Course Description

Internet Security Systems' RealSecure SiteProtector application provides scalable, centralized security management and data analysis capabilities for RealSecure network, served and desktop protection solutions. SiteProtector simplifies large-scale RealSecure deployments through cost-efficient, unified command, control and monitoring, thereby reducing security management demands on staff, network traffic or other operational expenses. Event prioritization and correlation enable real-time attack and misuse tracking.

The SiteProtector interface helps administrators work more efficiently through flexible views built around asset grouping and event aggregation. Powerful filters screen for event exceptions and false alerts. In addition, SiteProtector automates RealSecure Protection System deployment, and enables multiple site management via secure remote administration.

The Introduction to RealSecure Site Protector training course provides concepts, methods and practices necessary to successfully use the SiteProtector management tool. The course focuses on hands-on exercises supported by demonstrations, presentations, and lecture. Starting with an introduction to the SiteProtector architecture and the different components, students will learn about the role of each component and how they act in concert to monitor and protect a real-world network. Students will learn how to install and configure SiteProtector as well as how to manage sensors and monitor network assets in the SiteProtector environment.

Key Instructional Focus and Objectives:

• Describing SiteProtector's system architecture, configuration options, and sensor response capabilities.
• Defining your overall security strategy.
• Explaining different approaches for deploying SiteProtector components on a network
• Migrating data into SiteProtector from RealSecure 6.x databases.
• Using the SiteProtector Console to manage RealSecure components and monitor network assets.
• Working with policies for network sensors and server sensors.
• Using the stand-alone Policy Editor to manage sensor policies.
• Configuring event collectors, network sensors, server sensors, and the security fusion module.
• Using SiteProtector to run a remote network scan.

Key Hands-on Lab Focus and Objectives

• Installing and configuring SiteProtector components: Deployment Manager, Application Server, Site Database, Event Collectors, Network Sensors, Server Sensors, Internet Scanner and Databridge, and the Security Fusion Module.
• Using the SiteProtector Console to connect to and configure RealSecure assets.
• Using the Console to manage RealSecure components and monitor event data.
• Creating Analysis views and data filters.
• Configuring policies and setting up event notification.
• Configuring and customizing sensor policies and responses with the Policy Editor.
• Displaying events and viewing event detail.
• Configuring different types of security events and their responses.
• Working with event propagation.
• Creating user-defined events.
• Running a remote scan.
• Working with correlation events.