2KKUU7ita

Chapter 18: Managing Security Processes
✓ Finding critical security events in system log files is difficult, if not
impossible. It’s just too tedious a task for the average human to accomplish
effectively.
✓ Depending on the type of logging and security equipment you use, you
might not even detect some security events, such as intrusion detection
system (IDS) evasion techniques and hacks coming into allowed ports
on the network.
Instead of panning through all your log files for hard-to-find intrusions, here’s
what I recommend:
✓ Enable system logging where it’s reasonable and possible. You don’t
necessarily need to capture all computer and network events, but you
should definitely look for certain obvious ones, such as login failures,
malformed packets, and unauthorized file access.
✓ Log security events using syslog or another central server on your network.
Do not keep logs on the local host, if possible, to help prevent the
bad guys from tampering with log files to cover their tracks.
The following are a couple of good solutions to the security-monitoring dilemma:
✓ Purchase an event-logging system. A few low-priced yet effective
solutions are available, such as GFI EventsManager (www.gfi.com/
eventsmanager). Typically, lower-priced event-logging systems usually
support only one OS platform — Microsoft Windows is the most common.
Higher-end solutions, such as HP ArcSight Logger (www.hpenterprise
security.com/products/hp-arcsight-security-intelligence/
hp-arcsight-logger), offer both log management across various platforms
and event correlation to help track down the source of security
problems and the various systems affected during an incident.
✓ Outsource security monitoring to a third-party managed security
services provider (MSSP) in the cloud. Dozens of MSSPs were around
during the Internet boom, but only a few strong ones remain, such as
BT’s Assure managed service (www.globalservices.bt.com/uk/
en/solutions/monitor_my_network_security), Dell SecureWorks
(www.secureworks.com) and Alert Logic (www.alertlogic.com).
Now considered cloud service providers, the value in outsourcing security
monitoring is that these companies often have facilities and tools that
you would likely not be able to afford and maintain. They also have analysts
working around the clock and have the security experiences and
knowledge they gain from other customers to share with you.
When these cloud service providers discover a security vulnerability or
intrusion, they can usually address the issue immediately, often without
your involvement. I recommend at least checking whether third-party
333