Security event managers rule the roost

See editor's note at end of review

You won't find many IT products as ambitious as the SEM (security event manager), which attempts no less than to track, correlate, and ultimately make sense of a vast number of events occurring throughout a sprawling enterprise network.

SEMs monitor the logs from security devices such as firewalls; watch over vulnerabilities uncovered by vulnerability scanners; and monitor the activities of operating systems, Web servers, PBXes, and any other device that resides on the network. They also, of course, keep tabs on users and managers as they go about their normal -- or not-so-normal -- activities.

These products can also be tasked with carrying out functions related to all of the above responsibilities, such as looking for devices or activities that don't comply with regulations or company policies. Moreover, they have to report what they find in a manner that mere mortals can understand, and they must preserve everything in an auditable form.

Being all things to all people isn't easy. These products are complex. Fortunately, our evaluation of SEMs from e-Security, Network Intelligence, and Symantec was aided greatly by the vendors themselves, who supplied field engineers to configure their solutions for our test network, demonstrate their SEM's capabilities, and submit their products to our tests of essential SEM functions. Our primary test was to evaluate the solutions' monitoring and correlation capabilities, using a Spirent Avalanche load-testing appliance to simulate a combination of legitimate network traffic (administrative, Web, and e-mail) and suspicious activity (viruses, worms, break-ins, and attempts at unauthorized access).

In addition, we focused on manageability features, including the power and ease of configuring case workflow and detection rules, and the ease with which day-to-day users could view the necessary information about security events. We also considered interoperability and scalability, including how easily each product could integrate into an existing enterprise infrastructure, the number and types of devices it could collect information from, and features for handling large volumes of events and large amounts of data. We did not test performance; the events per second figures noted below, which represent the number of events the solution can process when running on dual-Xeon hardware, were supplied by the vendors.

By the time we finished our testing and carted the smoking remains of our first infrastructure to that great repair depot in the sky, we'd found that there is no single road to SEM success. In fact, with these relatively different SEMs, we were, quite frankly, surprised that their results tended to be uniform.

An SEM primer

There are two types of SEMs -- appliances and software applications -- and the products reviewed here span both categories. The Symantec Security Information Manager 9550 and the Network Intelligence 7550-HA are appliances. The e-Security product, Sentinel 5.1, is a software package that must be installed on a server.

The advantage of choosing an appliance over a software-only solution is that you get a machine that's designed and optimized specifically for that purpose. For example, both of the appliances came with their databases already installed and configured.