Sumo Logic is expanding its EMEA footprint with planned availability of its AI-powered security solutions on the AWS European Sovereign Cloud and Swiss Data Center region.

The move aims to bolster support for European organizations' data privacy, sovereignty, resiliency, and security needs as they push ahead with digital and AI strategies.

Sumo Logic said the expansion will enable businesses to deploy its security analytics and SIEM capabilities while keeping data in-country or within designated time zones as demand for sovereign cloud services grows.

According to research from IDC, 63% of organizations are now more likely to adopt sovereign cloud services due to recent geopolitical events, with spending tipped to reach more than $400 million by 2029.

Despite the growing market, Eric Avery, global head of infrastructure and data at Sumo Logic, said strict data sovereignty regulations are creating barriers for many organizations – particularly across regulated sectors such as healthcare, finance, and the public sector.

“Previously, enterprises in highly regulated industries have been limited in their choice of cloud security solutions while meeting compliance requirements like Switzerland’s FADP,” he explained.

“Sumo Logic's innovations around SIEM and agentic AI, combined with AWS' European Sovereign Cloud infrastructure, provides the ideal response.”

AWS sovereign cloud and Swiss expansion

Under the expansion, Sumo Logic’s Intelligent Security Operations platform will be made available for deployments on the AWS European Sovereign Cloud to help customers operate cloud workloads in an independently governed environment while using Sumo Logic to log, track, and secure deployments.

The security vendor also confirmed plans to roll out its platform in Switzerland in an effort to better support customers that require faster in-country data processing in line with the Swiss Federal Act on Data Protection (FADP), as well as GDPR obligations.

By expanding its footprint to the AWS Swiss Data Center, Sumo Logic said organizations operating within Swiss borders will be able to leverage its agentic AI-driven log analytics and advanced SIEM capabilities to boost compliance, while benefitting from a faster, low-latency environment.

“We deliver reliable security operations that help organizations stay secure and compliant while running services locally with the performance and scale they need,” Avery added.

FOLLOW US ON SOCIAL MEDIA

Many routinely assert that small and medium-sized businesses (SMBs) are less likely to be targeted than their larger counterparts, but this is far from the case. SMBs have limited resources versus their larger counterparts, which can make cyber security a challenge.

But robust security is possible if these companies take a handful of simple steps to avoid the common cyber security pitfalls and ensure they’re resilient if a cyber attack does land. 

1. Plan for the worst-case scenario

It’s true to say cyber attacks are a matter of when rather than if – regardless of the size of your business. One of the biggest traps for SMBs is fixating solely on preventing cyber attacks, says Haris Pylarinos, founder and CEO of security skills company Hack The Box. This can leave firms reeling when a cyber assault does eventually get past your defenses. 

He advises ensuring your business doesn’t have any weak spots through methods such as vulnerability assessments and penetration testing, as well as making sure you have an incident response plan in place.

When a cyber attack happens, one of the biggest pitfalls SMBs face is a lack of preparation, says Jack Peters, customer solutions architect at M247. He cites data from AAG showing that less than a fifth of UK businesses have a formal incident response plan in place. “It’s essential that businesses create, implement and maintain a strategy for how they will handle a cyber attack, as this will allow everyone to correctly identify any weaknesses and vulnerabilities within the IT framework,” he advises.

The plan needs to be implemented before an incident occurs, he says, highlighting that a pre-emptive approach “will be beneficial in the long-term”. 

According to Pylarinos, SMBs should focus on key areas: preparation, detection and analysis, as well as containment, recovery, and post-incident analysis. 

It’s also important the incident response plan is easy to understand. Although the specifics may vary depending on the size of the organization and industry, Peters advises using the five-step cyber security framework developed by the National Institute of Standards and Technology (NIST). “This is a great model to follow.”

2. Get the basics right

As a foundation for all things security, SMBs should ensure they are getting the basics right. As part of this, it’s key to update your devices regularly. Many smaller businesses suffer irreparable damage after falling victim to a cyber attack that could have been prevented if they’d taken the time to update systems. 

One way to ensure you are protected is to update your devices automatically, advises Elliott Wilkes, CTO at consultancy and managed service provider Advanced Cyber Defence Systems. This should include all devices that access company data such as computers, smartphones, servers, virtual machines (VMs), and Internet of Things (IoT) devices, he says. “It sounds simple, but you’d be surprised at how many ransomware events have taken place over the past few years using well-known vulnerabilities that have been fixed, but the organization didn’t deploy the patch.” 

While it might seem obvious, ensuring all devices have an antivirus system and that team members use strong passwords including random words, numbers, and symbols can “provide a first line of defense”, says David Clarke, head of security at IT consultancy Quostar. 

Craig Jones, VP of security operations at security firm Ontinue advises creating and implementing policies around secure internet use and handling sensitive data. “This includes avoiding suspicious emails or links, not sharing passwords, and not using unsecured Wi-Fi networks for work-related tasks. Don’t assume everyone knows the basics – even simple mistakes can lead to significant breaches.” 

3. Use technology like MFA wisely

Technology isn’t everything, but it can help boost security when resources are limited. Cheap and easy to use, one of the best additions to your security strategy is multi-factor authentication (MFA). Adding this extra layer of defense will help avoid your business being caught out by weak passwords and it also reduces the margin for human error.

Wilkes advises enabling MFA on all accounts where possible, using an app such as Google or Microsoft Authenticator. “If you only have the option to use SMS, that’s ok too – but try to use an app if you can. These store temporary codes that you enter along with your password to login to a website or application.”

For super-robust defenses, especially if your business operates in a high-risk industry vertical, you could consider a physical token to secure your accounts, such as a Yubico YubiKey. “These provide authentication that is much more resistant to phishing emails, which is an increasingly common way criminals gain access to an organization’s systems and data,” says Wilkes.

Additionally, if it’s feasible within your budget, SMBs should consider security information and event management platforms (SIEMs) which feature vulnerability assessments and cyber threat intelligence technology, says Clarke. “Regular cyber security assessments can be critical to protecting firms by helping them identify weaknesses and potential entry points into their networks.”

4. Invest time and effort into cyber security training

It’s often said that employees are a firm’s weakest link, and many cyber attacks are successful due to a simple mistake made by a member of staff. A costly blind spot for any business, particularly SMBs, is failing to invest in cyber security training, says Pylarinos. “With cyber threats on the rise and growing in sophistication, training your staff to combat the latest risks is crucial.”

As part of this, SMBs should ensure they are encouraging cyber awareness among all employees, says Pylarinos. This is often overlooked: In 2022, the UK Government found only one in five businesses (17%) provided awareness sessions for those not directly involved in cyber security. 

This is despite the fact that the majority of breaches (83%) were a result of phishing – seeing employees mistakenly clicking on malicious links or downloading malware-ridden documents. “By consistently training employees of all levels on the basics of cyber awareness, SMBs can spot phishing or social engineering lures and thwart cyber threats across their organization,” says Pylarinos.

Employee training can be performed in a number of ways, using educational platforms and exercises. Experts also agree it should be done regularly to ensure you are up to date with the latest threats.

Lewis West, head of cyber security at recruitment firm Hamilton Barnes, advises SMBs to be focused on building a “strong security culture” and increasing awareness across the entire team. “Training employees to become more aware of security and adversaries’ methods is an effective way to reduce the number of successful cyber attacks.”

Research from the Enterprise Strategy Group (ESG) reveals that IT professionals struggle to identify the most valuable data available to them, so priority investments include the centralisation of data with increased security controls, as well as comprehensive analytics to identify complex attacks. As a solution, organisations are investing in SIEM infrastructure but admit they find it difficult to manage it effectively.

In this technical product review of IBM Security QRadar SIEM, ESG makes several observations, including QRadar's ability to prioritise events, lower costs, integrate with both IBM and 3rd party solutions, and more.

Download the full report for more details and how to overcome the most challenging attributes of SIEM for your business.

Provided by

The cloud was instrumental in allowing the public sector to keep the wheels on in the face of several years of huge disruption, with those organisations that embraced the scalable services on offer being much better equipped to confront these seismic changes.

This whitepaper dives into how governments’ resilience is critical to managing disruption across different areas of the public sector, and the ways in which the cloud is enabling adaptability and responsiveness that is needed.

Download now to discover the emerging practices that will build public sector resilience in the face of current and future uncertainty.

Provided by

Provided by

A change in a system, like a customer updating their information or placing an order, produces a notification called an event.

To best manage the increasing volume of event producers and consumers in your TT ecosystem and make use of the information in event streams, your organisation needs an event-driven architecture (EDA).

Download this whitepaper to learn about the key capabilities of an EDA, like:

• Pub-sub and message-oriented middleware to reliably move event messages
• Streaming analytics, which applies machine learning to make decisions
• Event mesh, a dynamic infrastructure that allows message to be delivered across a distributed enterprise

Most often than not, as a consumer, you will have been used to experiencing customer identity and access management with your own favourite apps and websites, whether that’s online banking on your smartphone, or online shopping through your social media. CIAM provides the digital identity layer for businesses to identify who you are, across multiple touchpoints, as well as the registration and sign-up process in order to keep your information secure.

In this dummies guide brought to you by OKTA, you’ll realise how CIAM can support your business to deliver secure, seamless digital experiences for your customers and what the key CIAM capabilities are.

Download to learn:

• What the future looks like for CIAM
• What to look for in a modern CIAM solution
• Ten important things to consider in CIAM

Fill out the form below to access this resource

Customer identity and access management (CIAM) allows customers to have the constant, immediate access to digital services they expect, while also keeping them secure. Organisations moving towards identity and access management can often struggle with security vulnerabilities, however far along the process they are, which in turn affects their customers’ confidence in them.

To eliminate this, businesses need to put their customers first, with an effective CIAM solution that covers authentication, authorisation and user management. By implementing this robust infrastructure, you can protect your customers’ data and re-inspire their trust.

Download this guide from OKTA to understand the four key phases on the path to CIAM, as well as the pain points your business may come up against, and the solutions to them.

Fill in the form below to access this resource

Provided by

Did you know that the average enterprise security team sees 200,000 security events per day?

As attackers become more dangerous and the regulatory environment continuously evolves, basic tools just can’t keep up. This is why upgrading to a Modern Security Information and Event Management (SIEM) solution is crucial.

SIEM solutions go beyond the automatic collection, parsing and normalising of logs. They apply advanced correlation and analytics to automatically detect threats, assess their severity and filter through the noise to alert you to critical events. They leverage built-in automation and intelligence to keep you protected — while simultaneously freeing up time to focus on remediation and recovery.

However, before you upgrade to a modern SIEM solution you need to be able to determine the best solution for your organisation. This report explores the five key questions to help you make this decision.

Provided by

The most productive security teams are going beyond the use of tactical tools for investigation and reporting of security incidents.

Instead, they are taking a more strategic, proactive, platform-oriented approach to identifying and assessing security-related risks, proving compliance, and maturing the flexibility and resilience of ongoing operations.

Download this resource now to see how security strategies have been evolving in recent years and how a platform-oriented approach improves visibility, analytics, automation, and more.

Part of ManageEngine’s burgeoning product portfolio, Log360 delivers a complete SIEM (security information and event management) solution that’s priced right for SMBs and mid-sized organizations. It teams up a choice selection of ManageEngine’s IT security management products, amalgamates them into a single web console for easy access and offers optional add-on products to further enhance its efficacy.

The Log360 web site is a tad vague about what is actually included in the suite so we asked ManageEngine support to clarify. It advised us that the base Log360 suite includes ADAudit Plus, EventLog Analyzer, O365 (Office 365) Manager Plus and Log360 UEBA (user and entity behavior analytics).

Add-ons include Exchange Reporter Plus for on-premises mail server auditing and ADManager Plus, which adds a heap of Active Directory reporting tools. DataSecurity Plus also provides file server auditing and DLP (data leak prevention) while Cloud Security Plus collects and analyzes log data from AWS, Azure, Google Cloud and SalesForce.

ManageEngine Log360 review: Pricing and getting started

Prices for Log360 start at around £452 but costs will depend entirely on what you want to monitor. We requested a quote from ManageEngine for 1 domain controller, 5 Windows servers, 5 syslog sources, 100 workstations, 5 Windows file servers, 5 application auditing licenses, AD reporting, an Exchange server, UEBA and a single Office 365 tenant and it came back the next day with annual subscription cost of only £4,078.

Initial installation of the base Log360 suite is simple, as it’s handled by a single routine. We loaded in on a Windows Server 2019 Hyper-V VM logged in as a domain member, and the suite was ready to go in 20 minutes.

Each individual component has its own web console with a dedicated port number and Log360 provides a single pane of glass for accessing them all. If you install more components later on, you can add them to the main Log360 console by entering their host name and service port number.

We suggest adhering to the recommended host hardware specification as the minimum requirement is nowhere near enough - our VM initially had 2 CPU cores plus 8GB of memory and Log360 ate the lot. In fact, we weren’t happy with performance until we had assigned 8 virtual Xeon Scalable Gold cores and 32GB of memory to the Log360 VM.

ManageEngine Log360 review: ADAudit Plus and EventLog Analyzer

The Log360 console opens with dashboard status overviews of all components, and each one can be quickly accessed from the side bar. ADAudit Plus presents graphs for at-a-glance views of user logon failures, account deletion, modification and creation activities, logon failure error reasons, logon activity, account lockouts and password changes.

It offers access to hundreds of exportable reports on all manner of AD activity (and Azure AD if configured), while the Compliance tab provides reports on regulatory standards including SOX, PCI-DSS, HIPAA and, of course, GDPR. You can peruse activity on Windows, NetApp, Dell EMC and Synology file servers, use analytics to spot anomalous activity and choose when to archive logs for 24 different AD categories

EventLog Analyzer supports over 750 log sources so you can integrate data from your core servers, firewalls, routers, switches, databases, VMware and Hyper-V hypervisors, web servers, vulnerability scanners and endpoint security products. Logs are easily managed as it provides full archiving facilities, where you specify intervals and retention periods and elect to have the files securely encrypted and time-stamped.

Log interrogation features are outstanding; you can use the console’s top search bar for fast results or create more complex queries using wild-cards, phrases, Boolean operators, groups and ranges. Log data can be correlated from multiple sources and reporting tools include a range of canned reports plus a full set for GDPR compliance.

ManageEngine Log360 review: O365 Manager Plus and Log360 UEBA

O365 Manager Plus just required us to enter our tenant details and we could then use its customisable dashboard to view mail traffic, malware and spam activity, top senders or receivers, mobile users, mailbox quotas and much more. The usage view required ManageEngine’s RESTful API access to be enabled and then we could view our user’s OneDrive, Skype and Teams activities.

Reports are available for all Office 365 functions and range from mailboxes and mail traffic to all things related to users, groups, contacts, account security and registered Azure AD devices. Extensive auditing for both Exchange Online and Azure AD is only a few clicks away and logs older than a set number of days can be archived and password protected.

Log360 UEBA opens with an informative dashboard showing how many events have been ingested, anomalies detected, trends over time plus users and devices being tracked. Each user and entity is assigned a risk score based on their activities, which you can view from the relevant dashboard to see why they have been marked up for attention and generate detailed anomaly reports on areas such as failed logins, registry activities, firewall changes and even USB device usage.

ManageEngine Log360 review: Optional add-ons

If you have an on-prem Exchange server then Exchange Reporter Plus is well worth considering. Its main dashboard shows all inbound and outbound mail activity along with a traffic summary and a sidebar which highlights alerts you need to investigate. Extensive predefined reports tell you everything you need to know about your organisation’s email while the auditing section keeps you informed of any changes to your Exchange databases along with mailbox permissions and properties.

Another add-on that’s worth a look is ADManager Plus, as this takes AD reporting to a higher level. However, note that this is a cut down version for Log360 that doesn’t include the AD object management tools provided by the full standalone version.

ManageEngine Log360 review: Verdict

Businesses worried about GDPR compliance can rest easy with Log360 at their side as it delivers an excellent range of event log and security management tools. Best installed on a dedicated host, it neatly integrates everything into one central console, more components can be added as required and it’s all offered at a competition-thrashing price.

ManageEngine Log360 system requirements (recommended)

Automating necessary, but menial and time-consuming functions in a business could be the key to unlocking the next wave of advanced analysts and threat hunters.

'There really isn't any reason to avoid automation,' according to Michael Leland, chief technology strategist at McAfee, adding that only through embracing the automation of tasks, specifically in a company's security operations centre (SOC), can they hope to free up valuable human brainpower for other things.

Speaking at (ISC)2 Security Congress, Leland said every tier 1 analyst wants to move up to tier 2, but are stymied by the relentless and menial work they have to do.

"A tier one analyst whose job is to pick through the events at a very low level I hate to call them it trained monkey work but at the end of the day, a lot of the work they're doing is mindless." he said.

"But I can tell them that I'm reducing the workload by 80% by allowing a bunch of the automation to do his job. That time restriction now is removed and he can start performing more advanced techniques that you might want to learn."

These monotonous duties preventing tier 1 analysts progressing to tier 2 and beyond include triaging all the events that pop up in the SOC and evaluating whether they need remediation.

The time it takes a human to triage an event and perform remediation takes around 75 minutes, what's known as dwell time. An automated process could do it in just two, according to Leland and the efficacy of a SOC is measured, in part, on the dwell time it takes to remediate issues.

"The only way to achieve this kind of efficiency is to automate as many of these tasks as possible, whether that's an AI engine, whether it's machine learning or simply mining data," he said.

The value of a unified and automated architecture is huge. Automating processes in a SOC can lead to a 1,000% or more increase in event handling capacity, a 65% quicker triage rate and this is all done with a much greater degree of accuracy compared to what a human can produce.

This is due to a few things, the first being a human's inability to multi-task. Leland referenced an experiment McAfee did with people who were originally told to enter a room, scan it and then recall all the items they saw in that room after.

People were able to score a 98% recall rate in the first test condition, but when the researchers made them unlock a door before entering the room an added task the recall rate tumbled to 67%.

"We think that the combination of humans and machines, the concept of human-machine teaming is probably the only way that we are going to achieve better accuracies, reduced timeframes for meantime detection, reduced meantime for remediation and reducing alert fatigue," said Leland.

Another factor affecting the effectiveness of a SOC program is the constraints on resources that businesses face. By freeing up tier 1 analysts, organisations can use their analyst's free time to explore opportunities to improve what those analysts are already doing, or do new things to benefit the business while the automated SOC works in the background.

The need for automation has never been greater for businesses and that's evidenced by the sheer number of events that trigger alerts in a SOC environment.

Leland said, on average, an enterprise of a significant size will be alerted to 3.2 billion events a month. 3,000 of these will require investigation and only 13 will be critically dangerous.

"How else would you find those 13 in 3.2 billion if you have a human bottleneck? Automation is the only way to achieve that."

Automation may be one of the industry's most feared buzzwords it threatens the jobs of many real people working in the industry but a rise in automation should instil fear in no-one, Leland claims.

"The idea behind robots replacing humans is probably something that we're not going to see in our lifetime," he said. "But what is more realistic is that we're going to build environments where humans and AI or computers work better together to create greater value."

Privacy International has found that more than half of Android apps, including big names like Skyscanner and Tripadvisor, automatically transfer data to Facebook when opened without user consent.

In a 51-page report titled 'How Apps on Android Share Data with Facebook', Privacy International revealed 61% of the 34 apps tested transfer data such as "app installed" or "SDK initialised" when the app is opened. The app also sends data about the nature of the device the user owns, and the user's location based on language and time zone settings.

According to researchers, this data is gathered by Facebook regardless of consent, or whether users even have a Facebook account.

The data reveals how often people use these apps, according to Privacy International's analysis, and is often sent with a unique identifier such as Google Advertising ID (AAID), or Apple's IDFA. Together, the data could be used by advertisers to link data about user behaviour and paint a comprehensive profile.

"If combined, data from different apps can paint a fine-grained and intimate picture of people's activities, interests, behaviours and routines, some of which can reveal special category data, including information about people's health or religion," the report warned.

"For example, an individual who has installed the following apps that we have tested, "Qibla Connect" (a Muslim prayer app), "Period Tracker Clue" (a period tracker), "Indeed" (a job search app), "My Talking Tom" (a children's' app), could be potentially profiled as likely female, likely Muslim, likely job seeker, likely parent."

The report also found that some apps routinely send Facebook data that is highly detailed and occasionally sensitive, including data on users who do not have Facebook accounts.

Privacy International highlighted how travel app KAYAK, for example, would send information about flight searches including departure dates, departure city, destination, number of tickets, number of children and class of ticket.

"Facebook places the sole responsibility on app developers to ensure that they have the lawful right to collect, use and share people's data before providing Facebook with any data," the report continued.

"However, the default implementation of the Facebook SDK is designed to automatically transmit event data to Facebook."

The digital rights group suggested this constitutes a breach of the EU's General Data Protection Regulation (GDPR) given the Facebook SDK automatically shares data before apps are able to ask users to agree or consent.

In light of developers filing 'bug reports' last year, Facebook released a voluntary feature that should allow developers to delay collecting automatically logged events, such as "SDK initialised", until after they acquire user consent. This feature was only launched 35 days after GDPR took effect on 25 May, however, and only works with SDK version 4.34 and later.

"Prior to our introduction of the "delay" option, developers had the ability to disable transmission of automatic event logging data, except for a signal that the SDK had been initialised," Facebook said in response to the report.

"Following the June change to our SDK, we also removed the signal that the SDK was initialised for developers that disabled automatic event logging.

"In June we also introduced another option for businesses that want to use our auto-event logging feature in compliance with our Business Tools Terms.

"Today, an app developer can either choose to use a pre-installed mechanism for obtaining an end user's prior informed consent (as they could in the past), or use the SDK delay feature."

Privacy International's report insisted that despite these options for developers, automatic data transmission was still detected for the majority of apps tested.

A number of possible factors could explain this, including the fact that data sharing is the default option, and that many apps run older versions of the Facebook SDK. Skyscanner, for instance, was running version 4.33.0 of the SDK when tested in early December, while Spotify was running version 4.310.

Ethical hackers got a real treat last month, when Kali Linux officially became available on the Microsoft Store, running on Windows Subsystem for Linux (WSL).

Kali Linux is a security-focused Linux distro based on Debian and is designed primarily for 'offensive security', which is a branch of cyber security that involves ethical hackers attacking businesses in order to expose flaws in their networks that can then be fixed, a process known as penetration testing.

The software comes pre-packaged with a variety of different command line hacking tools, including password crackers, packet sniffers and exploit tools. But you need to install it before you can make use of these pen-test treasures. Luckily, it's fairly simply to do that. Following the steps laid out on Kali Linux's open source project page, maintained and funded by Offensive Security, you can set up your machine with all the tools you need to perform a comprehensive pen test.

Update Windows 10

Firstly, if this is your first time using WSL, you'll need to update your Windows 10 machine to install it. You can do this by navigating to the Control Panel and go to 'Apps and Features', select 'Programs and Features' from the right panel and click 'Turn Windows features on or off' from the left menu. Select WSL and save it.

Alternatively you can open an administrative PowerShell window and install WSL by running the following command: Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux.

Whichever method you choose, Windows 10 will then reboot and you'll be able to then find, download and install the Kali Linux app in the Microsoft Store.

Install Kali Linux

One you have launched the application, you'll need to create a default UNIX account as part of the installation process, and add a password. Once you do so, WSL will automatically complete the installation and open a new console window.

Kali Linux's open source creators advise users to run an upgrade to keep up with the latest packages, and to clean up the apt-cache to save space on your drive.

The official page also points out that due to the tools' pen-test nature, some antivirus software will identify them as malware. To whitelist Kali tools, Offensive Security recommends allowing antivirus exceptions on the directory Kali sits in.

Offensive Security's explainer has plenty more troubleshooting advice for running Kali Linux on Windows 10 if you experience any issues once you have it installed and running.

A load of vendors have chosen to hone in on the cloud craze on the first day of RSA 2012, including HP and the host itself.

HP announced an expansion of its Security Intelligence and Risk Management (SIRM) offerings, which together are similar to other security information and event management (SIEM) products, such as IBM's recently-updated QRadar platform.

The SIRM offering builds on HP's major acquisitions in the security sector over the past two years, including Arcsight, which was seen as the leader in the SIEM space.

RSA NetWitness Live has been instrumental to our customers in detecting and defeating advanced threats.

It also ties in Fortify and TippingPoint technology, packing in various pieces to help companies get a good view over " traditional, mobile and cloud environments."

The HP EnterpriseView feature, which starts at $250,000, gives an overall view of security, including a dashboard and heat map designed to let users know where the greatest risk lies.

The HP Application Security Monitor (AppSM), which starts at $5,000 per application server, brings centralised searching, reporting and analysis covering Java/.Net applications, including mobile ones.

Those two features are expected to arrive "soon," whilst others, including HP Mobile Application Security, the HP Compliance Stack and the HP TippingPoint Next-Generation Intrusion Prevention System are already available.

The host with the most?

Not to be outdone by partners on the first day of its flagship conference, RSA introduced an update of its NetWitness technology, acquired last year by EMC.

NetWitness Live has been given something of a turbo boost with 30 per cent more threat content and integration with RSA's analytics platforms to give companies a greater knowledge about dangers facing their networks.

"RSA NetWitness Live has been instrumental to our customers in detecting and defeating advanced threats," said Amit Yoran, senior vice president and general manager of RSA's security management and compliance division.

"By tapping into the collective intelligence and analytical skills of the global security community, the RSA NetWitness Live service helps organisations significantly enhance their situational awareness and shorten their time to respond to potential threats."

The cloud-based technology brings together information from the global intelligence community, amounting to around 100 different sources - 300 less than IBM's aforementioned QRadar service.

As for the analytics integration, customers will now be able to share relevant threat data across the RSA NetWitness for Logs platform and the RSA NetWitness Spectrum malware detection product.

The event has also seen Qualys, one of the original proponents of cloud-based security, launch its open source web application firewall.

More cloudy announcements are expected over the next couple of days, so check back at IT Pro for all the latest from RSA 2012.

IBM has issued the first major update of the security information and event management (SIEM) software it bought in its Q1 Labs acquisition, claiming it is blowing the competition out of the water with the amount of data feeds it has collated.

Big Blue said the QRadar Security Intelligence Platform, built mainly of Q1 Labs sauce rather than IBM's own code, draws together 400 sources on threats giving IT pros a wider knowledge of dangers facing their networks.

IBM has hooked up its own X-Force threat feed to the SIEM offering, which monitors 13 billion security events per day.

A host of other Big Blue offerings have been integrated into QRadar, including IBM Security Identity Manager and IBM Security Access Manager to mitigate the insider threat.

There are no vendors that can cover that breadth and that's really the value we bring.

Future integration modules are also being released for non-IBM products, including Symantec DLP, Websense Triton, Stonesoft, Stonegate and others.

"Essentially we support Symantec and McAfee and can extend to others. We don't support HP Arcsight," IBM told IT Pro.

Martin Borrett, director of the Institute of Advanced Security at IBM, said there had been a "wealth of excitement" around what Big Blue could do with Q1 Labs technology.

"We've been trying to figure out how IBM can take it to the next level, integrating our research and existing product line," Borrett told IT Pro.

"At this stage, apart from driving more scalability into the platform itself with new appliances, it's really about those flows in and out. We had all the insight from the X-Force but it just wasn't plugged into the platform in the way that it will be now. It's really about that crucial integration."

The release also marks another major moment for IBM in establishing itself as a major security services player.

However, it faces strong competition in the SIEM space, with Symantec already offering a well-respected product, HP running its Arcsight-based offerings and McAfee set to boost its presence in the market after acquiring Nitro Security.

Borrett said IBM had "significant differentiation" in the market, thanks to the large number of sources QRadar can access and the insight it can get from the data.

"There are no vendors that can cover that breadth and that's really the value we bring," he claimed.

"The depth of the analytics we can get out of the Q1 platform I think is significantly stronger and better than our competition. Because of the context we can do it in... and the real-time capability [QRadar] is significantly better than the competition."

As for the SIEM market in general, with major players coming in and swamping the market, Borrett claimed there was still room for smaller players to partner with bigger vendors to supply more insight for bigger offerings.

"The important thing is that those capabilities integrate into these other platforms and into our platforms in particular," he added.

COMMENT In the space of a few hours, two big announcements from the security information and event management (SIEM) industry hit yesterday.

Intel-owned McAfee decided it wanted a piece of the pie so it snapped up Nitro Security.

Meanwhile, IBM joined the party by agreeing to acquire Q1 Labs a company which was adamant it was not for sale just 12 months ago.

Last year, HP spent an absolute fortune on getting its mitts on ArcSight - a company then (and still) ranked as the market leader.

This would all indicate the SIEM industry is rather big one. The irony is, these three major acquisitions may actually herald the end of the SIEM market as we know it.

It's not an industry, it's a feature

In all three acquisitions noted above, the acquired party has or will see its technology rolled into a bigger package. In the case of Q1 Labs, it will form part of an entirely new division within IBM. Recently-appointed CEO of Q1 Labs, Brendan Hannigan, will even head that division once the deal goes through.

Everyone knows that SIEM is just one layer of what companies would need for effective protection, but these recent acquisitions have indicated SIEM is not an industry on its own. With these big deals came an acceptance that SIEM is really just a feature.

During a press conference yesterday, Hannigan even admitted that SIEM was just a part of what he called "security intelligence."

"The end point is security intelligence which is broader than SIEM," Hannigan told IT Pro.

"Firms that focus just on log management and event correlation will be limited. Security intelligence is the key."

Hannigan said the best way for Q1 Labs to provide its services to end customers was to through a larger vendor in this case IBM. "We will be able to offer significantly better solutions than we could have done before," he added.

Put simply, expect the rest of the SIEM industry to be gobbled up by tech giants in the coming months. Their products will also be rolled into existing, wider ranging security offerings, leaving the sector looking rather thin.

Just like deduplication in storage, SIEM is just a piece of a larger pie that vendors won't be able to rely on as a sole selling point in the future.

What will Symantec do?

So HP, IBM and McAfee have all joined the party. That leaves one notable absentee: Symantec.

Earlier this week, Symantec CEO Enrique Salem said his company was considering spending another $1 billion on acquisitions. However, Salem did not mention the SIEM, or security intelligence, segment. Instead he focused on mobile, virtual spaces and the cloud.

Nevertheless, with chief rival McAfee making a splash yesterday, Symantec will be keen to show it isn't off the pace.

Of course, Symantec already has a product in the area the unimaginatively titled Security Information Manager.

But to consolidate its dominance of the security landscape, it will want to have the best of breed in the intelligence space. With others acquiring some impressive companies, Symantec would do well to show it wants to be a serious player in this space.

So who could it be looking at? Rapid7 is one growing company in this area. Just today it announced it was expanding into Europe with a new base on the continent.

However, it didn't appear on Gartner's SIEM Magic Quadrant from earlier this year. Now that Q1 Labs and NitroSecurity have been snapped up, the best option from Gartner's rankings appears to be LogLogic.

It is still a relatively small comoany, with just 150 employees, but that might make it even more attractive for a prospective buyer, given how highly rated the company is.

Symantec has had its options cut thanks to IBM and McAfee, but there's still plenty of choice.

We'll just have to wait and see if Salem will want to splash some of the companies millions (possibly billions) on an intelligence firm. It would be a smart move doing so sooner rather than later.

Intel-owned McAfee has made a splash in the security information and event management (SIEM) market by announcing it is to acquire NitroSecurity.

The announcement came on the same day IBM made its own SIEM purchase in agreeing to acquire Q1 Labs.

McAfee now wants a piece of the SIEM pie and offer its customers greater security intelligence so they can learn about security issues affecting their organisation.

With NitroSecurity's technology and talent, McAfee can expand its reach into the fast growing SIEM market.

NitroSecurity offerings will be rolled into current McAfee offerings, including the security giant's SIEM product known as the ePolicy Orchestrator.

NitroSecurity's SIEM offering has already passed integration testing with ePolicy Orchestrator, so the wheels are already in motion.

"NitroSecurity's technology supports a broad range of information sources including network security devices, firewalls, operating system and application logs, vulnerability assessment scans, identity and access management systems and privacy systems," said Ken Levine, chairman and chief executive officer at NitroSecurity.

"It will complement the extensive McAfee security portfolio and help to meet the demanding compliance and protection needs of our joint customers."

McAfee expects the deal to be sewn up by the close of 2011's fourth quarter.

"With NitroSecurity's technology and talent, McAfee can expand its reach into the fast growing SIEM market," said Stuart McClure, general manager and senior vice president for the risk and compliance business unit at McAfee, in a blog post.

"NitroSecurity is quite simply the most advanced SIEM on the market This capability provides the most visibility and the most advanced correlation capabilities giving McAfee true situational awareness.'"

Q1 Labs will no longer be able to claim it is the number one independent security information and event management (SIEM) company after agreeing to be acquired by IBM.

The SIEM vendor was adamant it was not for sale when IT Pro caught up with the company last September, saying it was delighted HP had bought chief rival ArcSight.

Q1 Labs then claimed it was in a better position in the SIEM market as a result of HP's purchase. It said it wanted to become the "Oracle of security intelligence."

Realigning IBM's security expertise in a new division with a greater focus on analytics is a bold step.

That will no longer be the case, as Q1 Labs is set to be rolled into the new IBM Security Systems division as part of the proposed acquisition. Q1 Labs CEO Brendan Hannigan will lead the division once the deal is closed.

Hannigan was only promoted to the CEO role in May, amidst questions of when the company was planning to go public. The Q1 Labs board described him as "the perfect candidate to lead Q1 Labs as we anticipate our Initial Public Offering."

"Since perimeter defense alone is no longer capable of thwarting all threats, IBM is in a unique position to shift security thinking to an integrated, predictive approach," Hannigan said of the IBM deal.

"Q1 Labs' security analytics will add greater intelligence to IBM's security portfolio and continue to distinguish IBM from competitors."

Even though the deal has not yet closed, IBM Managed Security Services has made a cloud-based service of Q1 Labs' SIEM offering available to customers.

Meanwhile, Q1 Labs will be working on creating "a common security platform for IBM's software, hardware, services and research offerings."

"Realigning IBM's security expertise in a new division with a greater focus on analytics is a bold step IBM is taking to help clients stay ahead of growing security threats," said Robert LeBlanc, senior vice president for IBM Middleware Software.

Financial terms of the deal were not disclosed.

The move means IBM will be going into more direct competition with HP in the security space.

Intel will be looking on with interest too after its subsidiary McAfee bought SIEM vendor NitroSecurity today.

Q1 Labs has launched a new security information and event management (SIEM) system, giving companies the ability to track employees' social network and multimedia use.

QRadar 7.0 is able to check anomalies in workers' use of applications to help detect any threats, as well as pick up on the kinds of information employees are making public in real-time.

Social network use can also be correlated with other access information. This allows administrators to check what sensitive databases have been accessed before the user has visited a social network, in case of any foul play or unwanted transmission of information onto the likes of Facebook or Twitter.

Another major feature of Q1 Labs' newest product is client-side vulnerability profiling, which identifies any potential threats on a network and then alerts when these are exposed.

Firms using QRadar 7.0 can also prioritise remediation steps based on the risk profile of each application.

On showing IT PRO the product in action, John Burnham, vice president of marketing for Q1 Labs, explained how the firm was delighted to have achieved an industry first in its social media and application monitoring, stressing the impact social networks have had on business.

"Social media is what the web was to enterprises in the mid-1990s," Burnham said.

The recent HP acquisition of ArcSight, along with the addition of this new product, will place Q1 Labs in a better position in the SIEM space, Burnham suggested.

"We were really pleased ArcSight was bought," he explained, adding that Q1 Labs is now the biggest independent firm in security intelligence.

As for whether Q1 Labs would ever be sold, Burnham stressed the company is "not for sale," although he expected to see other acquisitions in the space.

"Our goal is to become the Oracle of security intelligence," he added.