Verizon adds context, impact to security service

Where previously the managed security service would identify a threat, classify it as high, medium or low and detect whether it was attacking a critical or non-critical system, the risk-correlation enhancement enables the business to also quickly know whether an attack is attempting to subvert the confidentiality, integrity or availability of a system, Nguyen-Duy said, using an industry standard known as the Common Vulnerability Scoring System. By knowing whether the attack is attempting to take down a real-time system such as a mail server or trying to steal confidential information, an enterprise can better know how to respond.

Clients can use an online portal and intuitive user interfaces to create a holistic view of their network, in advance of any threats, Nguyen-Duy said. The online dashboard also gives a quick, easily understood view of incoming threats, he said.

“Threats can be more readily understood, the information is more usable, and clients can use one of our reports or one or their own, or download and import information into another report formats, so they can have a better compliance regime,” Nguyen-Duy said. “In the aftermath of the financial crisis, we expect there will be fewer budget resources to address broader threats and a broader and more expansive regulatory environment. This enables customers to more efficiently address those challenges.”

Risk is defined as the combination of threat and vulnerability, which together make up the likelihood of an attack, multiplied by the impact, which includes financial consequences, regulatory violations and damage to reputation, Nguyen-Duy said. With this new risk-correlation service, all threats are evaluated by Verizon’s Security Event Analysis Machine (SEAM), and that information is relayed back to the client via the dashboard. In some cases, further information is required, and that is communicated via the dashboard as well to provide an easily understood overall assessment of each threat.

“Security personnel get dozens of alerts and they want to look at more critical applications, real-time transactions like mail servers that are vital while the database for spare parts might not be that important,” Nguyen-Duy said.