(kù)協(xié)調(diào)分析綜合處理信息處理及響應(yīng)平臺(tái)工單派發(fā)資產(chǎn)定義平安策略遵從性檢查緊急響應(yīng)應(yīng)急響應(yīng)流程數(shù)據(jù)庫(kù)系統(tǒng)日志W(wǎng)eb圖形化呈現(xiàn)專家效勞/短信SNMP信息共享21AgentCollectorFileSensorDatabaseSensorSyslogSensor

CustomSensorCollectorFileSensorDatabaseSensorSyslogSensor

CustomSensorSymantecSecurityInformationManager(CorrelationorCollectionAppliance)SyslogSensorExamples:Unix/LinuxServers,Switches/Hubs,FirewallsandIDScapableofsyslog.收集器架構(gòu):Syslog和Database例如(SSL)DatabaseSensorExamples:HIDS,AV,VulnerabilityScannersareexamplesofsomeofthetypesofproductswherelogsaretypicallystoredinrelationaldatabases.(JDBC)(syslog–tcp/udp)22AgentCollectorFileSensorDatabaseSensorSyslogSensor

CustomSensorCollectorFileSensorDatabaseSensorSyslogSensor

CustomSensorSymantecSecurityInformationManager(CorrelationorCollectionAppliance)CustomSensorExamples:WindowsEventLogSensorandCheckpointLEAsensors收集器架構(gòu):自定義和文件型例如(SSL)FileSensorExamples:CustomApplications,HIDS,AV,VulnerabilityScannersareexamplesofsomeofthetypesofproductswherelogsaresometimesstoredinflatfiles.(C:\path\to\log.txt)SymantecslkdjflaskdjflsakdjfalskdjfalskdjflsakdjflaskdjfalskdfjalskdfjlsakdjflaskdjflsakdjfasdfaAppliance)(WindowsRPC)(OPSECLEA)23日志處理流程

采集全球威脅關(guān)聯(lián)優(yōu)先級(jí)劃分關(guān)聯(lián)分析歸并過(guò)濾

標(biāo)準(zhǔn)化事件

事故的鑒別流程輸出：按優(yōu)先級(jí)排列的事故關(guān)聯(lián)分析結(jié)論構(gòu)成事件業(yè)務(wù)沖擊響應(yīng)的優(yōu)先次序24ISO27001報(bào)表展現(xiàn)25KPI視圖展現(xiàn)26強(qiáng)大的報(bào)表呈現(xiàn)能力3727報(bào)表范例:操作系統(tǒng)違規(guī)統(tǒng)計(jì)UNIXSystemsWindows2003SystemsWindows2000Systems28報(bào)表范例:策略符合性級(jí)別AllSystemsUNIXSystemsAllSystemsUNIXSystemsAllSystemsUNIXSystemsAllSystemsUNIXSystemsModuleDomainManagerAuditDateCompliance%DomainCompliance%AccountIntegrityAllSystemsrack13-10May5,200478%78%AllSystems78%UNIXSystemsrack13-10May5,200478%78%UNIXSystems78%NetworkIntegrityAllSystemsrack13-10May5,2004100%100%AllSystems100%UNIXSystemsrack13-10May5,2004100%100%UNIXSystems100%PasswordStrengthAllSystemsrack13-10May5,200475%75%AllSystems75%UNIXSystemsrack13-10May5,200475%75%UNIXSystems75%29報(bào)表范例:策略符合趨勢(shì)30Agenda合規(guī)性管理方案整體架構(gòu)1客戶關(guān)注的其他問(wèn)題3現(xiàn)場(chǎng)交流和問(wèn)答4具體功能模塊介紹231內(nèi)置的第三方軟件組件OperatingSystem:WhiteBoxLinux3.0(RH-baseddistribution)IBMDB28.2FP10(Housesallsecurityeventsandincidentdata)IBMDirectoryServer5.2FP0002(LDAPforusers,roles,config,etc)IBMHTTPServer2.0ApacheTomcat5.0Servletengine32開(kāi)放的API接口SSIM4.5iscompletelyopenWehavebuiltwebservicesaroundmostfeaturesTicketsIncidentsAssetsArchiveAuto-Ticketingwascreatedasasample33日志管理和審計(jì)一體化解決方案34IntrusionDetection/PreventionSymantecNetworkSecurity(SNS)SymantecHIDSSymantecITASnortSymantecSygateSymantecCriticalSystemProtectionCiscoIDSCiscoSecurityAgentsTippingPointNIPSEnterasysNetworkDragoneEyeRetinaJuniperIDPISSSiteprotectorMcAfeeIntrushieldSourceFireEnterpriseAVSolutionsSymantecAntiVirusSymantecClientSecuritySymantecMailSecurityforExchangeSymantecMailSecurityforLotusDominoSymantecMailSecurityforSMTP

McAfeeEPO

McAfeeGroupShieldMcAfeeVirusScanTrendMicroControlManager(TMCM)TrendMicroOfficeScanTrendServerProtectInformationServerTrendInterscanMessagingSecuritySuiteTrendScanmailforExchangeTrendScanmailforNotesTrendInterscanViruswallTrendInterscanWebSecuritySuiteIdentiftyManagementMicrosoftWindowsDHCPMicrosoftOperationsManagerMicrosoftActiveDirectory

RSASecurIDCiscoACSRouters,SwitchesandVPNCiscoIOSJuniperVPNCyberGuardCiscoVPN3000ConcentratorVulnerability/PolicyScannersSymantecESMSymantecBindviewNessusnCircleQualysQualysGuardStillSecureVAMOperatingsystemsMicrosoftWindowsEventLogSolarisOSCollectorSunBSMSUSELinuxDebianLinuxRedHatLinuxIBMAIXHP/UXTandemSELinuxIPTablesFirewallsSymantecGatewaySecurityCiscoPIXCiscoFWSMNokiaFWJuniperNetScreenFirewallCheckpointFirewall-1NortelContivityFortinetFortigateSunScreenMicrosoftWindowsFirewallMicrosoftISAOtherCiscoNetflowFoxServerControlBlueLanceLTAuditorPassGoUPMKiwiSyslogGenericSyslogSymantecCyberwolfSymantecWholesecurityDatabasesOracleSecurityLogs(9i&10g)MSSQLServerLogsWebservers,FiltersandProxiesApacheWebServerIBMWebsphereBluecoatProxyMicrosoftISAMicrosoftIISSunOneWebServer超過(guò)100種事件收集器35集中保存日志信息集中保存原始日志數(shù)據(jù)…用于事后取證到達(dá)合規(guī)要求支持長(zhǎng)期日志保存需求歸檔文件同時(shí)被壓縮保存靈活的存貯選擇(內(nèi)置存貯或SAN/NAS/DAS)不