What is Snare? [Video]

Not sure what Snare does? Looking for a logging or SIEM solution but not sure how Snare fits? Our own Gene McGowan threw this video together to quickly cover the full gamut of Snare. Want the fastest overview of Snare possible? Watch this video.

https://youtu.be/o2_hc_WF6Ig

If you have any questions or would like to know more just reach out to us!

/by

What We Mean By “Reducing the Noise”

We like to tout Snare’s ability to “reduce the noise” in your logging efforts but what exactly do we mean when we say that and why is it important?

Event logging veterans can probably guess fairly easily that we are talking about the excess data collected by logging solutions, but because collecting everything has been a go-to tactic for so long maybe all that wasteful data bogging down your network and driving up SIEM costs doesn’t seem like noise but an inconvenient but unavoidable by-product. Many more probably don’t even realize how much junk is clogging up their SIEM and network.

Snare started off as the only rock solid log collector that could bring together logs on disparate systems and aggregate them for analysis. In other words you could count on your logs getting collected, something far too many tools still can’t guarantee, and you could see your syslogs and windows event logs in one place. Snare Agents are also agnostic so no matter what SIEM solution you opted to by, if you were having trouble with the logs you can plug and play Snare Agents to solve those problems. SIEM vendors picked up on this and began recommending Snare Agents as a compliment and that is how we took off.

Fast forward a bit and we here at Intersect Alliance wanted to take it a step further. Clients around the globe had a long list of nice to haves, things that would make their SIEM efforts more efficient and more effective. This was the genesis to the premium features you see today. Things like managing audit policy, truncation of windows event descriptive text, and multi-tiered filtering.

Cool, huh? Well, we think so. Our roadmap has filled out and we are excited to continue bringing more premium features to our Snare suite.

/by

PCI DDS Compliance v 3.0

If you’re dealing with any form of payment card data, starting on January 2015, security audits will need to prove PCI 3.0 compliance. Banks, card brands and regulators are stepping up action in the face of recent significant breaches in name brand companies. If you are running the unsupported open source agent for event logging, you will most likely fail your audit as they do not address several key aspects of the PCI DSS V3.0 audit requirements:

1. There is no technical, product, vendor or customer support – i.e. you are on an unsupported security tool/platform.
2. More than half of the critical event log data is in the custom event logs which are not processed by the open source agents, allowing forensic evidence to be lost.**
3. Best Practices, such as event data encryption, TCP protocols and caching in case of network outages or spikes, are not available.
To take a crucial step towards compliance, we encourage you to try the Snare Enterprise Agents, which are used by the world’s leading organizations and enterprises in finance, defense, e-commerce and retail.

Snare Enterprise Agents assist with PCI DSS compliance by collecting all applicable event logs out-of-the-Box.  To learn how the Snare Enterprise agent is used to address PCI, click on PCI DSS Best Practices with Snare Enterprise Agents.

For Snare Server, sample PCI objectives may be loaded. To do this go to SYSTEM\Administrative Tools\Snare Server Configuration Wizard\ and navigate to the section on additional objectives near the bottom of the list.  Select the last option which will import from the local system. Once loaded you will now have the extra objectives in the Reports Menu under Compliance Pack, in there are: NISPOM, SOX and PCI.  From there you can copy/clone these objectives and customise to suit your needs.

 

** Warning about Open Source logging: You risk missing more than half of your critical logs

The Open Source agents will not stand up to compliance or auditing standards (e.g. PCI), with more than half of the critical logs not being captured, including privileged user activity, system and Group Policy changes, dhcp logs, system time changes, host firewall policy changes and access logs, terminal service access, and print logs, just to name a few. Therefore, using open source versions will risk failing audits and will not be able to detect all serious malicious attacks or unauthorized changes on your systems. This can lead to loss of customer data, major brand damage and significant financial penalties depending upon which standard has been failed and the degree of damage caused. There are approximately 70 system event logs which you will not collect details from.

/by

Fear not, Snare is not affected by POODLE

The POODLE attack (which stands for “Padding Oracle On Downgraded Legacy Encryption”) is a man-in-the-middle exploit which takes advantage of Internet and security software clients’ fallback to SSL 3.0.

The Snare Agents are not affected by POODLE as it requires a cookie injection from the client and Snare does not use cookies for our connections.

Since it’s a client side attack, and would need some man-in-the-middle attack on the internal network which is low risk, and given most Snare Servers are on restricted networks, then it is low risk.

For additional information review US-CERT TA14-290A.

/by