Checking packets for papers
Listen to the column Checking packets for papers, or visit our Podcast Center to hear more by James Gaskin.
Remember Cold War movies where surly border guards carrying well-used machine guns stopped people at the border and growled "Papers!" in a Slavic accent? Q1 Labs (Q1Labs.com) now tracks "papers" for each packet zipping through your network. Actually, they cross reference network activity with identity management to give better finger a network felon.
The idea of tying identity management into network analysis and threat detection makes sense to me. When I sold the first generation Sniffer from Network General (the original Network General), network administrators always asked two questions: how busy was the network, and who was doing what. Getting the activity level question answered today is easy, but tracking who's doing what, especially if the what is something not good, takes time.
A Q1 Labs spokesman likened the new Qradar-2101 network security management appliance to video surveillance for your network. While I profess some dubiosity about that analogy, quickly locating users via name and computer address will certainly help security management. Wouldn't you want to know immediately which desktop has become a spambot because the user transferred a spreadsheet worked on at home with his teenager's USB thumb drive? The same USB drive full of spyware from high school? The quicker the ID, the better.
Security responses can be tailored based on user identity. A network administrator running a computer with the Ethernet card in promiscuous mode isn't a worry. However, a laptop carried in from outside running network analyzers during a meeting in the conference room may well be a giant security breach in progress. Low level employees caught surfing "inappropriately" can be marched out in handcuffs, while vice presidents caught doing the same thing can "have conversations" with the senior vice president.
Starting at $37,700, the Qradar-2101 isn't a casual purchase but provides significant savings over other products in this area. Security budgets magically stretch, especially after a break in and subsequent audit. Q1 Labs promises to interface with all manner of network servers, routers, switches, and management platforms.
Remember, employees make mistakes and create security incidents by accident or lack of training. Use QRadar to track down and train those employees. Save the machine guns for their third strike.
ITworld.com
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
