RackFoundry Total Security Management (discontinued)

Ideally RackFoundry would operate as a SEIM-type solution (Security information and event management) for our organization, however that has not been the case. It would be used across the entire company if the product worked. It ideally would solve a number of problems about the lack of contextual information for indicators of compromise, but it doesn't.

I would not recommend RackFoundry to any company whatsoever. At first it seems like a viable solution for the cost. Offering SOC monitoring, implementation and deployment all-in-one seems like a great deal. However it all falls apart when push comes to shoves. As it currently stands we are just over a year into our deployment. All we have to show for it is a fancy web app that does not display any information. In the year that this deployment has been ongoing it has taken us a few months just to get the virtual appliance installed. Then it was another few months of back and forth until we finally got credentials. Then when I finally logged in we began the process of deploying agents and began collecting data. Shortly afterward things began to stall to where they are now. We faced major issues with the web app, scans were not running, assets were not reporting in and data and reports were not being generated. After doing some more research and googling I realized that we were not alone with these issues. Countless other reports from companies who have had similar issues to ours. Each time I ask when the issues were going to be resolved, I got the same answer every time: "The next release should fix the issues you have been experiencing", only for the next release to come, and the issues remain.

We needed a solution for IDS and IPS for our whole organization. After months of looking at providers of IDS and IPS we came upon RackFoundry and to my delight it has been amazing working with them. We have multiple sites that we need secured from attacks and their system is providing us that safety net, so that we can focus on our tasks at hand.

From a cost perspective, I have found that you get more bang for you buck with RackFoundry. I have been researching IDS and IPS companies for months and the cost has always been astronomical, until I came upon RackFoundry. If you need an all in one solution for IDS & IPS, I would highly recommend that you give this company a call.

We initially did a POC of RackFoundry's Total Security Management appliance as we were looking for Intrusion Prevention, Intrusion Detection and a Log Management tool. Their current solution allowed us to do more with less. As with all security we really had a tight budget for the fiscal year. Total Security Management allowed us to procure multiple security functions instead of a single product. I can say I am not disappointed with the product as we passed our PCI compliance, however it does take some time for it to boot up. The setup was easy and took less than 30 minutes and my preferences were set in a span of 2 weeks. Easy to use and user friendly for my team for a mid size asset count.

RackFoundry Total Security Management (TSM) is suited for most companies that have the same challenge as my team had. If you are looking to purchase one security tool and spend most of your allocated budget then I would not recommend this for you. However, if you are looking for something close to a single pane of glass, (granted there is no such thing) this solution does come close as they have the main components built in such as their FW/IPS/IDS/SIEM. Before selecting RackFoundry we had two options which were: 1) Upgrade our current solution and spend an overbearing amount 2) Search for new vendors and maybe procure 1-3 devices and then manually integrate them. Because this was a unified console and integration between devices was simple, we were able to obtain 4-6 security functions and we even had some sense of security visibility via the SIEM. It's not as powerful as SPLUNK or LogRhythm, but it definitely does the job.