QRadar and Ward Solutions’ advanced Security Operations Centre –…

Welcome to the third and final blog in Ward Solutions’ QRadar Masterclass! In this blog we’ll take a look at the powerful analytical functionality that the QRadar platform offers, which is monitored and managed from Ward’s state-of-the-art Dublin-based Security Operations Centre.
Do you know what one of the leading causes of data breaches is? Complacency – i.e. thinking that your business is safe from digital threats even when it’s not. A recent Juniper Research study found that 75% of organisations feel secure, even though 50% have been attacked.[1] Complacency or lapses in security practices can result in critical assets not being as secure as they should be. In order to mitigate the fallout of a potential breach, organisations need to employ solutions that are capable of monitoring their whole network, while avoiding blindspots.
QRadar spots anomalies that might otherwise have been missed
By monitoring the whole environment, QRadar from Ward can spot anomalies, such as changes in regular user behaviour. A change in the regular behaviour of users or identities is often one of the first signs that the network has been breached, and, perhaps, that someone’s credentials have been compromised.
QRadar can also help rule out false-positive results by pulling data from organisational identity systems, allowing Security Operations Centre (SOC) analysts to see a recent reporting or role change for the individual.

Advanced analytical processes
Ward Solutions’ managed security services are delivered from our state-of-the-art Dublin-based SOC, in which we invested €1.2m just last year. This facility enables us to provide best-in-class threat monitoring, risk assessment and incident response technologies to our clients. It is from Ward’s SOC that QRadar’s advanced analytical processes are monitored. These include:
 
Advanced threat detection
QRadar employs real-time analytics to raise alerts for suspect behaviour such as the transfer of abnormally high data volumes deviating from behavioural baselines and sudden changes in network traffic. Anomalies are not easily spotted by security teams, and are only discoverable by a security solution that monitors and profiles the actions of all users and entities.
Critical data protection
QRadar can create a high-priority alert to prompt SOC-based security teams to investigate incidents related to processes acting on any data classified as critical.

Insider threat management
QRadar stands out from other security products for its ability to profile entities and individuals and identify abnormal behaviour on the network.
The combination of a comprehensive set of data, business context and threat intelligence—coupled with the ability to detect deviations from normal behavior as well as recognise what behavior is not allowed or is inappropriate—provides for an extremely powerful incident detection capability.
Risk and vulnerability management
When a new entity, such as a server, appears on the network, QRadar can trigger a scan to discover if it has any urgent or high-risk vulnerabilities that are exposed to potential threat sources. If any vulnerabilities are detected, QRadar can then notify the security team to prioritise the issue, thereby reducing the threat of a breach further down the line.

Unauthorised traffic detection
Since many organisations now permit employees to connect personal devices to the WiFI network, it can be difficult to identify any unauthorised devices that might attempt to connect. QRadar can detect potential threats—such as a jailbroken device, suspicious applications installed on a device, or potentially malicious Internet communications—and then trigger quarantining of the device and/or escalation to the appropriate security team for action.
Forensics investigation and threat hunting
In the event that a breach occurs, and malicious software is installed on your business network, QRadar’s advanced threat hunting functionality can help your security team to reconstruct the intrusion step-by step.
What’s more, the forensics workflow enables analysts to quickly and easily build a rich profile of the malicious software and piece together the infection paths through link analysis to identify “patient zero” and any other infected parties. As a result, the security team can quickly remediate the damage and help minimise recurrences.
Ward Solutions’ Security Operations Centre
Ward’s SOC is staffed by a team of information security engineers and consultants who protect businesses through prevention, analysis, detection and rapid response to a growing level of cyber threats on a 24×7 basis. The SOC uses best of breed security platforms and is underpinned by a set of operational, analytical and business technology processes and procedures, meaning that security issues are quickly and efficiently dealt with.
 
Contact Ward Solutions for a chance to win free security services worth €3,000 
Thanks for reading our series of QRadar blogs! If you haven’t done so yet, there’s still time to sign up for a chance to win a QRadar trial. For more information on how you can take advantage of the QRadar platform and Ward’s managed service expertise contact us today. Visit www.ward.ie or call +353 1 6420100.
[1] Talk Talk Business White Paper, http://response.talktalkbusiness.co.uk/Cyber_Security_White_Paper_Download