1

I'm comparing different solutions for PCI-DSS compliance, reading a lot of white papers and brochures regarding RSA enVision, Splunk, LogRhythm, SenSage, ArcSight and OSSEC.

Unfortunately, comparison have been difficult because the lack of details provided by the companies/organizations. So, what are your experiences using these systems? Any advice? Criticism?

Some details:

  • My PCI system will be a small segmented network with 5 hosts, protected by firewalls
  • All machines will be running Linux
  • I decided to write this question after reading this astonishing critic to enVision. Do you agree with those guys?!?

2 Answers 2

4

Whenever I see the term "CMDB" thrown about, my bs detector activates.

According the RSA use case video, the enVision solution will:

  1. Magically "discover" your IT environment by drawing upon your CMDB. Sure.
  2. Magically get messages from your vulnerability scanner what exploits your server is vulnerable to
  3. Process your IDS logs and magically correlate attacks with the vulnerabilities mapped in steps 1 and 2

Not knowing anything about enVision outside of what that video presented, I'm concluding that it's bogus enterprise software that typically gets sold to CIOs who are in the middle of ITIL projects, and that remains on the shelf in 90% of the time. Why?

  • CMDB is the great white whale of the ITIL high priests. Whatever database you have to track things, I'm sure that it isn't a CMDB.
  • After you spend a few years figuring out what RSA defines as a CMDB, how is this tool actually going to find anything? (A: You're going to write lots of scripts and do lots of work. Or hire lots of RSA consultants)
  • How do you correlate whatever your vulnerability scanner is reporting with the crap from you CMDB? (A: You're going to write lots of scripts and do lots of work. Or hire lots of RSA consultants)
  • How do you then automatically correlate attacks against vulnerabilities that were in turn associated with crap from your CMDB? (A: You give up before this stage.)

There's too many moving parts... assuming that the product could work, the resources required to make that happen probably exceed the cost of having someone sit at a desk at stare at syslog output 24x7.

1

Unfortunately, the best solution for PCI-DSS compliance is simply not to process card data yourself.

Not the answer you're looking for? Browse other questions tagged .