Security event managers rule the roost

See editor's note at end of review

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

You won't find many IT products as ambitious as the SEM (security event manager), which attempts no less than to track, correlate, and ultimately make sense of a vast number of events occurring throughout a sprawling enterprise network.

SEMs monitor the logs from security devices such as firewalls; watch over vulnerabilities uncovered by vulnerability scanners; and monitor the activities of operating systems, Web servers, PBXes, and any other device that resides on the network. They also, of course, keep tabs on users and managers as they go about their normal -- or not-so-normal -- activities.

These products can also be tasked with carrying out functions related to all of the above responsibilities, such as looking for devices or activities that don't comply with regulations or company policies. Moreover, they have to report what they find in a manner that mere mortals can understand, and they must preserve everything in an auditable form.

Being all things to all people isn't easy. These products are complex. Fortunately, our evaluation of SEMs from e-Security, Network Intelligence, and Symantec was aided greatly by the vendors themselves, who supplied field engineers to configure their solutions for our test network, demonstrate their SEM's capabilities, and submit their products to our tests of essential SEM functions. Our primary test was to evaluate the solutions' monitoring and correlation capabilities, using a Spirent Avalanche load-testing appliance to simulate a combination of legitimate network traffic (administrative, Web, and e-mail) and suspicious activity (viruses, worms, break-ins, and attempts at unauthorized access).

In addition, we focused on manageability features, including the power and ease of configuring case workflow and detection rules, and the ease with which day-to-day users could view the necessary information about security events. We also considered interoperability and scalability, including how easily each product could integrate into an existing enterprise infrastructure, the number and types of devices it could collect information from, and features for handling large volumes of events and large amounts of data. We did not test performance; the events per second figures noted below, which represent the number of events the solution can process when running on dual-Xeon hardware, were supplied by the vendors.

By the time we finished our testing and carted the smoking remains of our first infrastructure to that great repair depot in the sky, we'd found that there is no single road to SEM success. In fact, with these relatively different SEMs, we were, quite frankly, surprised that their results tended to be uniform.

An SEM primer

There are two types of SEMs -- appliances and software applications -- and the products reviewed here span both categories. The Symantec Security Information Manager 9550 and the Network Intelligence 7550-HA are appliances. The e-Security product, Sentinel 5.1, is a software package that must be installed on a server.

The advantage of choosing an appliance over a software-only solution is that you get a machine that's designed and optimized specifically for that purpose. For example, both of the appliances came with their databases already installed and configured.

But that's not to suggest that a software-only SEM is an inferior approach. As long as you go out and get at least what the vendor recommends, you'll be fine.

All three products tested were fairly easy to install, but the appliance-based solutions were by far the most straightforward. Although it's not particularly difficult to bring up an SEM, there's a lot more work to be done behind the scenes: You'll have to find a way for the SEM to get information from all of the devices on the network.

Some of the SEM products made the process of adjusting to the network easier than did others. The Symantec 9550, for example, auto-detected much of the information about the network and therefore required less user input. But all of the products required configuration and tuning to make sure the network provided information to the SEM itself.

As a result, the full SEM configuration process may take many more hours, or even days, beyond initial setup, depending on your infrastructure and staff expertise. In other words, don't plan on having one of these up and running if you start the deployment process a week before your Sarbanes-Oxley or HIPAA audit.

When everything is up and running, there is no advantage to having an appliance or a software-only SEM. Both types performed well, and our top-scoring products included one of each: the Network Intelligence 7550-HA appliance and the e-Security Sentinel 5.1 application.

e-Security Sentinel 5.1

e-Security's engineers made short work of incorporating the firewalls, switches, servers, Snort IDS, and other devices on our test network into their SEM, as well as two devices none of the vendors were prepared for: an Extreme Summit replacement switch and an Ingate SIP firewall. Ultimately, all of the vendors were able to hook these in, but e-Security was the fastest, completing the job in less than an hour.

Sentinel proved easy to use and very powerful. The product's graphical display is designed to give you a very clear look at the overall status of your enterprise yet makes it simple to see the data behind the images. If you click on a device on the network, for example, you can see immediately what other devices it communicates with, as well as view all problem IP addresses at a glance.

When you discover a potential problem, the product's iTrac module manages nearly all of the steps required to investigate it. It makes sure that all policies and procedures are recorded and followed as required, and you can add additional functions and policies for your company's specific needs.

e-Security designed Sentinel so that it can be operated by a number of people, each with defined tasks. In a practice that's becoming more common in security products, Sentinel's policies ensure that security managers can see only those functions they are authorized to perform.