This tip is part of SearchSecurity.com's Integration of Networking and Security School lesson Marrying security and network management tools. Visit the school and lesson home pages for additional learning resources.
The integration of security and network operation centers has become a hot topic among security and information technology professionals looking to not only consolidate tools and resources of their respective organizations, but also to harness and manage their shared nemesis: risk.
Traditional organizations build separate infrastructure for monitoring security and network events. It makes sense since network operations teams are concerned with statistics like "meantime between failures" (MTBF), which is tied to service level agreements (SLAs), server utilization, heat issues and alike. On the other hand, the information security team is tracking security events generated by the same servers, routers and other infrastructure. They track worms and viruses, check email security status and overall information security health of the organization. With these many varied interests and functions, SOCs and NOCs operate separately using their own tools and resources and all the while, they are both managing risk.
A bit about SIMs
In the past three years, security information management systems (SIMs) have become the type of technology that security operations centers are built on. Intrusion detection and prevention systems (IDS/IPS), firewalls, routers, server farms and network access control infrastructure all can send their security events to a SIM through SNMP or SYSLOG. That means there is no longer a need to have multiple consoles to monitor these environments. SIMs have built-in correlation and intelligence to decipher millions of alerts and report only those that are critical in nature. Today's SIM technology even includes system health information, although this is not a SIM's primary function.
However, the broad functionality and other benefits of SIMs come with a price: complexity in implementation and operation. Some of the complexities have been highlighted below.
- Deployment requires extensive planning
- Too many alerts in one place (filtering is a complex and time consuming task)
- Needs dedicated resource(s)
- Technically challenging to operate
- Training takes too long
- Tweaking the system is challenging:
- Eliminating false positive
- Finding false negatives
- Requires many changes to policies, procedures, and processes
- Generates constant, ongoing alerts (which requires monitoring)
SIM challenges
Perhaps the biggest challenge in a successful SIM project is not overcoming deployment issues, like training the personnel on using the technology, but managing the aftermath of deployment, when all of the mission-critical and vital business infrastructure components are sending their security events to the SIM database. Even with the correlation engine tuned and most basic out-of-the-box filters in place, the number of alerts generated could be overwhelming.
In a typical scenario, the number of false positives (false alerts, where one is generated that in actuality does not exist) comprised almost 80% of the total alerts reported. The problem is that without thorough study and investigation, even the most technically knowledgeable staff cannot be certain that an alert is in fact false positive.
To integrate a SIMs into a useful tool that both SOC and NOC team members can utilize, the process of successfully "filtering" alerts takes utmost priority. Below are helpful tips on filtering SIM events:
- Break down each device group
- Firewalls (Check Point, NetScreen)
- Host-based IDS (Cisco Security Agent)
- Network-based IDS (Sourcefire)
- Network devices (routers, switches)
- Servers
- UNIX (Solaris, Linux)
- Windows (2003)
- Mainframe (AS400)
- Work with SIM vendor to sort through alerts
- Requires great deal of time & patience
- Expertise
- Provide alert detail to CISO
- Provide alert detail to system administrators
- Normal chatter?
- Cut off from source
- Stop message flow from the source
- Sys admin will turn off messaging for a specific event at the source
- Stop message flow at SIM
- Rules can be written to ignore the message
- Action can be "drop" - eliminates the message all together from the database;
- Or "store" - ignore the message but keep it in the database for future use. Future use could include forensics and compliance
- Examine "canned" rules & write rules customized for your environment
Cross-training personnel
In a study designed to measure ROI of integrating SIMs into network services at Interval International Inc., one of the biggest surprises was how beneficial "early" cross training was. Interval sent a senior information security analyst (SISA) and a senior network engineer (SNE) to an offsite vendor cross-training program. For a period of six months following the formal training, two network personnel worked with the SIM team rotating shifts for six hours per week. The SISA also spent time with the network team, working on fine-tuning the HP OpenView tool and managed to send its SNMP traps to the SIM database.
A study showed that productivity of both department increased by more than 22% in the last quarter of fiscal year 2007. However, the intangible and immeasurable index of team building and increased integration effort are invaluable.
In summary, despite the numerous challenges of using SIMs to help integrate NOCs and SOCs, it is worthwhile because of the ability to monitor events in real time, introduce an event-correlation engine or network behaviorial analysis detection (NBAD), improve forensics analysis, and essentially have it serve as the foundation for your SOC team and improve the NOC group's efficiency.
About the author:
Sasan Hamidi is currently the chief security officer for Interval International, a global vacation and timeshare exchange company headquartered in Miami. Interval is a company under the umbrella of InterActive Corp. with sister organizations such as Expedia, HSH, Hotels.com, TicketMaster, Lendingtree, HotWire and a host of others. Hamidi is a frequent industry speaker, including at Information Security Decisions.
