Untitled Document
Not so long ago, a worm or virus on the enterprise network meant a late night
for an IT administrator digging into firewall or intrusion-detection logs to
isolate a problem and control the damage -- an annoying and marginally effective
approach for yesterday's simpler threats. Unfortunately, many of today's most
dangerous threats escape detection by individual security solutions, even with
diligent oversight by administrators because:
- Complex multidimensional attacks may be sub-threshold events for any single
security solution
- The speed and scale of attacks can quickly overwhelm personnel -- and new
attacks appear faster than administrators can research them
- Attacks occur where and when administrators are unavailable -- at remote
offices, or during regional disasters
- Disgruntled or financially-motivated administrators are themselves behind
some of the most dangerous and costly attacks
A cooperative approach with automated correlation across multiple security
solutions is the key to coping with enterprise threats like these. Years of
responsible investment have equipped most enterprise networks with powerful
individual security technologies. Problem is that they are largely point product
in nature and attempt to secure issues in a vacuum. Today's solutions take identification,
mitigation and reporting a step further by coordinating security across multiple
devices from deep within network infrastructure and adapting to meet the changing
security threats. These new adaptive solutions save money and time, help maintain
compliance with health, securities, banking, privacy, and other regulations,
and reduce documentation and reporting burdens.
What's the state of open source? Find out right here.
Adaptive threat management
Adaptive threat management (AdTM) solutions establish a dynamic cooperative
system that provides network-wide visibility and control to adapt to changing
threats and risks. The solutions are "adaptive" because they change
the network's security posture in response to threat conditions, for example
by quarantining or isolating a suspect computer, user, or network leg, collecting
additional information during an intrusion attempt, or throttling bandwidth
allocated to specifically identified applications during a network attack.
-1-