Viewpoint: Correlate SIMs and log management


This article can also be found in the Premium Editorial Download "Information Security magazine: How to dig out rootkits."

Download it now to read this article plus other related content.

Thumbs Up
I wanted to extend a hearty well done and congratulations to your staff for the awesome work you did on the July/August issue of Information Security magazine (CISO Survival Guide). Each page of the issue had something

    Requires Free Membership to View

useful and meaningful to me as a CISO and security professional. Also, I really liked the use of colors and layout--for some reason the yellow really was an appeal to the many pages.

Very well done; my compliments.

Ernie Hayden, CISO, Manager Enterprise Information Security, Port of Seattle

Correlating SIMs and Log Management
I read with great interest your recent article ("Providing Clarity," June 2007) that focused on security information management (SIM) tools.

The article touched very briefly on "the fine line" between log management tools and SIM. From my experience working with customers, best practices in log management play a key role in successful security and compliance initiatives. Therefore, I would suggest that any organization currently researching SIM tools would benefit from looking into this correlation.

SIM and log management tools are intrinsically linked: If we think of the general phases of data analysis as acquisition, examination, utilization and review, then log management corresponds to the automated parts of acquisition and examination, and SIM functionality would then represent the "contextual" parts of examination, utilization and review. In order to get that value (analysis) out of your raw information and all of your data, you have to be able to capture and manage it first. Log management capabilities form the foundation for the event analytics that eventually support the success of security and compliance initiatives.

Additionally, since security and compliance log event data has emerged as a critical type of information, it is imperative that organizations effectively manage it. To do this correctly, businesses must actively consider the management of security/ compliance event log data over the complete security information lifecycle, from the time the event record is generated through the time it is no longer needed for compliance or audit purposes. Only then will they have an effective security information management solution.

Andy Smith, Director Product Management, Information and Event Management Group, RSA, The Security Division of EMC

This was first published in September 2007

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: