FAA Turns to ArcSight for Security Event Management

The Federal Aviation Administration has just finished putting in placea new security event management system designed to help the agencydetect and respond to external and internal threats more efficiently.

The new tool is based on a product from ArcSight Inc. called EnterpriseSecurity Management (ESM) that allows the FAA to centrally monitor,collect and analyze information from multiple network security devicessuch as firewalls and intrusion-detection systems.

The tool is part of a broader FAA bid to bolster its network defensesand incident-response capabilities after the 9/11 terrorist attacks,according to Michael Brown, director of the Office of InformationSystems Security at the FAA.

“We were looking for a way to manage the large volume of informationcoming from multiple [network] sources [and] do a lot of correlationand data reduction,” he said. The goal is to help the agency bettermanage the large amount of information generated by security systems,Brown said.

ArcSight’s ESM, like other products in its class from vendors such asnetForensics Inc., NetIQ Corp., and Intellitactics Inc., is designed tohelp organizations quickly sift through the torrent of data generatedby multiple security devices, allowing them to focus on the ones thatare most important.

At the FAA, for instance, firewalls, system log files, vulnerabilityscanners and intrusion-detection systems together generate more than amillion alerts a day — only a very small fraction of which reallymerit any follow-up, Brown said.

“At the end of the day, after all the analysis has been done, we arelooking at roughly 15 to 20 alerts” that really matter, he said.

Apart from transforming raw event data into actionable intelligence forsecurity and network administrators, tools such as those fromCupertino, Calif.-based ArcSight can also be useful for forensicanalysis after an attack, he said.

Like other agencies, the FAA — which is a part of the U.S. Departmentof Transportation — is also subject to audits by the GovernmentAccountability Office and is required to implement strongincident-response capabilities under the Federal Information SecurityManagement Act.

The new event management capability will allow the FAA to create anauditable security infrastructure to demonstrate compliance with suchrequirements, Brown said.

By Jaikumar Vijayan – Computerworld (US online)