Having all the security solutions–even if they’re cloud-based–doesn’t necessarily ensure holistic protection. In the modern enterprise, there are simply too many parallel silos of data. The key is to get the solutions not only to talk to each other, but to leverage one another’s capabilities…in real time.
Last month, I published an article about a new unified security platform called REACT (Realtime Event & Access Correlation Technology). All in all, it received some very positive notices, but also raised some questions as to what exactly the platform is, and why it should matter.
Simply put, REACT is an approach whereby an organization leverages the capabilities of several security solutions into one central correlated repository of security intelligence. For instance, key information from an Access Management tool (such as SaaS SSO logins or views of/modifications on/additions to protected data) can be shared, processed and analyzed through a SIEM correlation engine. When this is done in real time, not only do you expand the centralized visibility, but more importantly any suspicious activity is immediately identified and alerted. When these systems are running in parallel, but not unified, it might be days or weeks before these anomalous instances are discovered and remedied.