Proactive Security Management - Large Enterprise Business - HP

Complying With Changing Regulations
Problems with privacy and lack of security have had enough press and public attention to induce widespread
and far-reaching changes in the way we interact with governments, businesses, and organizations.
Legislative organizations, standards bodies, and industry-specific groups have created laws, standards,
and certifications to guide or mandate how we create, store, use, and communicate information.
In the U.S., for example, the Sarbanes-Oxley regulation requires public companies to show that they
preserve the integrity of corporate financial information and take steps to protect that information
from unauthorized access. Another U.S. example is the Health Insurance Portability and Accountability
Act (HIPAA), which requires enterprises to take meaningful steps to preserve the confidentiality of customer/patient
information. Controls such as these drive the functionality of the security infrastructure
and require proof of compliance by methods of auditing and event logs.
Proactive Security Management Framework
Proactive security management is comprised of three subcategories:
• Security management processes
• Security management tools
• Enabling technologies
Security Management Processes
Simply having technology and tools does not ensure proactive security management. A combination of
people, procedures, and technologies is required to fully implement a proactive security management system.
Although most companies recognize the importance of preventing and managing information security
incidents, many have limited knowledge of how to do this effectively. And few companies have designed
and implemented incident prevention and management processes. This results in companies responding
reactively to incidents and losing millions of dollars each year in cleanup efforts. Awareness and training are
important security tools. Capturing and documenting best practices helps to continually improve capabilities
and avoid security incidents—or at least respond effectively to them.
Security Management Tools
Certain tools make proactive security management more effective, more efficient, and less complex.
Critical tasks for these tools include gathering and correlating security events; coordinating and automating
responses to attacks; monitoring, testing, and managing patch and update status; prioritizing vulnerabilities
and responses based on the scale of the threat; and linking to business objectives.
Gathering and Correlating Security Events
Although most companies
recognize the importance of
preventing and managing
information security incidents,
many have limited knowledge
of how to do this effectively.
Ideally, management tools collect and report faults from a wide range of subsystems in a centralized
fashion. Effective reporting, however, can generate a lot of information. Event filtering tools help system
administrators focus on the critical issues.
To be most effective, the tools not only report on specific incidents, but also on broader usage and
trends. For example, information from several devices may not reach the alarm threshold for each
device, but the information might expose a blended attack or an attack that is trying to remain
undetected. Correlating information from different devices assists administrators with finding root
causes, determining effects, and making efficient decisions.
Proactive Security
Management
3–5