RSA Solution Brief
RSA Solution BriefStreamlining Security OperationsManagingtheLifecycleofwithRSA DataLossPrevention EncryptionKeysSolutionswithandRSA enVision RSA Key ManagerRSA Solution Brief1
Who is asking for this?A Brief on the Security Operations Center userThe job of Security Operations team, whether in a large organization withdedicated staff and resources, or in a small company with one person assumingmultiple responsibilities, is to keep information assets secure by continuouslymonitoring the organization’s IT environment, anticipating and responding toimmediate threats and long term vulnerabilities and providing advice andguidance on security matters to both senior management and business units.To be effective, security operations professionals must draw on tools that, day inand day out, turn a myriad of real-time events into actionable data. They need anefficient closed-loop process for handling incidents and mitigating risk. They alsoneed the visibility necessary to assess the effectiveness of security policies,processes and resources and the controls necessary to fine-tune them.Drivers for Information DiscoveryThere is a growing shift in IT from perimeter-focused security measures toinformation-centric security. Information is the backbone of business and in anuncertain economy it is more important than ever to focus management efforts onsecuring this information. This is even more apparent when viewed in contrastwith traditional perimeter security measures that have become ineffective andincreasingly expensive to scale with the universal expansion of informationacross an enterprise.One of the key problems that security operations professionals face is the gapbetween business operations’ use of information technology and corporatesecurity policy. This gap and the resulting organizational barriers often maketraditional security measures hard to implement. As a result, security operationsprofessionals are increasingly turning to tools such as Data Loss Prevention (DLP)to identify critical information within the enterprise and Security Information andEvents Management (SIEM) solutions to provide much-needed information riskdiscovery and management.-2RSA Solution Brief
What is the RSA enVision platform?The RSA enVision platform collects, analyzes,correlates and alerts based on log data from all eventsources across the network and IT infrastructure. Italso intelligently combines real-time threat,vulnerability, IT asset and environmental data. Thishelps organizations to respond quickly andthoroughly to high-risk security issues and topinpoint the places where problems are likely toappear. By automating manual processes andincreasing productivity, the RSA enVision platformdelivers increased security while reducing cost.With over 1600 production customers world-wideacross every industry, including 5 of the Fortune 10and 40% of top global banks, the RSA enVisionplatform:– Provides real-time, actionable security informationfor quick and accurate threat detection andalerting by combining event data, asset andvulnerability information. Utilizing intelligentcorrelation capabilities, security professionals canprioritize and focus on the issues that support thebusiness needs.– Improves analyst productivity by streamlining theincident handling process by providing access toreal, empirical data and offering a built-inworkflow – from initial identification andprioritization of an incident to investigation withcontextual information, escalation, resolution,closure and archiving. Security professionals canefficiently and effectively accelerate problemresolution.– Increases the effectiveness of security measures andresources by giving security professionals visibilityinto their enterprise, the status of an incident, thevulnerability and risk of high-priority assets and theuse of security resources. Through comprehensivereporting and easy to use dashboards, securityorganizations can focus staff on high-risk issues andadapt and adjust policies, procedures andinvestments in order to mitigate risk.Optimizing IT &Simplifying ComplianceEnhancing SecurityNetwork OperationsCompliance reportsfor regulations andinternal policyReal-time securityalerting and analysisIT monitoring acrossthe se (IPDB)Security devicesForensicsAlert /correlationNetworkbaselineVisibilityRSA enVision Log Management platformNetwork devicesApplications /databasesServersStorageRSA enVision Information Management Platformfor Network, Compliance & Security OperationsRSA Solution Brief3
content types and classification modules, resultingin very high accuracy ratings. The result is less timerequired to set up and tune policies and fastervalue delivery from the DLP system. RSA DLP scalesacross the enterprise and offers great flexibility,including optional temporary agents and gridscanning. The lowest possible TCO is achieved byleveraging existing customer hardware for DLP andrequiring fewer hours for set-up and ongoingmaintenance.What is RSA Data Loss Prevention?The RSA Data Loss Prevention (DLP) Suite is anintegrated suite of data security products thatprovides a proactive approach to managing yourbusiness risk associated with the loss of sensitivedata. Together, the RSA DLP Datacenter, Network andEndpoint modules, which comprise the DLP Suite,create a comprehensive data loss prevention solutionthat:– Discovers and protects sensitive data in the datacenter, on the network and on the end pointswhile leveraging common policies across theinfrastructure. DLP helps locate sensitive data nomatter where it resides, including file systems,databases, e-mail systems, large SAN/NASenvironments, and end points.Combined Data Loss Prevention andenVision Deployment ScenarioIn order to initially detect and audit sensitive data,the customer first configures policies and contentdetection modules in RSA DLP. The EnterpriseManager module receives events from the DLPcomponents whenever a policy violation is detected.As events are generated, the Enterprise Managerforwards the relevant event and user information tothe enVision platform. The customer uses theenVision platform to collect, correlate, analyze andalert on this information in combination with assetand user information from other sources. Thefeedback from that analysis is used to fine-tune DLPpolicies to ensure sensitive data is stored and usedappropriately.– Mitigates risk through identity aware policy basedremediation and enforcement. RSA DLP leveragesActive Directory Groups on the network and at theend point. Integration with Microsoft RightsManagement Service (RMS) provides groupspecific controls and enables protection beyondthe company’s boundaries.– Reduces total cost of ownership with industryleading scalability, incident handling andworkflow, and a comprehensive policy library. Adedicated information classification and policyresearch team provides finely-tuned policies,DLP DatacenterDashboardDLP EndpointDLP NetworkIncidentsReportsPoliciesEnterprise Manager4RSA Solution BriefAdminRSA Data Loss Prevention SuiteThe RSA DLP Suite gives youinsight into the risk status andtrends of sensitive data in yourenterprise – based on policies –regardless of whether the dataresides in a data center, on anetwork or out at the endpoints.
DLP NetworkEnterpriseManagerDLP DatacenterRSA enVision platformRSA Data Loss PreventionDLP EndpointCombined deployment applies the powerful analysisand correlation features of the RSA enVision platformto the content-aware information discovery providedby RSA Data Loss Prevention. The integration bringsenVision log parsing and reporting to all DLP events,which are forwarded to enVision via syslog by theDLP Enterprise Manager. Beginning with RSA enVision4.0 and RSA Data Loss Prevention 7.0, this capabilityis offered out-of-the-box, with no complex setuprequired in either product. This feature will be offeredto all RSA enVision platform customers via themonthly content update package.suspicious activity with all of the other activity by thesame user. Using the RSA enVision platform withevent input from DLP, the SOC user can quickly gatherall of that user’s information and find a pattern ofactions that, when taken as a whole, could representa much more severe incident than the original alert.For instance, a user sending a financial spreadsheetto a personal e-mail account may generate an alert,but it may become much more serious if the analystdiscovers that same user has also been copyingnumerous other sensitive documents to a personalthumb drive.Use CasesUse Case: Data Movement ForensicsUse Case: Security Incident Impact ClassificationAs the SOC analyst uses the event data from DLP tomake real-time decisions about security breaches, theforensic analyst uses the same data to strengthen aninternal investigation. Incorporating DLP events intothe enVision platform allows an analyst to lookbeyond what data repositories a user had access to.The analyst can now see exactly what types of datathe user could access, how sensitive that data was,and what actions the user took or attempted with thatinformation.A security operations center (SOC) professional hasto monitor and respond to many different types ofsecurity incidents such as malware attacks,vulnerability exploits and access spoofing. Via anintegrated enVision and DLP solution, efficientcorrelation of security and DLP event logs can helpthe analyst quickly determine the severity and impactof a potentially urgent incident. By providing insightinto the type and sensitivity of information involvedin the incident, DLP can help the SOC analyst decidewhen and how to remediate it and assess whatdamage has been done.Use Case: WatchlistingThe SOC user may receive an alert from the enVisionplatform that indicates suspicious user activity butdoes not in itself represent a security breach. In thiscase, the analyst may want to correlate theWhereas previously the analyst could only determinethat a user under investigation had access to a givenSharePoint site, he can now prove that theSharePoint site contained a sensitive customer listthat the user then copied to a USB thumb drive andalso e-mailed to a competitor – all within the sameenVision interface. This level of detailed informationgives the SOC user an unparalleled ability toinvestigate security incidents.RSA Solution Brief5
Use Case: Critical Business Information DiscoveryUse Case: Privileged User ReportingDiscovery of where sensitive data resides and how itis protected is the first step in securing that data.Through the integration between DLP and theenVision platform, all information about criticalsecurity assets and sensitive corporate data can bestored and analyzed in one place. Now, the enVisionplatform can become the centralized tool formonitoring the vulnerability status of various ITassets and correlating it with the critical businessinformation they contain.Information and its users change frequently, whichrequires compliance reporting to be an ongoingpursuit. On its own, the RSA enVision platform offersper-user alerting and reporting regarding what datawas accessed. With the addition of DLP events intothe enVision platform, the security specialist can adda new layer of reporting that indicates not only whatdata was accessed but also what the sensitivity orconfidentiality of that data was. The analyst can nowgenerate compliance reports to show what types ofdata privileged users can access, as well as what datais actually being accessed and which movements ofthat data are affecting compliance.There are numerous benefits to creating thiscentralized information store, ranging from asimplified report generation process – the result of asingle interface – to an improved feedback loop,allowing for precise tuning of existing securitymeasures. A firewall, for instance, may be modifiedto be more restrictive once the data that it protects islearned to be extremely sensitive. It is thecombination of DLP and the enVision platform thatmakes this type of holistic analysis feasible.FEATUREBENEFITOut-of-the-box integration of RSA Data Loss–Enrich SOC environment in real time withbusiness sensitivity metrics.–Discover sensitive data and all relatedinformation to enable action on faultybusiness processes–Prioritize and remediate security incidentsby information sensitivity–Execute data movement forensics includinguser access activity, data movement, asset &information criticality.Prevention with the enVision event streamReport security violations by user,department, information and infrastructureQuery user or asset incidentby information sensitivity6RSA Solution Brief
ConclusionThe integration of RSA Data Loss Prevention and theRSA enVision platform combines the powerfulanalysis, correlation, and reporting features of theenVision platform with the comprehensiveinformation discovery capabilities of RSA DLP.Together, RSA DLP & the RSA enVision platformbecome part of a compelling solution to deliverbusiness-centric information security. By enhancingtraditional auditing methods with content-awareinformation discovery, customers can gain criticalinsight into where their sensitive data lives and howwell it is being protected, allowing them to fine-tunecontrols and report on access more effectively thanever before.RSA Data Loss Prevention Suite and RSA enVision togethercan identify business risk and report on it in the most efficientway possible. DLP events are natively sent to the RSA enVisionplatform to streamline the process of understanding securityrisk across information, identities and infrastructure.Policies and classificationtemplates are configuredin DLPDLP Enterprise Managerreceives events when policiesare violated and forwardsthem to the enVisionplatform as they occurSecurity operations teamreceives the alerts and takesnecessary actions to reducebusiness riskThe enVision platformcollects, analyzes, correlatesand alerts on events frommany sourcesRSA Solution Brief7
RSA is your trusted partnerRSA, The Security Division of EMC, is the expert ininformation-centric security, enabling the protectionof information throughout its lifecycle. RSA enablescustomers to cost-effectively secure critical informationassets and online identities wherever they live and atevery step of the way, and manage security informationand events to ease the burden of compliance.RSA offers industry-leading solutions in identityassurance & access control, encryption & keymanagement, compliance & security informationmanagement and fraud protection. These solutionsbring trust to millions of user identities, thetransactions that they perform, and the data that isgenerated. For more information, please visitwww.RSA.com and www.EMC.com. 2009 RSA Security Inc. All Rights Reserved.RSA, RSA Security, enVision and the RSA logo are either registeredtrademarks or trademarks of RSA Security Inc. in the United States and/orother countries. SharePoint and Microsoft are registered trademarks ortrademarks of the Microsoft Corporation in the U.S. and/or othercountries. EMC is a registered trademark of EMC Corporation. All otherproducts and services mentioned are trademarks of their respectivecompanies.DLPENV SB 0409
What is RSA Data Loss Prevention? The RSA Data Loss Prevention (DLP) Suite is an integrated suite of data security products that provides a proactive approach to managing your business risk associated with the loss of sensitive data. Together, the RSA DLP Datacenter, Network and Endpoint modules, which comprise the DLP Suite, create a .
- RSA Archer eGRC Suite: Out-of-the-box GRC solutions for integrated policy, risk, compliance, enterprise, incident, vendor, threat, business continuity and audit management - RSA Policy Workflow Manager: RSA Data Loss Prevention and RSA Archer eGRC Platform - RSA Risk Remediation Manager: RSA Data Loss Prevention and RSA Archer
Each RSA number is a semiprime. (A nu mber is semiprime if it is the product of tw o primes.) There are two labeling schemes. by the number of decimal digits: RSA-100, . RSA Numbers x x., RSA-500, RSA-617. by the number of bits: RSA-576, 640, 704, 768, 896, , 151024 36, 2048.
RSA SecurID for Windows logon BlackBerry software token Site-to-user authentication SAML 2.0 co-authors 2001 - 2002: SMS authentication Palm Pilot software token Windows Mobile software token 1986: Time-synchronous OTP (RSA SecurID) 1977: RSA Algorithm RSA Identity Assurance Apple Face ID Apple Watch 2015: 1996: RSA SecurID software token 2006 .
Marten van Dijk RSA Laboratories Cambridge MA marten.vandijk@rsa.com Ari Juels RSA Laboratories Cambridge MA ari.juels@rsa.com Alina Oprea RSA Laboratories Cambridge MA alina.oprea@rsa.com Ronald L. Rivest MIT Cambridge MA rivest@mit.edu Emil Stefanov UC Berkeley Berkeley CA emil@berke
RSA NETWITNESS LOGS AND RSA NETWITNESS NETWORK RSA NetWitness Logs and RSA NetWitness Network provide security visibility across your infrastructure, from on-premises data centers to public cloud services. It captures real-time data from logs and network packets, as well as NetFlow data, and applies deep analytics, machine learning, UEBA and threat
To generate the RSA certification you’ll execute the crypto key generate rsa modulus command followed by the modulus keysize which ranges between [360-2048]. As shown below, an RSA certificate is generated using a 2048 bit modulus key. R1(config)#crypto key generate rsa modulus 2048 You’ll notice that immediately after the rsa general keys .
Generates a RSA key pair and exports it Session ID, public exponent and modulus length Status and key data RSA key generation, no store and cipher Generates a RSA key pair and exports it in VIS format Session ID, public exponent, modulus length and the exporting key ID Status and ciphered key data RSA private Performs a RSA private encryption .
crypto key generate rsa Example: Step5 RSA key pair. Generating an RSA key pair for the device automatically enables SSH. Device(config)# crypto key generate rsa We recommend that a minimum modulus size of 1024 bits. When you generate RSA keys, you are prompted to enter a modulus length. A longer modulus length might be more secure, but it
