Perimeter
10/12/2011
04:48 PM
Rob Enderle
Rob Enderle
Commentary
50%
50%

McAfee + NitroSecurity: SIEM Merger Done Right

McAfee showcases the perfect security company merger by bringing out a SIEM offering that better anticipates an increasingly hostile world

One of the big problems with security solutions in business is that they are largely ad-hoc. This means different layers are often added without much consideration for interoperability, and the end result is exploits that otherwise might have been caught are missed because they pass between the reporting gaps of the various systems. Security information and event management (SIEM) products are designed to close these gaps by connecting all of the products and showcasing trends so that an attack -- regardless of the attack vector -- can be more rapidly identified and mitigated.

The advantage of having a vendor-independent SIEM solution is that it gives you a better choice of the parts. The disadvantage is that the independent vendor generally has trouble maintaining high integration with new features because they aren’t in the development loop for the products they are integrating with, and are always playing catch-up. In a slow-moving market, this is an acceptable trade-off; unfortunately, the security market is no longer slow-moving, which likely goes to the core of why McAfee bought Nitro Security.

According to IDC, the SIEM market alone is currently more than $1 billion total and growing at an aggressive 22 percent. This is likely because of the proliferation of point-security solutions that now need to be better integrated in order to be made effective. This is coupled with the massive increase in visible threats, which many of us believe are underreported, but have crossed industry and government sites and penetrated organizations that were thought secure enough. SIEM products have a strong value proposition: They create visibility across the IT infrastructure, limit risk, and provide analytics that can identify threats and help fund mitigation efforts. In short, they provide the missing situational awareness needed to address what has become a complex threat landscape, and help make better decisions with regard to how to best protect the business.

I think the key to why McAfee bought NitroSecurity is the need for speed. It already tied back into some of its other offerings, but these offerings were being changed at an increasing rate, and for the links back into NitroSecurity to function optimally, McAfee would need an integrated suite. The only way to get this result effectively while maintaining product development security was to buy NitroSecurity and use it to link its ePO, McAfee Risk Advisor, and GTI offerings.

This now will increasingly look like an end-to-end suite so that buyers aren’t left with timing integration gaps between McAfee's and NitroSecurity's products.

This was also one of the easiest types of integration mergers to do, one where the product was already partially integrated with the planned suite of offerings and where the integration issues are likely already known.

Most software acquisitions occur between products that were never intended to work together, and then fail because folks eventually find out it is generally better to start from scratch than to try to integrate products that were never designed to be integrated.

In this case, NitroSecurity’s SIEM offering was designed to be integrated with McAfee's products, making the integration comparatively easy and speeding time to market. The end result is a solution that is and will remain more agile and better able to respond to a world of increasing and ever more aggressive threats.

Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2188
Published: 2015-02-26
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0594
Published: 2015-02-26
Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and CSCun1...

CVE-2015-0632
Published: 2015-02-26
Race condition in the Neighbor Discovery (ND) protocol implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service via a flood of Router Solicitation messages on the local network, aka Bug ID CSCuo67770.

CVE-2015-0651
Published: 2015-02-26
Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.

CVE-2015-0882
Published: 2015-02-26
Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php an...

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.