This tip is part of SearchSecurity.com's Integration of Networking and Security School lesson Marrying security and network management tools. Visit the school and lesson home pages for additional learning resources.
The integration of security and network operation centers has become a hot topic among security and information technology professionals looking to not only consolidate tools and resources of their respective organizations, but also to harness and manage their shared nemesis: risk.
Traditional organizations build separate infrastructure for monitoring security and network events. It makes sense since network operations teams are concerned with statistics like "meantime between failures" (MTBF), which is tied to service level agreements (SLAs), server utilization, heat issues and alike. On the other hand, the information security team is tracking security events generated by the same servers, routers and other infrastructure. They track worms and viruses, check email security status and overall information security health of the organization. With these many varied interests and functions, SOCs and NOCs operate separately using their own tools and resources and all the while, they are both managing risk.
A bit about SIMs
In the past three years, security information management systems (SIMs) have become the type of technology that security operations centers are built on. Intrusion detection and prevention systems (IDS/IPS), firewalls, routers, server farms and network access control infrastructure all can send their security events to a SIM through SNMP or SYSLOG. That means there is no longer a need to have multiple consoles to monitor these environments. SIMs have built-in correlation and intelligence to decipher millions of alerts and report only those that are critical in nature. Today's SIM technology even includes system health information, although this is not a SIM's primary function.
However, the br
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
oad functionality and other benefits of SIMs come with a price: complexity in implementation and operation. Some of the complexities have been highlighted below.
Requires many changes to policies, procedures, and processes
Generates constant, ongoing alerts (which requires monitoring)
SIM challenges
Perhaps the biggest challenge in a successful SIM project is not overcoming deployment issues, like training the personnel on using the technology, but managing the aftermath of deployment, when all of the mission-critical and vital business infrastructure components are sending their security events to the SIM database. Even with the correlation engine tuned and most basic out-of-the-box filters in place, the number of alerts generated could be overwhelming.
In a typical scenario, the number of false positives (false alerts, where one is generated that in actuality does not exist) comprised almost 80% of the total alerts reported. The problem is that without thorough study and investigation, even the most technically knowledgeable staff cannot be certain that an alert is in fact false positive.
To integrate a SIMs into a useful tool that both SOC and NOC team members can utilize, the process of successfully "filtering" alerts takes utmost priority. Below are helpful tips on filtering SIM events:
Mainframe (AS400)
Work with SIM vendor to sort through alerts
Provide alert detail to CISO
Provide alert detail to system administrators
Stop message flow from the source
Stop message flow at SIM
Examine "canned" rules & write rules customized for your environment
Cross-training personnel
In a study designed to measure ROI of integrating SIMs into network services at Interval International Inc., one of the biggest surprises was how beneficial "early" cross training was. Interval sent a senior information security analyst (SISA) and a senior network engineer (SNE) to an offsite vendor cross-training program. For a period of six months following the formal training, two network personnel worked with the SIM team rotating shifts for six hours per week. The SISA also spent time with the network team, working on fine-tuning the HP OpenView tool and managed to send its SNMP traps to the SIM database.
A study showed that productivity of both department increased by more than 22% in the last quarter of fiscal year 2007. However, the intangible and immeasurable index of team building and increased integration effort are invaluable.
In summary, despite the numerous challenges of using SIMs to help integrate NOCs and SOCs, it is worthwhile because of the ability to monitor events in real time, introduce an event-correlation engine or network behaviorial analysis detection (NBAD), improve forensics analysis, and essentially have it serve as the foundation for your SOC team and improve the NOC group's efficiency.
About the author:
Sasan Hamidi is currently the chief security officer for Interval International, a global vacation and timeshare exchange company headquartered in Miami. Interval is a company under the umbrella of InterActive Corp. with sister organizations such as Expedia, HSH, Hotels.com, TicketMaster, Lendingtree, HotWire and a host of others. Hamidi is a frequent industry speaker, including at Information Security Decisions.
