New Tachyon Promotes Ad Hoc Security Queries

One of the major security issues of 2017 is visibility. Both network and security operations professionals want to know what's happening on the network and what it means for the network and its users.

1E, a publisher of software lifecycle automation tools, has released Tachyon as a tool for providing visibility and automating the response to a variety of events and conditions.

Tachyon is described as an endpoint detection and response (EDR) system intended to scale up to millions of endpoints across a network. According to 1E CEO Sumir Karayi, one of the key technology steps required for this level of scaling is to reduce both the amount of data involved in monitor and response transactions, and the amount of data stored in a database for analysis.

In a telephone interview with Light Reading, Karayi said that the central database has become a weak link in two critical areas of endpoint monitoring: scaling and ad hoc queries. When it comes to scaling, he pointed out that many systems requires tens to hundreds of megabytes of data to be stored for each endpoint. It doesn't sound like a great deal of data, but when scaled to hundreds of thousands or even millions of endpoints, it represents a huge volume.

More important, said Karayi, "It's data that's out of date from the moment it's stored."

In a dynamic commercial environment, endpoints may change on a minute-to-minute basis, and Karayi said that it's more effective to simply query the endpoints at the time a report is generated. That live query means that it's also no more difficult to ask an ad hoc question than one that was planned six months in advance, and in his recent conversations with system administrators it's those "on the fly" questions that are the most important.

Security is, according to Karayi, now inextricably linked to IT operations. IT operations, for its part, "...is serving the needs of every part of the organization," he said.

In an ideal system, operations staff will be able to understand the needs of a business unit, find out whether endpoints are supporting those needs and make adjustments to bring the endpoints into compliance within minutes rather than days.

1E Tachyon is in general availability now, and is compatible with every major endpoint operating system and a wide variety of servers and enterprise configuration management systems.

— Curtis Franklin, Security Editor, Light Reading