With three security operations centers worldwide, Ubizen's OnlineGuardian managed security services allow ISPs to provide a unique value added service for their security conscious customers.

by Jeff Goldman [February 13, 2002]

In 1995, a professor and two students in the Department of Computer Science at Belgium's Catholic University of Leuven founded the startup company NetVision, to offer remote management and monitoring of network security devices.

Four years after its founding, with dual headquarters established in Leuven and in Reston, Virginia, the company found that its name wasn't distinctive enough to compete in the international marketplace. In October of 1999, the name NetVision was changed to the more distinctive Ubizen, combining the Latin ubi, meaning where, with both biz and zen.

At first, the company had focused on reselling third party products and creating customized solutions for businesses. Now, according to Nathan Tennant, Ubizen's Product Manager of Managed Security Services, the business is made up of about 50 percent managed security services, 30 percent Ubizen's own software products, and 20 percent reselling of third party products.

Ubizen 75 Murray Street New York, NY 10007 Voice: (703) 391-0375 E-mail: info@ubizen.com

One of Ubizen's own software products is DMZ/Shield. According to Gregg Laroche, DMZ/Shield Product Manager, the product works in concert with other network-level safeguards like firewalls and IDSes, while performing some of the same functions. DMZ/Shield both logs and blocks attacks while they're still out in the demilitarized zone, thereby decreasing the load on your other devices.

"Some analysts call this category of product an application-level firewall," Laroche said. "We prefer the term shield, because we want to maintain distinction from the firewall market. The shield and the IDS work together. The IDS acts as a safeguard to check that things are not slipping through, and the shield lowers the amount of incidents on the network, so your IDSes see as much as 60 percent less traffic."

But the product isn't just about redundancy: DMZ/Shield's (below) analysis is thorough enough that during the Code Red and Nimda attacks, Ubizen's customers were fully protected even prior to the discovery of the worms. DMZ/Shield costs $5,000 for a one-server license; larger volumes are significantly discounted, and ongoing support and upgrades are available for 25 percent of the license fee.

Still, DMZ/Shield is only one small part of Ubizen's offering. In terms of IDS solutions, the company's greatest strength lies in its OnlineGuardian managed security services.

Leveraging experience
Rather than offering its own security solution in competition with the leaders in the market, Ubizen's OnlineGuardian service manages and monitors Cisco, ISS, and Check Point products at the customer's site. Each device is then linked back to one of Ubizen's three security operations centers in the U.S. and Europe.

Information from devices deployed at customers' sites is analyzed in the security operations centers using Ubizen's State Event Analysis Machine (SEAM) technology. "What SEAM enables us to do is to take millions of log events and parse those relatively obscure or unwanted events so that we're only looking at a handful of events that are of concern to us," Tennant said.

Teams at two security intelligence labs in the US and Europe search for new vulnerabilities and attack patterns, then feed that information into SEAM. "With this, coupled with past customer data, we're able to parse out most of the remaining data or log files that we come across so we're only looking at a few key events," Tennant said. "Then our security analysts can take a look at that and decide what action to take."

While Ubizen's professional services team is happy to advise a company on every aspect of their security from square one, Tennant says most customers come to Ubizen with all security measures already installed. "Their main problem is usually an overload of data," Tennant said. "They have all this information, and they don't know what to do with it."

What Ubizen can provide is the ability to look at a customer's log files 24 hours a day, 365 days a year, and pass on to the customer only the important information. A Web-based reporting center allows the customer to view all data in a graphical format that shows past trends, peaks in activity, alerts generated, and how they were handled. Pricing starts at approximately $20,000 per year.

Make it your own
For ISPs, Tennant explains, managed security services from Ubizen can be an ideal value added service. "A lot of ISPs are asking us about our managed security service and how they can make it part of their package," he said. "There's a competitive advantage point for them to do so, and they have the opportunity to make an additional 20 or 30 percent on the recurring service fees every year."

A particular strength of the offering is the fact that Ubizen will build a portal customized to the ISP's look and feel. "When a customer wants to check on what their firewall activity is for any particular day, instead of going to an OnlineGuardian portal, they'll go to one with the ISP's name on it," Tennant said. "The customer may never know that Ubizen is managing and monitoring their security devices."

One such company is BCE Teleglobe, which formed a partnership with Ubizen last September to offer managed firewall services, VPN services, intrusion detection systems, vulnerability scanning, and professional services to its customers.

According to Margaret Owens, Teleglobe's Manager of Managed Security Services, the decision to go with Ubizen had a lot to do with Teleglobe's international customer base. "We were looking for a partner who was proficient across multiple security technologies," Owens said. "In addition to that, we were interested in Ubizen's ability to deploy services in three geographically dispersed security operations centers."

Why partner with Ubizen, rather than going it alone? Owens explains that some things are best left to the experts.

"Teleglobe's philosophy in this arena is to leverage the expertise and core competencies of partners in this business," she said. "Particularly in the area of managed security services, there's a great cost savings to working with a partner who has an around-the-clock security operations center capability."

The ability to brand Ubizen's services was particularly important to Teleglobe. "It's important that there's a single point of accountability," Owens said. "If something goes wrong in the network, you have one call to make to have the problem managed. Part of our success so far has been that we have defined airtight procedures between the two companies, so we can deliver a single seamless service to our customers."

Still, Owens, says, it ultimately comes down to the quality of the product. "One of the key differentiators in this market is that, when there's an incident, the person who's alerted about the incident needs to know what to do with it," Owens said. "Ubizen's team of security analysts is very well versed in managing incidents as they occur."

— End

Online Resources:
    Intrusion Detection Systems Directory
    IDS Quick Reference Chart

Related articles:
	[Dec. 24, 2001]	White Paper: Reducing Network Security Risk
	[July 11, 2001]	ISP-Planet Survey: MSSPs