Symantec last week unveiled a set of security applications it says will help network executives control and correlate corporate security efforts.
NEW YORK – Symantec last week unveiled a set of security applications it says will help network executives control and correlate corporate security efforts.
The Symantec Security Management System will let the company’s event management and incident management tools talk to each other, and ultimately integrate with non-Symantec tools. The management system is built on Symantec’s Enterprise Security Architecture (SESA), the common foundation that all Symantec products will be based on. This platform will let security tools run on Microsoft, Linux, AIX, Unix and other platforms.
Security information management (SIM) products such as SESA use data aggregation and event correlation features similar to those of network-management software and applies them to event logs generated from security devices such as firewalls, proxy servers, intrusion-detection systems and antivirus software.
For SESA to succeed, Symantec will benefit from getting as many security vendors as possible on board with the idea of supporting its planned Symantec Security Management System (SSMS) by having them write software for sharing data with it. To that end, Symantec has launched a “partner program” to get vendors to build so-called “collectors” that would collect event data from their equipment to share with the Symantec package. More than a dozen vendors last week at Symantec’s SIM debut in New York said they would support Symantec’s basic SIM architecture.
The first version of SSMS that Symantec plans to ship by the end of this month is expected to only work with Symantec’s intrusion-detection and antivirus products. Support for Symantec’s Raptor firewall won’t be added until year-end, says John Heath, Symantec’s senior product manager.
Some heavyweights in the security industry with SIM ambitions of their own were noticeably absent from Symantec’s New York SIM coming-out party, namely Check Point Software Technologies and Internet Security Systems, these days in close partnership with Network Associates, Symantec’s chief rival in antivirus software.
But Symantec says it is writing “collector” software for the Check Point firewall, the ISS RealSecure sensors and the NAI’s ePolicy Orchestrator console for virus-software management.
|
Ryan McGee, NAI’s director of product marketing, said a year ago when NAI added a way for its ePolicy Orchestrator to collect information about Symantec Norton AntiVirus and take action on it, Symantec objected. “But turnabout is fair play, and what they’re doing validates our approach,” McGee says. “But we don’t plan any close Network Associates-Symantec alliance.”
Phoenix electronics distributor AVnet, which is beta testing the SSMS, says the product does a good job collecting events from Symantec’s IntruderAlert IDS and the ISS RealSecure IDS that AVnet uses.
“At this point, the payback is that we get one centralized console for them. But for any sort of advanced correlation of events, it will take a lot more integration,” says Steve Jeffers, Avnet’s manager of enterprise security services.
