Thursday, November 8, 2012

How to detects the most complex threats on financial service infrastructures


Leveraging its total visibility across systems, security devices, and the network, QRadar applies industry-leading event correlation, including behavior analysis, and intelligent application of context—network architecture, system profiles, identity information, and 3rd party security intelligence sources— to event data.
QRadar also surveys the organization’s entire network, using native flow sources in a customer’s routing/switching infrastructure or from distributed collectors to gather a detailed history of all network flow activity.

This unique integration of event information and flow activity delivers complete threat context before attacks occur, and comprehensive forensics afterward, to simply, accurately, and thoroughly respond to incidents and assess impact.
Log Management
In addition to in-depth understanding of network security, device configurations, and application behavior, QRadar provides an audit trail for demonstrating compliance, as well as access to historical log data. Log management is an important foundation for SOX compliance, you need to collect, store, and report on your event logs and prove that you have adequate controls in place.
QRadar provides integrated storage, and features to help guarantee the integrity of collected information. In addition to the critical log management capabilities of log collection, storage, and search, QRadar provides advanced leverage of all of the information collected through integrated, real-time event correlation, threat detection, and compliance reporting and auditing.
Threat and Fraud Management
Today’s criminals are not operating out of seedy boiler rooms. They are sophisticated and smart, continuously evolving their methods to keep pace with corporate technology advances and, with a low probability of being caught or prosecuted, the risk-reward scenario for cybercriminals is extremely attractive.
Regardless of the specific type of fraud committed, it is important to understand that fraud can be accomplished through a number of methods including phishing, skimming, hacking into databases and so on. These data breaches are not only serious security and regulatory risks, but the negative publicity that results from compromised data can be devastating for a financial services company. You need to protect the ultimate asset – your customers' trust.
QRadar can detect unauthorized access to systems and data to keep sensitive client information from being hacked, or otherwise compromised from both internal and external sources. To detect more complex cyber threats, QRadar leverages all available network activity data, including information segmented across different network and security solutions and operations teams, to uncover and track suspicious behavior.
QRadar’s broad visibility delivers the requisite surveillance on the network to detect today’s more sinister IT-based threats and deliver a manageable set of prioritized security threats along with the information necessary to remediate the situation. To quickly identify internal misuse, QRadar can integrate with a customer’s Identity and Access Management (IAM) solution, and analyze these data sources to develop a comprehensive picture of an asset’s user identity and behavior as well as vulnerability state, which is not available through IAM solutions alone.
Many financial services institutions have fraud detection capabilities in place for certain applications or sectors of their business. The overarching value of QRadar is it’s ability to tie intelligence from these solutions to the broader set of data collected from the entire enterprise infrastructure. Presenting a more complete picture for security professionals and reducing operational complexity.

No comments:

Post a Comment