Self Defending Networks (MARS)

Security Monitoring for Threat Identification, Mitigation and Compliance

At Gazzola.com we specialise using Cisco’s Security Monitoring, Analysis and Response System (MARS) appliances.  It provides security monitoring for network devices and host applications supporting both Cisco and other vendors. Security monitoring with MARS greatly reduces false positives by providing an end-to-end topological view of the network, which helps improve threat identification, mitigation responses, and compliance.

Features of Cisco Security MARS:

• "Learns" the topology, configuration and behaviour of your environment
• Automatically updates knowledge of new Cisco IPS signatures, for up to the minute reporting on your environment
• Promotes awareness of environmental anomalies with network behaviour analysis using NetFlow and syslog
• Provides simple access to audit compliance reports with more than 150 ready-to-use customizable reports
• Makes precise recommendations for threat mitigation, including the ability to visualize the attack path and identify the source of the threat with detailed topological graphs that simplify security response at Layer 2 and Layer 3
• Integrates with the Cisco Security Manager to correlate security events with the configured firewall rules and intrusion prevention system (IPS) signatures that can affect the security event.

Gazzola.com has successful experience helping their customers implement a robust MARS deployment.

Important Information and Benefits of MARS

The Cisco Security Monitoring, Analysis, and Response System is an appliance-based, all-inclusive solution that provides unmatched insight and control of your existing security deployment. Part of Cisco’s security management lifecycle, Cisco Security MARS empowers your security and network organizations to identify, manages, and counters security threats. It works with your existing network and security investments to identify, isolate, and recommend precise removal of offending elements. It also helps maintain internal policy compliance and can be an integral part of your overall regulatory compliance solution.

Security and network administrators face numerous challenges, including:

• Security and network information overload
• Poor attack and fault identification, prioritization, and response
• Increases in attack sophistication, velocity, and remediation costs
• Compliance and audit requirement adherence
• Security staff and budget constraints

Cisco Security MARS addresses these challenges by:

• Integrating network intelligence to modernize correlation of network anomalies and security events
• Visualizing validated incidents and automating investigation
• Mitigating attacks by taking full advantage of your existing network and security infrastructure
• Monitoring systems, network, and security operations to aid in compliance
• Delivering a scalable appliance that is easy to deploy and use with the lowest total cost of ownership

Cisco Security MARS transforms raw network and security data into intelligence that can be used to subvert valid security incidents and maintain compliance. This easy-to-use family of threat mitigation appliances enables operators to centralize, detect, mitigate, and report on priority threats using the network and security devices already deployed in your infrastructure.