Cloud Product Management Through Dynamic Policy Objects

Fortinet Korea has unveiled an industry-first NOC-SOC solution developed for specific purposes such as IT operations workflows, analysis, and automated response procedures covering the entire spectrum of IT operations and security response processes.

Based on the Fortinet Security Fabric architecture, Fortinet introduced management and analysis solutions for NOC (Network Operations Center) and SOC (Security Operations Center) purposes, incorporating the latest features of FortiManager 6.0, FortiAnalyzer 6.0, and FortiSIEM 5.0.

The new NOC-SOC solution provides enhanced security operations visibility by offering a new 'Security Fabric' topology view through the GUI, and delivers extended capabilities to manage Fortinet security products operating in private and public clouds through dynamic policy objects.

The Security Rating capability combines the analysis functions of FortiGate, FortiAnalyzer, and FortiManager with the threat intelligence services of FortiGuard to enable quantification of the security configuration status of security devices. This rating capability includes customized audits based on the network environment, industry benchmarking, extended audit rules, and risk scores.

The IR (Incident Response) tracking function automates event response procedures across silo business systems by integrating pre-defined event conditions (system events, threat alerts, user and device status) or ServiceNow IT Service Management (ITSM), which is a security incident management system.

The NOC-SOC solution presented by Fortinet is more than a simple product; it is a solution that enhances the level of visibility, control, and operations management by integrating the entire security operations process domain. It incorporates the latest features of FortiManager, FortiAnalyzer, and FortiSIEM, combining NOC operational context such as appliance status, network performance, and application availability with SOC security insights such as breach detection, data loss prevention, and compromised host identification. These workflow management and automation capabilities bridge previously disconnected functions and enable more seamless operations by allowing each team to comprehensively review views from different perspectives.

Under this model, once a threat is confirmed, the SOC team gains real-time visibility into all assets and their current status, immediately identifies the threat scope, and automatically executes measures to minimize damage.

The latest version of Fortinet's centralized security management solution, FortiManager, integrates FortiAnalyzer management capabilities to provide a single pane-of-glass view perspective and data, control, and analysis functions for NOC and SOC operations.

FortiSIEM proactively discovers and adds newly connected assets while comprehensively reviewing the operational context of the entire configuration management database (CMDB), including accurate up-to-date status for all assets. The security team can graphically view at a glance the current assets, status, and security threats, and leverage the advantages of Fabric Topology within FortiManager and FortiAnalyzer. The integrated view of operations and security in the NOC-SOC solution enables automated execution and helps the security team take actions more quickly and efficiently.

The Security Rating capability continuously evaluates Security Fabric elements to quantify the implementation status of optimized security policies and provides recommendations for improving overall NOC and SOC operations. Additionally, FortiAnalyzer tracks Security Ratings over time to show trends, demonstrates the ROI of security planning, and enables comparison of security status and peer organizations at a glance based on scale or region.

John Maddison, Senior Vice President of Product and Solution at Fortinet, stated, "Security and IT teams are facing challenges due to limited resources, while the scope and complexity of workloads and cyber threats continue to increase. The industry faces a shortage of cybersecurity talent, but as maintaining operational efficiency and security effectiveness is critical to digital business, a new approach that integrates SOC workflows and response automation into the NOC to enhance visibility and control is required. Fortinet is launching a customized NOC-SOC solution that bridges the gaps between IT domains to realize comprehensive and automated security response."