What rocks at RSA? Big data security, active defense.

SAN FRANCISCO — Continuous monitoring is the order of the day for federal IT systems, and automated tools are generating more data about the status and behavior of agency networks. The next challenge, analysts, vendors and government officials say, is making use of all that data.

The expansion of enterprise networks beyond traditional perimeters through cloud services and mobile devices, coupled with the explosive growth in information generated by security tools, is putting a premium on the ability to understand large volumes of data. So big data and data analytics are the big things at the RSA Conference this week.

The growing awareness that sophisticated attacks, usually blamed on Chinese espionage, have succeeded in penetrating many critical industries and government agencies is also making active defense — the practice of reaching out to touch your adversaries — a popular topic this year.

RSA, the Security Division of EMC, proclaims in a recent report that, “Big data holds big promise for security.” It defines big data as data sets too large, unrefined and fast changing for traditional analysis. While making sense of this volume and variety of data can require hundreds or thousands of servers running massively parallel software, it also can produce new insights and enhance decision-making.

A survey of 700 IT security professionals, including some in government, being released at the conference by the Ponemon Institute and Teradata shows a high level of interest in data analysis. Seventy-two percent believe Security Information and Event Management (SIEM) is more effective when combined with big data, although to date adoption has been hindered by a lack of skilled workers and convenient tools.

RSA has been touting the security value of analyzing large volumes of data since its own systems were breached in 2011. It released its Security Analytics tool in January, following the release of InfoSphere Guardium v9.0 for unstructured Hadoop environments by IBM in October. The RSA tool uses the Apache Hadoop open-source framework for data-intensive applications and combines SIEM, network forensics and big data analytics to enable large-scale data collection and analysis. It captures traffic at layers 2 through 7 and indexes metadata in a useable format.

A number of other vendors also are announcing or demonstrating data analytics tools on the conference show floor.

Hewlett-Packard Co. is announcing a pair of offerings that will be available in April. The company is integrating ArcSight’s SIEM capabilities with the Autonomy Intelligent Data Operating Layer server that collects and stores indexed data. Autonomy can analyze data from the Internet for sentiment and context and send it to ArcSight for correlation with security log information to predict attacks. HP also is announcing the ArcSight-Hadoop Integration Utility to allow a better view into event information for identifying security and attack trends.

The company 21CT is featuring its flagship LYNXeon analytic platform, a visualization tool based on intelligence and military research to correlate data. It can use cluster analytics to detect significant relations within social groups and organizations. LYNXeon is used by the Army, Navy, Air Force and Marines, as well as by the Homeland Security Department, to detect attackers and criminal behavior.

The concept of active defense, or offensive cybersecurity, has emerged as an issue in the last two years, said Hugh Thompson, RSA Conference program chair. Three papers were submitted on the subject for the 2012 conference. “Before that we hadn’t gotten anything on it,” he said. Numerous submissions came in this year for presentations in the Law, Policy and Government, Data Security, and Hackers and Threats conference tracks.

Active defense verges on vigilantism. “It’s a euphemism for offensive tactics going outside your own system,” said Dmitri Alperovitch, a co-founder of CrowdStrike and a member of the conference program committee.

That does not mean it necessarily is illegal, but the legal boundaries are not well defined. Active defense can include clearly appropriate activities such as taking down malicious command and control servers through court action and requesting system owners to voluntarily shut down compromised systems. On the other end of the spectrum is hacking or destructive action against an attacker’s computer, which probably would be illegal.

In between is a large gray area that includes recovery of stolen resources and seeding of deceptive information to foil intruders. To date there have been few decisions defining the legal limits of such activity, but the growing number, sophistication and variety of attacks is making proactive defense a necessity, Alperovitch said.

“When the government is failing its responsibility to protect you, you have to take the matter into your own hands,” he said.