Just this week while I was on-site, an IT services company serving a client of mine asked for my help. They needed to know where to put their efforts in securing information. Their customers are varied, with a range of systems and connectivity. For each infrastructure, they wanted to know, where are the highest risks? In one case, there are two connections to the Internet, remote access, mobile users, and a complex web of systems and networks, some with external data sharing.

Where should they focus first?

Fortunately, tools are emerging to automate the analysis. Recently, I tested RedSeal Systems' Security Risk Manager (SRM), which gives analysts and IT managers visual access to the risk state of their information technology.

Originally an appliance-based solution, SRM has become software-only. One version is available on a USB flash drive, allowing consultants and others who require a fully portable analysis system access to all of the benefits of the system -- and there are many.

With the growth of both the importance and the complexity of information technology within an enterprise, the implications for protecting and then managing the security of those systems are great. The challenge in doing that is very high, as well.

For example, the ACLs (access control lists) on a router will determine the kind of traffic that can flow through it to a system. A change in those ACLs will alter the risk profile of all systems connected to the networks that the router joins. Multiply this kind of issue across all of the routers, switches, and wireless LAN access points, together with the client and server operating systems, applications, and their patch levels, and the task seems overwhelming.

Managing risk information

Security Risk Manager takes the configuration information from your infrastructure either by capturing it via SNMP from the devices themselves or by having the configuration files fed to the system. Then, using risk analysis that adjusts to the overall configuration (an approach that RedSeal has trademarked as "Adaptive Risk Analysis"), SRM analyzes the interplay and creates a unified network view similar to what a network management system would show. Expanding on the information in that network map, it augments it with analysis of the best devices to remediate together with suggested solutions for each device.

Beyond the logical network view of the situation, SRM further creates a visualization of high-value, at-risk assets. Using a matrix of values such as the exposure of the asset, the vulnerability, the severity of the vulnerability, confirmation of the vulnerability, impact, and whether or not a patch is available, standard and customized views of the risk profile of the complete infrastructure emerge quickly. Using size, shape, and clustering, the network risk overview provides a ready reference for the areas of necessary focus for IT staff.

When I first saw the system in its early development, I was intrigued and excited by the potential, both for internal IT organizations and for consultants and services companies. The appliance-based product was less attractive for services organizations, so the shift in the product delivery strategy was welcome. Furthermore, RedSeal has continued to refine the system and add support for additional devices.