Collaboration does not come easily to security professionals. There are many understandable reasons for our collaborative hesitancy that go back a long way.
There was security through obscurity, the misguided belief that if we didn’t talk about our environment and infrastructure, we’d be safer because people didn’t know much about our potential weaknesses. There’s the feeling of embarrassment in sharing information about failures in effectiveness within our own organizations.
Or there’s the ultimate humiliation and frustration of suffering a breach, regardless of the sophistication of our defenses and preparedness.
Moving Forward With Collaboration
We have taken some steps in the direction of collaboration. Information Sharing Analysis Center (ISAC) organizations across industries were quite pioneering and have grown in influence. There are definitely more CISOs and security professionals willing to open up and discuss their success and challenges at industry events. There are even platforms such as the IBM X-Force Exchange, set up for the sole purpose of sharing and disseminating threat intelligence among like-minded groups.
But even with these signs of progress, it still feels like hacktivist groups and cybercrime organizations are well ahead in their pursuits due to collaboration and teamwork.
IBM Security and Check Point Software have worked together for a long time, but we now have a bigger purpose for security collaboration: Our goal is to expand collaboration between our two organizations and our products and services to help our mutual customers accelerate their threat protection. These new areas of collaboration and service investments aim to improve visibility, reduce complexity and extend the value of security investments.
Sharing Threat Research
Our first focus area of collaborative defense is in threat research. We’ve joined forces by having researchers from both companies share early-stage threat identification to corroborate and speed analysis.
Check Point’s Threat Cloud and IBM’s X-Force teams are collaboratively using the cloud-based X-Force Exchange platform, leveraging its private collections feature. Developed and validated threat intelligence will be released to the public on X-Force Exchange, available via STIX and TAXII open standards, as well as through each company’s respective product threat feeds. Our initial collaborations are very promising.
In the area of security intelligence and threat protection, we’re improving the collaboration and automation between two premier platforms: Check Point’s Next Generation Threat Protection and IBM’s QRadar SIEM. We’ve recently expanded QRadar’s out-of-the-box integration for Check Point to support the full breadth of its capabilities, including threat emulation, antibot, antivirus, IPS and DLP blades.
Additionally, Check Point will soon be joining the IBM Security App Exchange with a new QRadar App that will fully integrate Check Point’s SmartEvent capability within the QRadar graphical user interface. This will allow users to provide network policy changes and analysis from their standard security operations center (SOC) interface of QRadar.
Collaborative Efforts in the Mobile Space
Collaboration also extends to the mobile world via cloud-based management and threat protection. Check Point is rolling out new integrations between IBM MaaS360 Enterprise Mobile Management (EMM) and Check Point’s Mobile Threat Prevention (MTP). This integration provides simplified deployment of MTP, with visibility to all devices and apps managed by MaaS360, risk scoring of devices and remote configuration and management.
In a future release — expected in spring 2016 — MTP will provide automated mobile remediation by triggering MaaS360 to remove or quarantine risky or potentially malicious apps.
The final area of collaboration between our organizations is the one where it all began 18 years ago: providing managed security services (MSS) based on Check Point’s groundbreaking firewalls.
The IBM MSS team leverages our eight global SOCs and extensive operational experience to provide mutual customers the best experience from Check Point’s threat protection technology. As customers’ network environments have become more complex — and threats more sophisticated — we will continue to collaborate to provide the best MSS experience for Check Point customers around the world.
Security is proving to be best played as a team sport, with trust and open communication among fellow players a best practice for winning. We’re taking the next step in collaboration and are thrilled to have Check Point as a security partner to join and support this new ecosystem.
Program Director, Business and Corporate Development, IBM Security and Mobile