PRO+ Premium Content/Information Security magazine

Among all the things that would benefit security and improve defenses, insight must rank among the first. We need it to identify when, where and how attacks occur -- and succeed. With insight, we could see how access privileges are being misused or abused, or when what looks like legitimate access is actually fraud. We could also understand how and where investments can be better applied to strengthen security and mitigate risks. However, this kind of insight is highly elusive. The reality is most organizations struggle with making use of the security information they already gather. In a recent Enterprise Management Associates (EMA) study of 200 organizations of 1,000 personnel or more worldwide, 58 percent of those knowledgeable about security log and event management say they collect more than 50 gigabytes of this data each day. Fifteen percent say they collect a terabyte or more. If each event is averaged at 300 bytes apiece, that’s more than three billion log events daily. The sheer volume of security data is not the only ...