Micromuse extends to security management

Micromuse has launched a console that manages alerts from different security devices at the ComNet networking exhibition in Washington. Netcool for Security Management is based on Micromuse's Netcool OMNIbus fault-management platform, but monitors alerts from virtual private networks, firewalls, antivirus programs, authentication mechanisms, intrusion detection systems and environmental and physical security applications. Micromuse is known for fault management and service assurance. "But our core technology is not limited to that bucket," said Ed Young, director of strategic solutions at Micromuse. "At the end of the day, an event is an event. The product can consolidate alarms to a single console from intrusion detection systems, firewalls, public key encryption and other systems." It correlates and prioritises information, helping to find the root cause of breaches, he said. The first user announced is a US-based managed security service provider (MSSP) called Clean Systems, which monitors security for multiple customers. "Our global security operations responsibilities span a diverse set of network and security devices, systems and application elements," said Jeff Oliveto, vice president of operations at Clean. "Each element typically has its own proprietary network management system." He said the product allowed Clean to build rules and attack signatures quickly to improve real-time security monitoring. Although consolidating security alerts is an obviously useful job, which must have occurred to anyone aware of the diversity of security devices on the market, the job of integrating has not been done until now because of the lack of standards. The large network management players, Computer Associates and Tivoli, do some security management, but have not taken the approach of event monitoring, as that is not their main strength, said Young. Micromuse has had a firewall monitoring product Netcool/Firewall since 1998. The new product starts with the ability to consolidate data from a comparatively small range of sources: Check Point firewalls, Cisco Pix firewalls and IDSs, System log files, hardware VPN devices from Asita, Niksun NetDetector intrusion detection and network surveillance systems, Network Associates Sniffer data and Johnson Controls card security systems. Micromuse also monitors for Internet protocols such as HTTP and HTTPS, Radius, SMTP, POP3, and IMAP. Two versions of the product will be sold -- a full version for new customers costing around £100,000 and an overlay/add-on, for customers of Micromuse's existing Netcool/Omnibus product, which has no published price yet. To back up his claims of the versatility of Netcool, Young cited Tesco, which has customised the fault management product to monitor its freezers. In future releases, the company plans to add agents for more security devices, and deliver a mobile agent, which will be able to scramble data on PDAs remotely when they go missing. Other plans include the ability to customise the front end, adding specific filters and views, as well as more options in the reports. Netscreen is also a Micromuse partners. The product will be available from March on Sun Solaris or Hewlett-Packard's HP-UX.

---