Earlier this week, HP announced updates to its enterprise security portfolio tailored to better address the threat of advanced persistent threats (APT’s).  By unifying security analytics for Big Data with expanded identity monitoring, they are accelerate an organization’s ability to detect and mitigate these APT’s.  The suite is built to answer the challenges of today’s diverse environments in cloud, mobile, and virtual, it is also built to capitalize on the three V’s of Big data – velocity, volume, and variety – all in an answer to threats that come from within a business and outside its boundaries as well.

At the core, the ArcSight component has been updated to ease the processing of massive amounts of events from the environment.  The product updates include out-of-the-box threat profiles and threat profile intelligence in ArcSight Threat Detector 2.0.  Cloud-ready, closed loop capabilities for accelerated threat detection and response to mitigate APTs are updated in ArcSight Threat Response Manager 5.5.  With HP Arcsight IdentityView 2.5, the update delivers expanded correlation of user identity, roles, and activities across events and security incidents.  All in all, this is a rather compelling and powerful update that addresses the latest advances and techniques in enterprise computing security.  APTs can certainly be sourced from outside or within a company, but it is most important to have the ability to detect and react to these threats with comprehensive tools that can process information quickly.  It’s the kind of thing that keeps security personnel up at night.  This is where actionable intelligence meets actual action.

“Typically batch in nature, big data analytics allows an organization to organize and analyze vast amounts of structured and unstructured information to facilitate the detection of rogue employees, partners, or criminal or collusive rings of fraudulent or abusive activity,” said Avivah Litan, analyst, Gartner. “A critical ingredient for success is the ability to quickly and easily integrate all types of structured and unstructured information across multiple internal and external information sources.”

A little deeper on Threat Detector 2.0, threat profiles come out the box, but it also adds the level of heuristic analysis that builds intelligence about user activity, building patterns from browsing behavior, distributed attack detection and activity profiling.  HP Response Manager 5.5 allows for automated responses to threats, like automatically shutting down a particular account that is under some duress.  This is an important piece of the overall enterprise security value proposition because organizations can set built-in responses without staff intervention, reducing needs in a number of ways and is proactive in nature.  IdentityView 2.5 boasts one of the most unique capabilities in the industry.  This update delivers an insider threat solution that is built from the collection of role data from identity and access management (IAM) systems and combines them with user activity collection from across all your enterprise accounts from applications, systems, user accounts.  This means forensic investigations, better access governance, and better mitigation of insider risks are now possible through an enhanced base of profiles of users activities, especially your privileged accounts and those you choose as high-risk (like CEOs, etc.)

HP continues to bring innovative and powerful enterprise-class developments to the security scene.  This latest announcement is turning the heat on competitors in the field with real-time, Big Data-enabled capabilities that are absolutely focused on the real-world threats in the enterprise today.