Should IDS and SIM/SEM/SIEM be used for network intrusion monitoring?

BROWSE BY TAG Network Security,   Network Intrusion Detection and Analysis,   Security Event Management,   Enterprise Network Security,   VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Network Security How to set up a split-tunnel VPN in Windows Vista What is the difference between static and dynamic network validation? Port scan attack prevention best practices Securing the intranet with remote access VPN security How to prevent network sniffing and eavesdropping How to implement virtual firewalls in a complex network infrastructure How to manage network bandwidth with distributed ISP bandwidth How to edit group policy objects to give a user local admin rights How to prevent operating system cloning with AES 256-bit encryption How to securely connect a LAN POS to a remote point-of-sale device Security Event Management Network traffic collection, analysis helps prevent data breaches Best Security Information and Event Management Products Understanding PCI DSS compliance requirements for log management Data breach notification legislation: What info must be released? How to prevent a denial-of-service (DoS) attack Mature SIMs do more than log aggregation and correlation The top 5 network security practices SIMs tools and tactics for business intelligence SIEM: Not for small business, nor the faint of heart Tying log management and identity management shortens incident response

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary security information management (SIM)  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

Generally speaking, a SIM/SEM/SIEM network intrusion monitoring system is an enhancement to an existing IDS. It will store and further process the logs generated by the IDS and allow you to correlate IDS entries with other security events, such as vulnerabilities detected by a network scanner. The use of a SIM/SEM/SIEM can greatly reduce the amount of time spent reviewing log records by automating the task.

That said, SIM/SEM/SIEM devices are expensive. If you don't have the budget to purchase a good SIM/SEM/SIEM, you're probably better off doing network intrusion monitoring yourself than installing a marginal quality SIM/SEM/SIEM. Less sophisticated systems integrate with fewer of your security devices, require more extensive configuration and maintenance and will probably increase the total cost of ownership.

You shouldn't lose any data between your IDS and your SIM, but it's always a good idea to monitor log data and keep IDS logs as a backup in the event the SIM malfunctions or becomes unavailable.

For more information:

• Learn how to mine enterprise SIM logs for relevant security event data.
• Don't have a SIM? Find out how to check for attack data on network logs without SIMs