Security Management Strategies for the CIOAccess "Tying log management and identity management shortens incident response"
This article is part of the April 2009 issue of Real-world solutions for data loss prevention
Incident response was tough enough when the challenge was getting to the bottom of what happened. For most organizations, when an incident is detected or suspected, gathering enough data to piece together what happened requires several hours of work piecing the logs together. The reason is simple: The majority of security appliances report what happened, but not who was behind the activity, historical information about that system or similar events. But today, regulatory compliance requirements are built on a strong security rationale for tying identity to activity. The reality is that compliance is driving organizations to do log management, and tying identity to activity helps get budget. Sarbanes-Oxley (SOX), for example, calls for strict controls over access to financial records, and that means it's critical to spot unauthorized activity by human beings. "Organizations that perform log analysis are constantly reacting to events on the network, while still trying to be proactive," says Ron Gula, CTO Tenable Security. "When logs are tied to user identities... Access >>>
Access TechTarget
Premium Content for Free.
What's Inside
Features
-
-
Tabletop exercises sharpen security and business continuity
Delaware's Dept. of Technology and Information conducts annual incident response exercises that test the readiness of state agencies to respond to real attacks. Learn how simulated cyberattacks and incident response exercises help organizations prevent future attacks and maintain business continuity.
-
Data loss prevention benefits in the real world
by Rich Mogull
DLP promises strong data protection via content inspection and security monitoring, but real-world implementations can be complex and expensive; these eight real-world lessons help you use DLP to its fullest.
-
Tabletop exercises sharpen security and business continuity
-
-
Tying log management and identity management shortens incident response
Tying log management to user identity shortens incident response and forensics investigation cycles. Learn how compliance has mandated that organizations determine not only when incidents occurred, but who is responsible for unauthorized access.
-
Tying log management and identity management shortens incident response
-
Columns
-
Sell the business on virtualization security
Executive management sees virtualization as the cure-all, but CISOs need to ensure it is done securely. Learn how virtualization can help you position security as a business enabler.
-
SaaS security risks must be addressed
Realize quickly that software as a service and cloud computing are the future computing infrastructures IT must secure.
-
Web browsers remain vulnerable to user mistakes
Hackers continue to bore holes in Web browsers, exploiting users with social engineering tricks to gain unauthorized access to systems and data.
-
Sell the business on virtualization security
More Premium Content Accessible For Free
Unlock new pathways to network security architecture
E-Zine
Network security architecture is showing its age at many organizations. With new technology, different data types, and use of multi-generations of ...
Emerging threat detection techniques and products
E-Handbook
Advanced persistent threat (APT) has been a used and abused term in the security industry, but security experts say targeted attacks are a growing ...
The rapid evolution of MDM solutions
E-Zine
Mobile device management (MDM) continues to grow at a feverish pace, both in terms of adoption and mobile security features. BYOD policies, and the ...