Security Event Management is system that provides log management, analysis of log files and monitoring of logs files for security incidents. It is designed as a suite of security tools that can be used by IT management or infrastructure security specialist with interest in monitoring and protecting physical and/or logical assets. Implementing Security Event Management can be a large and complex process and if not done correctly can result in data loss or systems being compromised.
Below are the components that make up Security Event Management.
Log Management
A log is a record containing information on the events and actions that have occurred on a computer system or network. Whether it be a server, firewall or an application most all devices generate some type of log, that record information on events to the system or network. Log files where originally used only for troubleshooting, but have evolved to serve many functions within an organization. Other functions of a log file include: network and system performance, monitoring user activity, recording security events (bad password attempts), malicious activity, and monitoring for errors or device failures. Logs have matured over the years to record activity on a vast amount of infrastructure devices. Some devices even generate multiple log files one being a security event log. The security logs should not be overlooked and is the primary reason for Security Event Management.
Log management provides a solution for storing computer security events, in detail for a specific time period. Reviewing the log files is an important step for identifying security incidents, violations of company policy, malicious activity and to provide detailed information for resolving such problems. Log management can also be used for auditing, compliance analysis, creating system baselines, and identifying trends in your assets,
Log Management can be an overwhelming and challenging task but by following a few simple rules these challenges can be avoided. Below is a brief explanation of some simple steps to take when implementing Security Event Management.
Identify and prioritize log management needs: An organization should define its goals and requirements for monitoring log files. Resources can then be allocated accordingly to help meet those goals and reduce the risk of critical steps being overlooked.
Define log management policies and procedures: Policies and procedures need to be put in place to ensure that there is consistency throughout the organization. Another reason is some organizations are audited to ensure they meet certain standards and or laws, without having policies and procedures in place these expectations would be hard to meet.
Plan for a robust secure log management infrastructure: A log management system will be handling a large amount of data which will contain sensitive and confidential data. When planning for a log management infrastructure, security and redundancy needs to be considered, for preserving data integrity and loss of data.
Provide enough resources to handle the responsibilities of log management: A log management system is no good unless you have the properly trained staff to handle the work load. Staff needs to understand the concepts, tools, technical details, analysis and other responsibilities that go along with log management.
Log Analysis
The next component of Security Event Management is log analysis. Log analysis can be one of the most challenging components to event management, but it is also the most important. Log analysis is often viewed as a dreadful task as it usually is thought of as manually reviewing data in log files. With the right infrastructure in place most of the analysis of log files can be automated. Thus taking less staff time and allocating resources to produce more valuable results.
Data within the log file can contain a vast amount of information. Along with that each device monitored may produce a different log file format. This makes it impossible to gain a full understanding of log files. It is important to understand as much as possible about log data but certainly not expected to understand all details. The best way to gain knowledge of log files is to review and analyze small amounts on a daily basis. This will get the administrator familiar with all the different log entries and help to establish a baseline of what typical entries are being logged.
The beginning phase of log analysis is the most challenging. This is because it can be very time consuming to understand the importance of the log entries. Once the process has matured you will be able to establish a baseline of your log activity. This baseline will also help streamline the analysis phase. When the administrator identifies which log entries are most important, the log files can then be filtered. Filtering allows certain events to be flagged and actions can be carried out on those flagged events. Filtering also saves system resources such as disk space and cuts down on the manual review process of log files.
Monitor and responding to Security Log Events
The last component to Security Event Management involves monitoring and alerting of the log files. Administrators can monitor for certain events and have the system generate an alert when that event occurs. Alerts are usually sent through email or directly to a cell phone by text messaging. Once an alert has been received the administrator should follow the organizations security response procedures to address the security incident. Some common examples of events to monitor include: virus activity, large number of bad password attempt, port scanning, ping sweeps, unauthorized access and high bandwidth usage.
It is recommended that security related incidents be reported and logged. This allows for management to run reports, address staff of events and identify security holes within the organization. Over a course of time the log configuration may need to be changed due to response to security events.
Summary
In summary Security Event Management provides a solution for log management, log analysis and monitoring of logs to identify security events. Combining these components IT staff can provide the tools necessary to monitor and protect physical and logical assets. There is no out of the box solution for securing assets. Each organizations implementation of Security Event Management will be different. This is because organizations have different environments, assets and needs for protecting against security threats.
Incoming search terms:
- event management security
- log management policy
- prioritize event log errors monitoring
- security event log review process definition
- security event monitoring policy
- security log monitoring plan