Perimeter
10/12/2011
04:48 PM
Rob Enderle
Rob Enderle
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

McAfee + NitroSecurity: SIEM Merger Done Right

McAfee showcases the perfect security company merger by bringing out a SIEM offering that better anticipates an increasingly hostile world

One of the big problems with security solutions in business is that they are largely ad-hoc. This means different layers are often added without much consideration for interoperability, and the end result is exploits that otherwise might have been caught are missed because they pass between the reporting gaps of the various systems. Security information and event management (SIEM) products are designed to close these gaps by connecting all of the products and showcasing trends so that an attack -- regardless of the attack vector -- can be more rapidly identified and mitigated.

The advantage of having a vendor-independent SIEM solution is that it gives you a better choice of the parts. The disadvantage is that the independent vendor generally has trouble maintaining high integration with new features because they aren’t in the development loop for the products they are integrating with, and are always playing catch-up. In a slow-moving market, this is an acceptable trade-off; unfortunately, the security market is no longer slow-moving, which likely goes to the core of why McAfee bought Nitro Security.

According to IDC, the SIEM market alone is currently more than $1 billion total and growing at an aggressive 22 percent. This is likely because of the proliferation of point-security solutions that now need to be better integrated in order to be made effective. This is coupled with the massive increase in visible threats, which many of us believe are underreported, but have crossed industry and government sites and penetrated organizations that were thought secure enough. SIEM products have a strong value proposition: They create visibility across the IT infrastructure, limit risk, and provide analytics that can identify threats and help fund mitigation efforts. In short, they provide the missing situational awareness needed to address what has become a complex threat landscape, and help make better decisions with regard to how to best protect the business.

I think the key to why McAfee bought NitroSecurity is the need for speed. It already tied back into some of its other offerings, but these offerings were being changed at an increasing rate, and for the links back into NitroSecurity to function optimally, McAfee would need an integrated suite. The only way to get this result effectively while maintaining product development security was to buy NitroSecurity and use it to link its ePO, McAfee Risk Advisor, and GTI offerings.

This now will increasingly look like an end-to-end suite so that buyers aren’t left with timing integration gaps between McAfee's and NitroSecurity's products.

This was also one of the easiest types of integration mergers to do, one where the product was already partially integrated with the planned suite of offerings and where the integration issues are likely already known.

Most software acquisitions occur between products that were never intended to work together, and then fail because folks eventually find out it is generally better to start from scratch than to try to integrate products that were never designed to be integrated.

In this case, NitroSecurity’s SIEM offering was designed to be integrated with McAfee's products, making the integration comparatively easy and speeding time to market. The end result is a solution that is and will remain more agile and better able to respond to a world of increasing and ever more aggressive threats.

Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web