NETWORK SECURITY TACTICS
Establishing a practical routine for reviewing security logs
Lenny Zeltser
09.19.2006
Rating: -2.68- (out of 5)
|
The term security information management (SIM) refers to the discipline of collecting and analyzing security events to detect or investigate malicious activities. Essential to this process are the individuals who review the gathered data and decide whether the events constitute an incident and should be escalated. Information security logs that are not regularly reviewed are hardly useful and can be a liability to an organization.
Sometimes reviewing security logs can be fun. Don't get me wrong -- sifting through mounds of data to identify the notable events is not always my favorite pastime. However, the pursuit of correlating seemingly unrelated events, determining the cause of an unusual alert or detecting an intrusion at its onset can be pretty rewarding.
Even though the review of security logs is cri
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
tical to the success of a SIM program, doing so regularly and comprehensively is not easy. Here are a few recommendations for establishing a process to ensure that important events don't go unnoticed:
A practical routine for reviewing security logs is regularly scheduled, partially automated, alternated among team members, and linked to problem resolution. Not only will such processes bring vigilance to the log-reviewing duties, but it will also ensure that an organization gets the most out of the valuable data captured by the its SIM systems.
About the Author:
Lenny Zeltser is the information security practice leader at Gemini Systems LLC, a New York-based IT consulting firm, and an instructor at SANS Institute. More information about his projects and interests is available at www.zeltser.com.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
