Vulnerabilities / Threats
2/24/2014
09:22 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

IBM Announces Security Forensics Capabilities To Help Protect Critical Data

IBM Security QRadar Incident Forensics designed as a module for the QRadar Security Intelligence Platform

ARMONK, N.Y., Feb. 18, 2014 /PRNewswire/ -- IBM (NYSE: IBM) today announced a powerful appliance for helping organizations diagnose and defend their critical data and enterprise networks against sophisticated external attacks and unauthorized insider activities.

Since 2010, the IBM X-Force Trend & Risk Reporthas been reporting on the alarming rate of how cyber attacks continue to occur. As data breaches continue to impact organizations, the need to reduce detection time and investigate these threats before they can significantly impact the business is critical. Cyber criminals often gain access to a corporate network weeks or months before actual data is compromised. According to the IBM X-Force Threat Intelligence Quarterly to be released next week, in 2013, more than half a billion records of personally identifiable information were leaked through a number of attacks against strategic targets. By detecting malicious activity earlier, organizations can more quickly stop, or reduce the potential loss of data.

IBM Security QRadar Incident Forensics, a new software product designed as a module for the QRadar Security Intelligence Platform, can help security teams retrace the step-by-step actions of sophisticated cyber criminals. By adding this forensics capture and search module to its QRadar Security Intelligence platform, IBM can further strengthen its clients' abilities to efficiently investigate security incidents and understand the impact of any suspicious activity. QRadar Incident Forensics provides a record of activity on the network, enabling organizations to retrace suspicious activity, provide alerts to growing concerns, and provide forensics search capabilities.

"Every breach is a race against time. This new forensics module further expands the breadth and depth of IBM's security intelligence capabilities," said Brendan Hannigan, general manager of IBM Security Systems. "QRadar Incident Forensics further helps IT staff prevent emerging threats and better determine the impact of any intrusion."

IBM Security QRadar Incident Forensics will help any member of an IT security team quickly and efficiently research security incidents or test for conditions associated with an observed attack pattern from an Internet threat intelligence feed such as X-Force. By using this guidance, security teams can avoid spending valuable time searching through petabytes of network traffic, and potentially discovering nothing of immediate value. With QRadar, security analysts can quickly collect security data related to an incident.

This solution is just one of IBM's new initiatives to expand its security intelligence capabilities. In the second quarter of 2014, IBM will introduce new capabilities to help organizations better understand the threat landscape. IBM Advanced Cyberthreat Intelligence Service will provide customers with insight into the threat landscape, targeted attacks and attacker tools, tactics and practices, incorporating IBM's own research with that of strategic partners specializing in threat visibility.

Additionally, IBM's Active Threat Assessment complements this ongoing threat intelligence and visibility. It leverages technical assessment capabilities and best-of-breed tools to identify previously unrealized, active threats while also modeling threats to unmitigated vulnerabilities in an enterprise environment.

IBM Security QRadar Incident Forensics, currently planned to be available in the second quarter of 2014, is an integrated module in IBM's QRadar Security Intelligence platform. Also part of this announcement, IBM is now allowing existing QRadar clients to test this solution as part of a beta program.

About IBM Security

IBM's security portfolio provides the security intelligence to help organizations holistically protect their people, data, applications and infrastructure. IBM offers solutions for identity and access management, security information and event management, database security, application development, risk management, endpoint management, next-generation intrusion protection and more. IBM operates one of the world's broadest security research and development, and delivery organizations. IBM monitors 15 billion security events per day in more than 130 countries and holds more than 3,000 security patents. For more information on IBM security, please visit:

www.ibm.com/security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2808
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a rel...

CVE-2014-9713
Published: 2015-04-01
The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors.

CVE-2015-0259
Published: 2015-04-01
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

CVE-2015-0800
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2...

CVE-2015-0801
Published: 2015-04-01
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.