NetWitness Platform - Security

[#1]

How does NetWitness ensure the NetWitness Platform is secure?

• Security in SDLC : NetWitness software undergoes various security checks during the SDLC process. Some of the major security controls in place includes (but not limited to) :

  • Vulnerability scanners

  • SAST tool

  • DAST tool

  • SCA tool

• Security Reviews : Important and security sensitive features go through detailed manual security reviews.

• Security Testing : Every year the product goes through an independent 3rd party penetration testing

• Address Vulnerabilities : Vulnerabilities identified from the above-mentioned exercises are ticketed and tracked.

• Certification : Exercises like Common Criteria certification for various NetWitness versions ensure security is looked at from various perspectives.

• Validate Reports : Customer reports as well as reports through Responsible Disclosures are validated by the security team and if found to be a valid RISK, they are addressed as per established processes within NetWitness.

• Training : All NetWitness developers are mandated to complete Secure Development Training to ensure they have the right skills and training to ensure security is built-in.

Where can I find details of Security related documents for NetWitness Platform product?

• Security Fixes in the product - Security Fixes  

• Common Criteria certification for 11.7:

  • Certified Products : CC Portal (Search for NetWitness under Network and Network-Related Devices and Systems)

• • • M020 Maintenance Report

    • Common Criteria Certificate for NetWitness

• Common Criteria certification for 11.6:

  • Certified Products : CC Portal (Search for NetWitness under Network and Network-Related Devices and Systems)

• • RSA Netwitness v11.6_v1.0-Final

  • ISCB-5-RPT-C125-CR-v1

  • ISCB-5-CERT-C125-CERTIFICATE-v1

• Security Configuration document: NetWitness Platform security configuration settings and security best practices such as Access Control Settings, Log Settings, Communication Security Settings, Data Security Settings, Alert System Settings, and Other Security Considerations are detailed in this document. See Security Configuration Guide for 12.0

• FIPS Compliance document: Federal Information Processing Standards (FIPS) compliant mode for RSA NetWitness Platform. The FIPS publications are guidelines that set best practices for software and hardware security products for the protection of valuable and sensitive information. See Security Configuration Guide for 12.0

• STIG Compliance document: NetWitness Platform is STIG compliant and helps to lock down information, systems, and software, which might otherwise be vulnerable to a malicious computer attack by limiting account access to a system. See Security Configuration Guide for 12.0

• Letter of Engagement for Penetration Testing done in 2022 (NetWitness Version 11.7.):

         Letter of Engagement  

• Letter of Engagement for Penetration Testing done in 2022 (NetWitness cloud services):

Letter of Engagement 

• Letter of Engagement for Penetration Testing done in 2023 (NetWitness Version 12.2 on-prem & cloud services):

Letter of Engagement

• Letter of Engagement for Penetration Testing done in 2024 (NetWitness Version 12.4 on-prem & cloud services):

Letter of Engagement

CloudSIEM

CloudSIEM is a NetWitness product which uses NetWitness platform software and as such above security practices are applicable to CloudSIEM as well.

Moreover, NetWitness is committed to conducting independent Security tests by 3rd parties annually. The SOC2 initiative for CloudSIEM is in progress.