High Tower: A Google Sites Site?

For those who have been following the ongoing saga of High Tower's disappearance, the change in their site says interesting things. The site is now hosted by Google Sites, and is simply a logo with no detail.


The SIM vendor's site had remained up until now. Does this mean that the vendor's servers have been turned off? What comes next for customers?

High Tower Topples?

High Tower Software, a SIM/SIEM vendor, hit the news (further coverage on Xconomy and Anton Chuvakin's Security Warrior site) in late November due to a shutdown. Various rumors came out of the company, and Brandon Dunlap's writeup on Brightfly tells a lot of the story. ArcSight jumped in immediately with Google ads, which Dunlap's article shows. LinkedIn showed a flurry of title changes from High Tower employees, as well as a number of recommendations, both of which are often seen when a company shuts down.

High Tower customers, however, were not so well informed, and continue to remain largely in the dark about their disposition of the company. The High Tower website hasn't seen an update since November, and the company's pending release of their newest software version is has not occurred.

High Tower met needs across the SIM/SEM spectrum, and competed with companies like TriGeo and with the industry heavyweights like ArcSight. Where does this leave customers? For the moment, they are left in limbo, albeit with functioning systems.

Log Management: Observations from the Log Management Thought Leadership roundtable webcast

I listened in on WhiteHatWorld's log management roundtable webcast that I mentioned on Monday. The panel provided a few noteworthy tidbits. If you're just starting to look at log management systems, or you are trying to sort out some of the decision points between SIM/SEM and log management devices, you should look for a panel like this. The review of concepts and issues can be useful, and I felt that the panel reflected many of the experiences that I've had. Here are a few of the highlights:

Appliance vs. software - the panel generally supported appliances due to:

• Ease of deployment.
• Ease of use.
• Fixed price, fixed form factor - value is more easily determined.
• Support and updates.

SIM/SEM versus log management

• There is an increasing use of a blended approach - both ends of the market are growing toward the middle.
• Most vendors started at one end, some did analysis, some did log management. They tend to do what they started as best.
  
• Logging versus security - the emphasis is different, as security isn't the only use of logs
• Compliance, forensics, and analysis as drivers for either type of implementation
  

Choosing a solution - a few of the top selection criteria and testing hints were:

• Fit your collection infrastructure to your environment and your requirements. You have options including: agentless vs. agents, multi-level collector/analysis engines, and other design choices. Architecture can have a major influence on performance.
• Remote sites may make agents particularly useful
• The ability to collect different data types flow data, syslog via TCP and UDP
• The ability to scale as your environment or deployment changes
  
• Analysis capabilities and other automated handling. Decide what you need, and what would provide the greatest benefit.
  
• Test and assess the speed of access to data and the ability to search the data. Pay particular attention to indexing capabilities and storage methods
• Be careful of the dangers of looking at single performance specification - vendors often measure under ideal conditions. Real scenario and testing is useful - what happens when features are enabled, UI is in use, and other actual usage models.
• If you're intending to use the system for incident response review your legal requirements such as verifiable chain of custody, validation, and audit.
• The experts suggested reviewing NIST standards such as 800-92
  
• Deploy a proof of concept:
• See how your network actually works.
• Check the items you're logging.
• Remember that space is cheap
  

Finally, a few ways to fail:

• Roll your own and don't carry through leading to failure
• Choose a product based primarily on price or an informal relationship
• Miss important functionality requirements
  

If this sounds useful, their next presentation is their Log Management TLR webcast on March 19, 2008, at 2 PM EST.

Edit, 03/07: you can listen to the recording here.