Security Management Strategies for the CIOThis Q&A is part of SearchSecurity.com's Integration of Networking and Security School lesson, Application and network log management program planning. For more learning resources, visit either the
Requires Free Membership to View
lesson page or the Integration of Networking and Security School main page.
Log aggregation seems so "turn of the century:" everyone is already doing it, so why should companies spend time and resources addressing it now? The answer is because they probably have a huge blind spot: Most applications don't log well.
In this interview, SecurityCurve's Diana Kelley discusses application event log management with James McGovern, enterprise architect and scecurity thought leader for a Fortune 500 enterprise headquartered in Connecticut. McGovern explains why he believes application logging is the "final frontier."
Diana Kelley: Jim, don't all IT professionals already have everything they need to
aggregate logs and use them intelligently?
James McGovern: A fool with a tool is still a fool. Having a network security engineer
review the logs of an application for security breaches increases the odds of failure. Why? Because
there's an interesting, and fine, line between leveraging developers and attempting to think that
it is a simple matter of comprehensive documentation for someone else to review.
Generally speaking, it is easier to teach a developer how to code securely than it is to help a
network security engineer understand logs within a software development environment.
DK: Are you saying developers need standards?
JM: Yes. If you were to look at the plethora of software products from Oracle, HP, EMC, etc., do
you think they all adhere to a common logging format? They don't! If companies that make their
living off developing software don't get it right, can we expect a large enterprise to? We need an
[independent] organization to lead a cross-industry consortium to work on the challenges in this
space related to standards, semantics and interoperability.
DK: I definitely agree with you on that! Interoperability and normalization of log formats,
including the syslog standards work going on within organizations like the IETF, will help with log
management processes. First by providing aggregator solutions more effective ways to gather
critical log data, and secondly by helping parsing engines to derive better information about
current, future, and past activity on the network and applications. Let's go back to the challenges
many companies face now and how to address them.
JM: So, you've got a log management appliance. How many enterprises have ever asked their software
vendors about log management integration at procurement time, or even RFP? Can this gap be closed
by a few reusable clauses in procurement agreements?
DK: That's a great point: log management requirements don't need to be re-invented for every new
device or system component RFP; re-use of existing wording reduces RFP creation time and, when
written properly, ensures the requirements are defined consistently. What do you think is the most
important use of log management for enterprises?
JM: It's the way in which we understand what is happening in the enterprise. If we can't understand
activity and access, there's no way we can understand impact to the business. It sounds simple, but
it's very complicated. The logs need to address access and activity or there's no way log
management can parse it usefully. It is cause and effect.
DK: How else can companies improve?
JM: Don't treat log management like a reporting activity. We simply have too many lists and too
many spreadsheets. More importantly, we need to do alerting not just on the characteristics of
individual rows, but also on sets. For example, if you happen to have been smart enough to develop
a log management "profile" for your application, you may know how many failed authentication events
occur on average within a specified time period. Wouldn't it be beneficial to know if the number
were higher than average or even lower to detect activity trends?
DK: What about outages? Do log management systems become blind sides?
JM: Logs are wonderful for outages. Having sat through many crisis calls with business customers
and a major revenue-generating application being down, I can certainly say that the chaos of
everyone gathering information in silos is suboptimal. Unlike current processes that involve
speculation and heroics, logs are an actual fact of what happened. If you are going to assemble a
team, it would be great to write reports in real-time to put together the pieces.
DK: Any final words of advice for your peers?
JM: Log management is not just about security. Imagine having the ability to aggregate logs from
firewalls to applications such that you can analyze the customer experience for your top ten
business relationships. Surely, current Web reporting and other coarse-grained approaches aren't
sufficient to truly understand the customer experience. Well-designed application logging would
take the customer experience into account.
About the author:
Diana Kelley is a partner with Amherst, N.H.-based consulting firm SecurityCurve. She formerly
served as vice president and service director with research firm Burton Group. She has extensive
experience creating secure network architectures and business solutions for large corporations and
delivering strategic, competitive knowledge to security software vendors.
Join the conversationComment
Share
Comments
Results
Contribute to the conversation