6

I have a decent understand and experience with securing and setting up smaller networks, although absolutely no enterprise experience. I understand at such a large scale there are different technologies for managing the sheer number of machines and the complicated topology.

What security technologies are unique to enterprise environments? Firewalls would not count as they are prevalent in non enterprise environments as well.

At a guess I would think there would be heightened monitoring and aggregated logging which could be centralized, perhaps a way to quickly isolate compromised machines from the rest of the network (on the fly vlans?)...what else?

I am not asking about more sophisticated versions of technology, as obviously an enterprise firewall with have more features/functionality than one for a small business.

I have looked at devices like the Cisco MARS and ArcSight...which seem to do centralized log aggregation and reporting prediction....are these the only examples of technologies specific to enterprise environments?

How much additional information would administrators have at their disposal from such unique technologies, compared to what standard logging and reporting tools.

Improve this question
12
  • 1
    This question, including many of the questions in it, appear to be a repeat of this other SE question -- security.stackexchange.com/questions/3092/…
    – atdre
    Commented Jun 5, 2011 at 17:37
  • @atdre, not interested in stuff for a SOC or suggestions relating to that, interested specifically in differences in enterprise security from smaller environments, unique to enterprise environments. For example a firewall would be part of the answer to the SOC question, but not to my question.
    – Sonny Ordell
    Commented Jun 5, 2011 at 18:09
  • @ Sonny: Yes, that question discusses the problems of the cost of SIEM as it relates to smaller organizations. You should really check it out.
    – atdre
    Commented Jun 5, 2011 at 18:24
  • @atdre, it's a different question to what I'm asking is my point. There may be some cross over in the answers, but my question is certainly not a repeat.
    – Sonny Ordell
    Commented Jun 6, 2011 at 3:37
  • 1
    @ Sonny: No, you are wrong. 1) My answer discusses unique Enterprise-grade and SMB/SOHO-grade incident response/detection technologies, 2) My answer discusses the cost of these technologies, 3) My answer discussed custom controls for client-side technology that would minimize the rate and impact of incident response
    – atdre
    Commented Jun 9, 2011 at 17:15

2 Answers 2

Reset to default
1

What security technologies are unique to enterprise environments? Firewalls would not count as they are prevalent in non enterprise environments as well.

There is nothing that is 'unique' to an enterprise environment. There various levels and certain 'hindrances' to software being deployed outside these environments (I.E. cost) but it doesn't mean you won't see it happen.

I am not asking about more sophisticated versions of technology, as obviously an enterprise firewall with have more features/functionality than one for a small business.

That really though is what an 'enterprise' solution is... a more sophisticated version of technology used at a consumer level.

Take a look at things like spiceworks, which handles network management, and then intrusion detection systems like Snort and Suricata. (Note: I'm telling you free versions of this sort of software so you can play with them!) The 'commercial' versions of such things will do the same sort of tasks.. just on a larger/better scale.

Another 'enterprise' solution is hardware/circuit level firewalls built into switches and/or routers.

Improve this answer
4
  • what about things like ArcSight and such? What would be an equivilant threat detection system for a SOHO environment?
    – Sonny Ordell
    Commented Jun 27, 2011 at 16:26
  • @Sonny ArcSight is a very large application/service that does a large variety of tasks related to Intrusion Detection (et cetera) and compiles them under one 'software suite'. I can't think of anything that rivals all the features of ArcSight, but you can fairly easily find programs/services for any one (or a few) of ArcSight's features. Take look at Snort (as I mentioned above) and also Snorby. EDIT: Good luck finding what you need!
    – DKGasser
    Commented Jun 27, 2011 at 18:36
  • not actually needing anything just wondering what goes on in more complex environments. So things like ArcSight don't have unique technologies as such, just much better versions of what is at a lower level?
    – Sonny Ordell
    Commented Jun 27, 2011 at 18:44
  • @Sonny I can't speak with any certainty of knowing the inner workings of something like ArcSight, but I'm fairly certain it all boils down to the same concepts/methodologies.. just implemented in slightly different ways and with greater/lesser resources.
    – DKGasser
    Commented Jun 27, 2011 at 18:45
4

From your title it appears you are asking what security incident response and detection technologies are unique to large enterprise environments?

Unique technology:

  • A central Security Information and Event Management (SIEM) system - large organizations need to be able to centrally gather logs and alerts from a large number of disparate systems (e.g. firewalls, AV, platforms, databases, applications) for correlation and monitoring. A smaller organization may get away with configuring email alerts or reviewing logs
  • A central incident tracking and workflow system - something like Remedy or better to log security incidents, manage ownership, allocate tasks and track to completion. A smaller organization may use email or a spreadsheet for this

People and process:

  • A 24 x 7 Security Operations Center (SOC) consisting of shift workers or follow the sun geographic pool of people
  • Formal security incident rehearsals both on paper and full on red team / blue team exercises

Just about everything also needs more powerful models, clusters, horizontal growth capability to cope with the scale and redundancy and geographic distribution needs that smaller organizations will not have.

Unique security technology outside of incident response and detection that you see more in larger organizations due both to scale, complexity and regulatory and audit requirements (probably not a complete list):

  • Data loss prevention
  • Email encryption
  • Removable media control
  • Identity and access management
  • Configuration compliance and file integrity monitoring e.g. Tripwire
  • Single sign-on
  • Web access management (e.g. Siteminder)
  • Federated identity
  • automated security source code analysis and application vulnerability scanning
  • hardware security modules
  • internal Certificate Authority (CA)
  • backup encryption / decryption appliance
  • DDOS filtering service
  • Dedicated IPS (i.e. not in a UTM)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .