Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

10/12/2011
04:48 PM
Rob Enderle
Rob Enderle
Commentary
50%
50%

McAfee + NitroSecurity: SIEM Merger Done Right

McAfee showcases the perfect security company merger by bringing out a SIEM offering that better anticipates an increasingly hostile world

One of the big problems with security solutions in business is that they are largely ad-hoc. This means different layers are often added without much consideration for interoperability, and the end result is exploits that otherwise might have been caught are missed because they pass between the reporting gaps of the various systems. Security information and event management (SIEM) products are designed to close these gaps by connecting all of the products and showcasing trends so that an attack -- regardless of the attack vector -- can be more rapidly identified and mitigated.

The advantage of having a vendor-independent SIEM solution is that it gives you a better choice of the parts. The disadvantage is that the independent vendor generally has trouble maintaining high integration with new features because they aren’t in the development loop for the products they are integrating with, and are always playing catch-up. In a slow-moving market, this is an acceptable trade-off; unfortunately, the security market is no longer slow-moving, which likely goes to the core of why McAfee bought Nitro Security.

According to IDC, the SIEM market alone is currently more than $1 billion total and growing at an aggressive 22 percent. This is likely because of the proliferation of point-security solutions that now need to be better integrated in order to be made effective. This is coupled with the massive increase in visible threats, which many of us believe are underreported, but have crossed industry and government sites and penetrated organizations that were thought secure enough. SIEM products have a strong value proposition: They create visibility across the IT infrastructure, limit risk, and provide analytics that can identify threats and help fund mitigation efforts. In short, they provide the missing situational awareness needed to address what has become a complex threat landscape, and help make better decisions with regard to how to best protect the business.

I think the key to why McAfee bought NitroSecurity is the need for speed. It already tied back into some of its other offerings, but these offerings were being changed at an increasing rate, and for the links back into NitroSecurity to function optimally, McAfee would need an integrated suite. The only way to get this result effectively while maintaining product development security was to buy NitroSecurity and use it to link its ePO, McAfee Risk Advisor, and GTI offerings.

This now will increasingly look like an end-to-end suite so that buyers aren’t left with timing integration gaps between McAfee's and NitroSecurity's products.

This was also one of the easiest types of integration mergers to do, one where the product was already partially integrated with the planned suite of offerings and where the integration issues are likely already known.

Most software acquisitions occur between products that were never intended to work together, and then fail because folks eventually find out it is generally better to start from scratch than to try to integrate products that were never designed to be integrated.

In this case, NitroSecurity’s SIEM offering was designed to be integrated with McAfee's products, making the integration comparatively easy and speeding time to market. The end result is a solution that is and will remain more agile and better able to respond to a world of increasing and ever more aggressive threats.

Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-2319
PUBLISHED: 2019-12-12
HLOS could corrupt CPZ page table memory for S1 managed VMs in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM84...
CVE-2019-2320
PUBLISHED: 2019-12-12
Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ805...
CVE-2019-2321
PUBLISHED: 2019-12-12
Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdra...
CVE-2019-2337
PUBLISHED: 2019-12-12
While Skipping unknown IES, EMM is reading the buffer even if the no of bytes to read are more than message length which may cause device to shutdown in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ809...
CVE-2019-2338
PUBLISHED: 2019-12-12
Crafted image that has a valid signature from a non-QC entity can be loaded which can read/write memory that belongs to the secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastruc...