Slashdot Mirror
Cisco Security System Shuts Out Third-Party Tools
alphadogg writes "Cisco has finally publicly acknowledged it won't add support for new third-party devices to its security information and event monitoring appliance, ending months of speculation about the future of its Monitoring, Analysis and Response System. Some claim it's the beginning of the end for MARS as a multi-vendor SIEM device. 'MARS customers can expect non-Cisco network device data and signature updates to continue for currently supported third-party systems, but no new third-party devices will be added,' Cisco declared in a statement, noting that 'Cisco MARS continues to focus on supporting Cisco devices for threat identification and mitigation.' Cisco's SIEM competitors this week have eagerly grabbed at the topic of Cisco MARS freezing third-party support because of a Gartner research memo published Oct. 29 in which analyst Mark Nicolett stated, 'Cisco has quietly begun informing its customers of a decision to freeze support for most non-Cisco event sources with its [MARS].'"
Cisco only supports Cisco. No Standard interfaces, nothing. Once they get in your shop, you are forced to buy other Cisco devices and Software to work with them.
Try something that works WITH you as a SECURITY appliance, as opposed to yet another sales opportunity. There is lots of competition that easily beats MARS in functionality, ease of use and comprehensive support. TriGeo, for one.
Learning HOW to think is more important than learning WHAT to think.
Since SIEM equipment is typically used to consolidate alert and event data from multiple vendor sources...
Isn't that quaint! All these demands by the government to secure and protect critical "cyber"-resources, and here we have a major vendor basically giving the middle finger to that initative, making it more expensive and difficult to accomplish that objective. Once again two government initatives are at odds with each other: You have the DMCA and copyright advocates on one side, who have made overriding vendor lock-in by creating interoperability illegal, and national security interests on the other side asking ISPs and internet-connected networks to be secure.
#fuckbeta #iamslashdot #dicemustdie
Cisco doesn't allow legitimate owners of their hardware to apply security patches without an exorbitantly expensive software subscription. I found this out when I purchased some of their hardware on ebay for self-study purposes. Personally, I think that's a bigger issue. It means that many individuals and small businesses out there are probably running outdated, insecure versions of their software. Not good!
Security patches should be freely available for the good of the whole Internet community.
I've been a MARS admin/user for a few years and this is not a surprise at all. I have first generation hardware - right after the purchase, Cisco announced that they no longer provide software updates for 1st gen machines, trying to push new hardware down customers throats, so for about a year I was unable to patch or update my environment. Finally they gave in last year and started supporting both 1st and 2nd generation hardware again (I assume because customers were running away from their sinking MARS ship).
This announcement is not a surprise at all since they've been pushing netflow like crazy, however a true event management solution should not be vendor centric to begin with. It's a pain to get MARS to take in events from Windows machines for example, or accept and manage events from other sources, so the announcement that that will no longer continue the non-existent support they had before is a non-sequitur.
Apparently the mentality at Cisco now is that if they paint a box green and write Cisco on it, people will buy it.
Cisco is not "shutting out third party tools," they are simply stopping official support of third party (non Cisco) devices and applications - they are not shutting anyone out.
However, this does cause some issues as SIEM platforms are meant to be multi-vendor, multi-platform security management solutions and the fact that Cisco will not support third party devices any longer does not bode well for their customers or the long term viability of the MARS offering.
A SIEM platform or any other security or performance management platform, like OpenView or SCOM, needs to have software that can "talk" to the managed system. Every device manufacturer, OS, application, database, etc. has a different API or way to collect logs - some have a standard event format or collection mechanism, but, many do not.
In order to officially support collection of these logs a SIEM vendor has to test their collection method against those devices or applications, which is a very expensive and time consuming process. As third party vendors (i.e. Microsoft) release new versions of their platforms (i.e. Windows 2008 vs 2003) the management platform also has to retest their monitoring against those new versions.
Oftentimes, the new third party version breaks the existing management capability, therefore, the management vendor has to go back and redesign how they "talk" to the platform.
Cisco has simply stated that they are no longer willing to support non Cisco platforms as part of their SIEM offering. There are plenty of other SIEM platforms out there that do support non native platforms, such as ArcSight, NetIQ, RSA, etc.
It sucks that Cisco customers now have to look for another solution for non Cisco devices, but, this is great news for other SIEM vendors as Cisco, by way of their huge client base and marketing clout, were able to amass over 4,000 customers for their SIEM offering. Many of these customers will now look for another SIEM vendor.
You heard it here first: Cisco is end-of-life'ing this product line.
Everyone in the industry heard it hear last -- it's common knowledge.
Cisco's channel already knows to stop selling it. Do you really think they would make changes like this unless it was due to pulling engineers off the product? They're not going to sell another subscription to MARS after this, and that's okay with them ... so quit freaking out.
But, he is _aware_of_Cisco's policies now, and the rest of the list is better informed.
Cisco has partnered with SenSage to cover the non-Cisco log sources. DISA is implementing this solution as we speak.
Well over a year ago, the Cisco MARS started supported the notion of parser templates that could be imported and exported. Cisco also created a web site for exchanging said parsers. So, in theory a lot of 3rd party devices could be supported by the community of users (and vendors). It's not bad idea really, but no one uses it and frankly...I'm buying a commercial SIM so *I* don't have to do all that work. There is also the problem of 3rd party devices that don't normally use syslog or traps (Checkpoint, for example). Ultimately, the whole point of paying for a commercial SIM is to get a product that can scale and understands and accurately categorizes events across all your relevant systems, not just your routers, switches and IDS/IPS. MARS scales reasonably well (albeit 1/3 of what the specs say), but has never done well with parsing events from even Cisco devices.
Without 3rd party support, MARS is not a SIM...it's just a really expensive syslog aggregator + SDEE.