Cisco Security MARS Overview
Cisco Security MARS is an appliance-based, all-inclusive solution that provides superior insight into and control of your existing security deployment. Part of Cisco's security management suite, Cisco Security MARS empowers your security and network organizations to identify, manage, and counter security threats. It works with your existing network and security investments to identify, isolate, and recommend precise removal of offending elements. Cisco Security MARS also helps maintain internal policy compliance and can be an integral part of your overall regulatory compliance solution.
Security and network administrators face numerous challenges, including:
• Security and network information overload
• Poor attack and fault identification, prioritization, and response
• Increases in attack sophistication, velocity, and remediation costs
• Compliance and audit requirement adherence
• Security staff and budget constraints
• Cisco Security MARS addresses these challenges by:
• Integrating network intelligence to modernize correlation of network anomalies and security events
• Visualizing validated incidents and automating investigation
• Mitigating attacks by taking full advantage of your existing network and security infrastructure
• Monitoring systems, network, and security operations to aid in compliance
• Delivering a scalable appliance that is easy to deploy and use with the lowest total cost of ownership (TCO)
Cisco Security MARS transforms raw network and security data into intelligence that can be used to subvert valid security incidents and maintain compliance. Cisco Security MARS enables operators to centralize, detect, mitigate, and report on priority threats using the network and security devices already deployed in your infrastructure.
The Defense-in-Depth Dilemma
Information security practices have evolved from Internet perimeter protection to an in-depth defense model in which multiple countermeasures are layered throughout the infrastructure to address vulnerabilities and attacks. Layering is necessary because of increased attack frequency, diverse attack sophistication, and the rapid nature of attack velocity.
Network access points and systems are probed thousands of times each day in an attempt to exploit vulnerabilities. Modern blended/hybrid attacks use multiple and deceptive attack methodologies to gain unauthorized system access and control from outside and within organizations. The proliferation of worms, day-zero attacks, viruses, Trojan horses, spyware, and attack tools challenges even the most fortified infrastructures, resulting in shorter reaction time and costly remediation.
In addition to the number of servers and network devices, each security component offers isolated event log and alert features for anomaly detection, threat reaction, and forensics. Unfortunately, this isolation yields a tremendous amount of noise, alarms, log files, and false positives for operators to discern or effectively utilize. In addition, compliance legislature requires strict data privacy, improved operational security, and documented audit processes.
Advancing Security Information Management and Threat Mitigation
Security information and event management products logically seem to alleviate these problems-helping you measure threats so you can manage them. These products enable operators to centrally aggregate security events and logs, analyze this data through limited correlation and query techniques, and generate alarms and reports about isolated events.
Unfortunately, many first-generation and second-generation security information and event management products do not yield sufficient network intelligence and performance attributes to precisely identify and validate correlated events, specifically determine attack paths, or precisely remove threats. Cisco addresses these security issues and management deficiencies with a family of scalable enterprise threat mitigation appliances. Cisco Security MARS complements your network and security infrastructure investment by delivering a security threat control and containment solution that is easy to deploy, easy to use, and cost-effective. The Cisco Security MARS family of high-performance, scalable threat mitigation appliances fortifies deployed network devices and security countermeasures by combining network intelligence, ContextCorrelation™ features, SureVector™ analysis, and AutoMitigate™ capability, which empower organizations to readily identify, manage, and eliminate network attacks and maintain compliance.Cisco Security MARS tightly integrates with Cisco's premier security management configuration product, Cisco Security Manager. This integration maps traffic-related syslog messages to the firewall policies defined in Cisco Security Manager that triggered the event. Policy lookup enables rapid, round-trip analysis for troubleshooting firewall-configuration-related network issues and configuration errors.
Figure 1. Shows the MARS Dashboard page with a Summary of Current Security Posture
Features and Benefits
Intelligent Event Aggregation and Performance Processing
Cisco Security MARS obtains network intelligence by understanding the network topology and device configurations and by profiling network traffic. The system's integrated network discovery function builds a topology map containing device configuration and current security policies, which enables Cisco Security MARS to model packet flows through your network. Since Cisco Security MARS does not operate inline and makes minimal use of existing software agents, there is little negative effect on network or system performance.
Cisco Security MARS centrally aggregates logs and events from a wide range of popular network devices (such as routers and switches), security devices and applications (such as firewalls, intrusion detection systems [IDSs], vulnerability scanners, and antivirus applications), hosts (such as Windows, Solaris, and Linux syslogs), applications (such as databases, Web servers, and authentication servers), and network traffic (such as Cisco NetFlow).
Cisco ContextCorrelation
As events and data are received, the information is normalized against the topology, discovered device configurations, and same source and destination applications across Network Address Translation (NAT) boundaries. Corresponding events are grouped into sessions in real time. System- and user-defined correlation rules are then applied to multiple sessions to identify incidents. Cisco Security MARS ships with a full complement of predefined rules, frequently updated by Cisco, which identify a majority of blended attack scenarios, day-zero attacks, and worms. A graphical rule definition framework simplifies the creation of user-defined custom rules for any application. ContextCorrelation significantly reduces raw event data, facilitates response prioritization, and maximizes results from deployed countermeasures.
High-Performance Aggregation and Consolidation
Cisco Security MARS captures millions of raw events, efficiently classifies incidents with superior data reduction, and compresses this information for archival. Managing this high volume of security events requires a secure and stable centralized logging platform. Cisco Security MARS appliances are security-hardened and optimized for receiving extremely high levels of event traffic: more than 15,000 events per second or more than 300,000 Cisco NetFlow events per second. This high-performance correlation is made possible through inline processing logic and the use of embedded high-performance database systems. All database functions and tuning are transparent to the user. Onboard storage and continual compression of historical data archives to network file system NFS, and Secure File Transfer Protocl (sFTP) secondary storage devices make Cisco Security MARS a reliable security log aggregation solution. MARS also supports data and configuration backup and recovery via NFS, and sFTP.
Incident Visualization and Mitigation
Cisco Security MARS helps to accelerate and simplify the process of threat identification, investigation, validation, and mitigation. Security staff are often confronted with escalated events that require time-consuming analysis for resolution and remediation. Cisco Security MARS provides a powerful, interactive security management dashboard. The operator GUI provides a topology map that includes real-time hotspots, incidents, attack paths, and detailed investigation with full incident disclosure, allowing immediate verification of valid threats.
Cisco SureVector analysis processes similar event sessions to determine if threats are valid or have been countered by assessing the entire attack path, down to the endpoint MAC address. This automated process is accomplished by analyzing device logs such as firewalls and intrusion prevention applications, third-party vulnerability assessment data, and Cisco Security MARS endpoint scans to eliminate false positives. Users can quickly fine-tune the system to further reduce false positives.
The goal of any security program is to keep systems online and functioning properly-this is critical for preventing security exposures, containing incidents, and facilitating remediation. With Cisco Security MARS, operators have a rapid means to understand all of the components involved in an attack, down to the offending and compromised system MAC address. Cisco AutoMitigate capabilities identify available "chokepoint" devices along the attack path and automatically provide the appropriate device commands that the user can employ to mitigate the threat. The results can be used to quickly and accurately prevent or contain an attack.
Real-Time Investigation and Compliance Reporting
Cisco Security MARS features an easy-to-use analysis framework that simplifies the conventional security workflow, providing automated case assignment, investigation, escalation, notification, and annotation for daily operations and specialized audits. Cisco Security MARS can graphically replay attacks and retrieve stored event data to analyze previous events. The system fully supports spontaneous queries for real-time and subsequent data-mining efforts.
Cisco Security MARS offers numerous predefined reports to satisfy operational requirements and assist in regulatory compliance efforts, including compliance with the Payment Card Industry Data Security Standard (PCI-DSS), Sarbanes-Oxley, Gramm-Leach Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), and the Federal Information Security Management Act (FISMA) in the United States; the EU's Revised Basel Capital Framework (Basel II); and others. An intuitive report generator can modify the more than 100 standard reports or generate new reports for an unlimited means to build action and remediation plans, incident and network activity, security posture and audit, as well as departmental reports-in data, trend, and chart formats. The system also provides for batch and e-mail reporting.
Rapid Deployment and Scalable Management
Cisco Security MARS is placed on a network, where it can send and receive syslog messages and Simple Network Management Protocol (SNMP) traps and can establish secure sessions with deployed network and security devices through standard secure or vendor-specific protocols. No additional hardware, operating system patches, licensing, or lengthy professional service engagements are required to install and deploy Cisco Security MARS. Simply configure your log sources to point to Cisco Security MARS and define any network and source through the Web-based GUI. Cisco Security MARS can also forward syslogs to an external syslog server to integrate with existing network infrastructures.
Cisco Security MARS supports the optional Global Controller appliance which centralizes security Local Controller reporting to provide a single view report aggregation of the enterprise Local Controller environment.
Global Controller Capabilities include:
• Aggregation of reports across the Local Controller deployment
• Defining Rules, Reports and User accounts for Local Controllers (Note: Configuration of Local Controller is done "locally" on the individual LC appliance)
• Remote, distributed upgrade of the Local Controllers
"
Cisco Security MARS 25R (CS-MARS-25R-K9) 
