Analysts Reports: Enterprise Security Management & Log Management
 |
Security Information and Event Management Complement Identity and Access Management Audits August 13, 2007 (Must subscribe to Gartner to access full report.) Security information and event management (SIEM) user activity monitoring and identity and access management (IAM) audit and reporting functions are complementary. Broadscope user activity and resource access monitoring is needed for compliance reporting, breach detection and fraud detection. |
 |
Trends 2007: Physical And Logical Security Convergence August 17, 2007 (Must subscribe to Forrester to access full report.) The integration of enterprise physical security controls and management regimes with enterprise IT security architectures is a nascent trend that has been forecast as imminent for several years. But despite the clear benefits to be gained from increased overall enterprise security risk management, the convergence trend is sluggish in taking hold among enterprises. Lack of clear exemplar converged architectures and a dearth of rich convergence-oriented vendor offerings are part of the reason. But the federal government's HSPD-12 initiative and key recent vendor announcements suggest that the convergence trend might finally be gaining some momentum. |
|
Chief Privacy Officers Coordinate Enterprise Data Protection August 7, 2007 (Must subscribe to Forrester to access full report.) Forrester recently interviewed 21 chief privacy officers (CPOs) to better understand the roles and responsibilities of their positions. We found that the CPO role is primarily employed by organizations for three specific areas of responsibility: 1) setting corporate strategy and policy; 2) educating employees and third parties; and 3) assessing the effectiveness of the organization's privacy protection. |
|
Addressing HIPAA Security, Part 1: The Standards June 26, 2007 (Must subscribe to Gartner to access full report.) Covered entities and other affected organizations must comply with the Health Insurance Portability and Accountability Act Security Rule. This rule has a great deal of built-in flexibility, so the key is to build a defensible position of compliance. |
 |
Making the Most of the Convergence of IT Risk and Operations Management June 2007 (Must subscribe to Enterprise Management Associates to access full report.) IT spending is a constant, essential to keeping up with a pace of change that determines competitive advantage in today’s technology-dependent world. Yet the security and compliance spend is dictated, not by strategic business priorities, but by external demands—and the investment is constant, since the risk posture changes continually. How can the enterprise balance its investment in managing these risks with the need to preserve resources essential to maintaining competitive advantage? http://www.emausa.com/research/ema_product.php?product=4500_1373 |
|
Defining An Effective Security Metrics Program May 16, 2007 (Must subscribe to Forrester to access full report.) In a recent survey, Forrester found that the majority of security metrics programs are still in their infancy or planning phases. The respondents cited two main challenges in developing their metrics programs: finding the right metrics and translating the security metrics into business language. A lot of security managers are focused on gathering and reporting tactical and status update information. http://www.forrester.com/Research/Document/0,7211,42354,00.html |
|
Security Information and Event Management Magic Quadrant May 8, 2007 (Must subscribe to Gartner to access full report.) Funding for security information and event management (SIEM) technology deployments is driven in large part by the need to quickly address regulatory compliance issues, but most organizations also want to improve security monitoring capabilities. An optimal solution will support the real-time collection and analysis of log data from host systems, security devices and network devices; will support long-term storage and reporting; will not require extensive customization; and will be easy to support and maintain. |
|
What's Top Of Mind For CISOs In 2007 April 17, 2007 (Must subscribe to Forrester to access full report.) Most CISOs today are optimistic about their security controls and feel confident that they are equipped to adequately handle the majority of their organizations' security issues. They also find that executive management is more aware of security threats, and they're finding it easier to get the budgets to deploy security controls. http://www.forrester.com/Research/Document/0,7211,42050,00.html |
|
Calculating The Cost Of A Security Breach April 10, 2007 (Must subscribe to Forrester to access full report.) Trying to determine the cost of a data breach is no easy task. After calculating the expenses of legal fees, call centers, lost employee productivity, regulatory fines, stock plummets, and customer losses, it can be dizzying, if not impossible, to come up with a true number. In reality, there are many different factors that should be part of the data breach cost calculation — and it's more than just losing money. http://www.forrester.com/Research/Document/0,7211,42082,00.html |
|
Successful GRC Strategy Requires A Federated Approach April 9, 2007 (Must subscribe to Forrester to access full report.) Faced with complex, dynamic, and distributed business operations, organizations are turning to a structured approach for governance, risk, and compliance (GRC) to manage their business environments. This involves implementing a federated GRC organizational structure where enterprise risk and compliance are aligned centrally with corporate governance and reporting but are distributed to lines of business to assign ownership and accountability for risk and compliance. http://www.forrester.com/Research/Document/0,7211,42005,00.html |
|
The Top 10 Things You Should Know About PCI Compliance March 23, 2007 (Must subscribe to Forrester to access full report.) Visa and MasterCard released the Payment Card Industry (PCI) Data Security Standard (DSS) two years ago to ensure consistent security standards for the protection of credit card data. Since then, American Express, Diners Club International, Discover Bank, and JCB International Credit Card have also endorsed the standard and are asking their customers to adopt it. http://www.forrester.com/Research/Document/0,7211,41871,00.html |
|
2007: The Year Of Security Services How Security Service Providers Can Help CISOs March 23, 2007 (Must subscribe to Forrester to access full report.) Entering 2007, chief information security officers (CISOs) face a siloed security monitoring, measurement, and auditing environment as well as an increased responsibility for protecting the organization's information assets. The challenge of targeted and complex threats and their increased frequency will also contribute to their angst. http://www.forrester.com/Research/Document/0,7211,41955,00.html |
|
Defining A High-Level Security Framework January 18, 2007 (Must subscribe to Forrester to access full report.) A comprehensive security framework boils down to three familiar basic components: people, technology, and process. When correctly assembled, the people, technology, and process elements of your information security program work together to secure the environment and remain consistent with your firm's business objectives. http://www.forrester.com/Research/Document/0,7211,40996,00.html |
|
Intellitactics Offers Metrics Reporting Through Its Enterprise SIM Solution: The Forrester Wave™ Vendor Summary, Q4 2006 December 5, 2006 (Must subscribe to Forrester to access full report.) Intellitactics Security Manager has an excellent reporting interface and a data warehouse that provides organizations with a useful tool for investigating security incidents for security information management (SIM). Its main differentiator, though, is its Security Assurance Metrics (SAM) module, which provides an excellent business-centric view into the effectiveness of the organization’s security posture. http://www.forrester.com/Research/Document/0,7211,40831,00.html |
|
Analytics Roadmap November 2006 (Must subscribe to Enterprise Management Associates to access full report.) In recent months, the company has expanded its analytics capabilities in two valuable areas. In the delivery of reporting directly relevant to regulatory compliance, Security Manager has become for many organizations a primary compliance enabler, directly reducing the cost and level-of-effort impact of compliance implementation. In its depic�tion of the current realities of the enterprise security risk posture, Intellitactics Security Assurance Metrics enhance its executive dashboard capabilities in crisply and effectively communicating the values most relevant and meaningful to executives. This not only enhances consensus on security management priorities, it also communicates clear values of the security investment and management priorities. For Intellitactics customers, these capabilities have done much to enable IT and information security measures essential to managing the risks to information assets, recognized as among the most significant facing the enterprise today. |
|
Articulating the Business Value of Information Security July 21, 2006 (Must subscribe to Gartner to access full report.) Clearly articulating the business value of information security remains one of the major obstacles facing information security managers. The benefits of information security must be translated into business terminology. |
|
Measuring Information Security Through Metrics And Reporting July 7, 2006 (Must subscribe to Forrester to access full report.) Security responsibilities have increased substantially over the past few years. Increasingly, CISOs are managing risk assessments, regulatory compliance, and incident response programs in addition to their traditional responsibilities of managing firewalls, antivirus, and patching. Today, CISOs are grappling with questions like, How do I measure the effectiveness of my security organization? How can I communicate the value of security to senior managers within my organization? http://www.forrester.com/Role/Research/Workbook/0,9126,39824,00.html |
|
Security Controls and Policy Management Defined July 7, 2006 (Must subscribe to Gartner to access full report.) Security controls and policy management automation can improve an organization's external audit posture by linking company policies to recognized best practices and by providing an automated method for measuring compliance. The technology can also reduce the expense of compliance reporting. |
|
Security Awareness: The Missing Link July 6, 2006 (Must subscribe to Forrester to access full report.) Today, organizations spend millions of dollars on technical solutions and process improvements but still feel vulnerable. Security is a function of people, process, and technology working in concert, but often the people aspect of security is ignored. An effective security awareness program goes a long way to address people security and makes organizations look and feel more secure. Organizations must take a structured approach to develop effective security awareness programs. http://www.forrester.com/Role/Research/Workbook/0,9126,39823,00.html |
|
Magic Quadrant for Security Information and Event Management, 1H06 May 12, 2006 (Must subscribe to Gartner to access full report.) Intellitactics is a good choice for organizations looking for deployment flexibility and customization and a broad SIEM solution that has strong event and information management capabilities. |
|
Are We Secure Yet? March 31, 2006 (Must subscribe to Forrester to access full report.) Information security managers around the globe are frustrated. They are struggling to make sense of the reams of data being churned out in today's enterprise environment. http://www.forrester.com/Research/Document/0,7211,39168,00.html |
|
See Information Security Through the Controls and Policy Lens January 24, 2006 (Must subscribe to Gartner to access full report.) Information security officers need to understand their responsibilities from three perspectives, or lenses: architecture, process and controls. The controls lens takes the perspective that information security is a set of controls used to address reasonably anticipated risks. |
|
The Chief Information Security Officer's Guide to Compliance January 12, 2006 (Must subscribe to Gartner to access full report.) An organization's success with addressing regulation will be predicated on successfully implementing an effective risk management program. An organization's success will be measured, however, by its interpretation and addressing of applicable regulation. |
|
Three Lenses Into Information Security January 10, 2006 (Must subscribe to Gartner to access full report.) In the past, most security practitioners understood that policy and technology were their focal points. Today, information security officers need to understand their responsibilities from three perspectives, or "lenses": architecture, process and controls. Security management is maturing. |