Datasheet

GOVERNMENT

Improving the Nation’sCybersecurity
Executive Order 14028, “Improving the Nation’s Cybersecurity” is an important step towards protecting against the increasing volumeand danger of cyber attacks. This mandate reinforces the need for log and event management and explicitly notes the importance ofcollecting, sharing, and storing event data.
While the executive order and subsequent memos are unquestionably setting the right direction, there are challenges around cost andspeed of delivery for this ambitious scope of requirements. Confluent stands ready to help agencies realize this new vision for federalcybersecurity by meeting the data demands and requirements while leveraging existing investments.

Bolstering Log and Event Management is Key to Cybersecurity
A central piece of the executive order is the collection, logging, and sharing of events in near real-time across tools and organizations.
Collecting, correlating, and getting a view across events is the only way to be aware of all active and potential attack vectors adversaries
can take. As with anything else, it’s important to use the right tooling for the problem.
Security Incident and Event Management (SIEM) solutions are optimized for data at rest and search rather than data in motion, the way
data about today’s fast moving threat landscape should be accessed and analyzed.

“Rather than storing the data away in silos, where it’s static, and bringing retroactive questions
to the data, what you want to do is publish your data as a constant stream and deliver it to thequestions for real-time analysis.”— will laforest, confluent public sector cto
Confluent, powered by Apache Kafka®, is the data-in-motion platform purpose-built for scalable, durable, and highly efficient event
logging and sharing. Confluent enables customers to create a central nervous system so that tools can rapidly get the right data andfeed it to organizations when and how they want it.

The Role of Data Mesh
Data mesh is an architecture that embraces the ubiquity of data in connecting processes. It decouples all the different actors within anorganization, so they can all produce and consume independently. It views data as a product, a shift from the traditional monolithic data
infrastructures focused on the consumption, transformation, and storage into numerous data stores of different types. Instead, datamesh allows each domain to handle their own pipelines and independently produce data for downstream consumers. Data mesh is theconnective tissue between these domains and their associated data assets to create a universal interoperability layer.
Modern cyber defense architecture must move to event streaming to provide a data mesh for receiving, logging, processing, and sharing
data with cyber defense tools like SIEM, SOAR, and Machine Learning. The commonly seen 1-to-1 direct data path is ineffective forenterprises that typically have multiple tools both commercial and open source, and operational environments that need to be able toselectively access data.
© 2023 Confluent, Inc. | Confluent.io1

Datasheet | Improving the Nation’s Cybersecurity

EVENT SOURCES

COLLECTIONCOMPONENTS

AGENCY
Agency 1

FirewallBeats

Routers &Switches

Component

Network Sensors
System Logging
Windows Events

Kafka Connect

Component
Application Logs

Identity &Credentials
Wi-Fi, DHCP

ArcSight Agents

Component
System Perf
Metrics

IP, DNS

SplunkForwarders

Component

Agency 2

Confluent helps meet the Executive Order requirement for event forwarding andevent log management in collecting, aggregating, routing, and sharing data.

Data in Motion in Practice

Get Your Data Moving

A large Defense agency program was responsible for supporting
cyber defense across over 20 locations and multiple tiers as ashared service. In addition to monitoring and detecting threats
they also needed to provide the data to numerous mission
partners for their own operations. They found that using a SIEM
vendor stack alone was cost prohibitive for the volumes of data
they had. Additionally the SIEMs had to be treated independently
and could not be tied together for a holistic, global view of thedata and made it hard to share data with all the stakeholders.
Finally, the SIEM was not designed for the volume of data
ingestion and analysis required by the program and it often failed
to meet performance requirements.

A Data in Motion approach will enable a more proactive approachto cybersecurity while also:

The agency began using Confluent as a data fabric for all thecyber data, running in all their locations where it receives andprocesses the data (normalizing, enriching, and routing withKafka streams and KSQL). Confluent’s multi-region replication
aggregates up into regional hubs, and then into a central location.
This architecture allows them to perform real time dataprocessing and analysis, allows their customers to subscribe toKafka for the real time feeds of data that they care about while
enforcing authorizations and permissions. It also decreases costand improves scale, and makes global operations practical while
optimizing network bandwidth.

• Reducing storage, network, and licensing costs• Enabling tiered and cold storage out of the box to support OMB
requirements in a cost effective manner• Providing aggregation at the Component and Agency level
through Confluent replication• Leveraging existing cyber investments via connectors• Making data available to FBI and CISA in real time with outof-the-box capabilities• Providing real time threat detection abilities at edge
• Enabling open ecosystem and preventing vendor lock-in• Providing built in auditing to support requirements on tracking
usage of data
• Providing RBAC to lock down data to only those who have ajob related need
• Providing Schema catalog with APIs for sharing of data
schemas with consumers
Getting your data in motion requires careful planning and theright partner. Confluent powers an event streaming platform
with the needed flexibility, durability, resilience, and security
required for complex, large scale cybersecurity operations.
Confluent Platform supports Government goals of zero trust,logging, endpoint detection response, and software security.

Ready to get started? Contact a Confluent expert today
Email us on publicsector@confluent.io | Or visit confluent.io/get-started for more details© 2023 Confluent, Inc. | Confluent.io2